|
|
05-27-2020, 07:26 PM
Hello,
Recently a dupe was exploited on my server, Apollo. After investigating into my logs I was able to find out the dupe and patch it.
I have decided to release information publicly regarding this dupe, due to a couple of individuals going to other custom servers and attempting to sell information about it.
How it works
The dupe is as simple as logging in on 2 accounts at the same time, and eventually you will get them both to be online at the exact same time. Once they are both online, you can transfer the items to 1 account, then logout and repeat, therefore duping all items on the account.
Very important
There is a fix for this that some Ruse based servers have, that will stop this dupe 90% of the time. However it is still possible to do it, it is just much harder.
An easy fix to this, is to make sure that inside of PlayerHandler.handleLogin method it checks if the account is already online before allowing the player to fully login.
If you need further help with patching the dupe send me a message on Discord for more information.
thanks for sharing
That doesn’t sound like a fix just sounds like a mere obstacle for the duper.
Is a fix if the same account can only log in once at any given time. It's a little bit ambiguous in the OP, but it sounds as if it's a timing attack attempting to log into the same account multiple times.Originally Posted by Abnant
Idk how you interpret thisEdit: oh I see what he means now, a fix that is already implemented but doesn’t fully work. Got it, my bad.However it is still possible to do it, it is just much harder.
I remember doing this on battlescape isle back in 2008 or so
Hi everyone,
Just wanted to share my fix for this problem..
In Trading.java simply add:
This will never allow a player of the same name to even accept the request.Code:if(player.getUsername().equals(player2.getUsername())) { return; }
correct me if im wrong but this "fix" doesn't really fix the original issue? surely if they can login to the same account twice they have the possibility to drop trade/kill in wilderness/stake the items/use a 3rd account with a different name to bypass this?
seems the only logical way to fix this dupe is to stop them being able to log into an account more than once?
| « Command System | [Elvarg/Any] Redone PlayerPunishment » |
| Thread Information |
Users Browsing this ThreadThere are currently 1 users browsing this thread. (0 members and 1 guests) |
