Exploits and Fixes

[Auntie Mangos]

Bug : http://getmangos.eu/community/viewtopic.php?id=8771

possible Fix (not tested since cheat engine does not work for me with linux):

http://getmangos.eu/community/showpost.php?p=96621&postcount=18

[balrok]

maybe you edit your post inside this thread.. else it's quite strange to discuss here about another thread..

to have it work under windows you just can use the mangos's getMSTime()

it's located in src/shared/Timer.h

ps: i don't plan to review it.. spellsystem is too complex for me

[NetSky]

anyways this core sided cooldown check would be good as temporary solution till something like mangos-"warden" is possible ^^

i was thinking of some external program for clients like punkbuster

this would open possibilities to check clients cheating without harming server performance at all

[DasBlub]

this would be bad, as you'd then force the users to install an additional software.

and implementing warden in mangos... i'm not sure about this. from the technical part, this would be *very* interesting, although there might be some criminal potential in that, as you could also abuse this system to run basically *any* on the client side (at least if i understood warden's concept correctly).

[darkstalker]

from what i understood warden uses cryptographic stuff, so you can't send modules to the client withouth the private key that only blizz has

[DaemonCantor]

from what i understood warden uses cryptographic stuff, so you can't send modules to the client withouth the private key that only blizz has

Sorry to butt in to this but I've been following this without saying anything till the last two post showed up DasBlub and darkstalker both have a valid point as in now you both are talking the same language that hakers talk in as in what could posssibly go wrong but the otherside is that if you try to use this cryptographic key system it is illegal under US Law, unless you your selves come up with your own system and implement with your own keys, now that would encompass coming up with your own cryptographic modules and keys which then could be put into public domain.

For those people living outside the US this is probably meaningless, but for ones like myself that do live in the US I have to be fearful of anything in this direction as you can understand why.

Also pardon so there is no misunderstanding "No I'm not calling anyone a hacker, I'm just stating that Hakers look at these things and ask the same question as well as how can we use this?

[Patman128]

from what i understood warden uses cryptographic stuff, so you can't send modules to the client withouth the private key that only blizz has

No, you can send new modules, and yes, you can find the keys to them. They have been decrypted without a problem.