[C++] OfflineShop - Function ADD ITEM <Exploit>

[alberto2010 139]

Can any1 tell me how to solve this exploit ? Shop offline ADD Item exploit.

Video: https://youtu.be/clLZlXH_EKw

 

[VegaS 1058]

I see you've already added my fix for function opening.

All you have to do now is to use your brain 10% to implement and AddItem function.

[alberto2010 139]

so what i need to edit in offlineshop_manager.cpp ?

is somewhere on this script.:

Spoiler

void COfflineShopManager::AddItem(LPCHARACTER ch, BYTE bDisplayPos, BYTE bPos, int iPrice)
{
    if (!ch)
        return;

    // Fixed bug 6.21.2015
    if (bDisplayPos >= OFFLINE_SHOP_HOST_ITEM_MAX_NUM)
    {
        sys_err("Overflow offline shop slot count [%s]", ch->GetName());
        return;
    }
    // End Of fixed bug 6.21.2015
    
    // Check player has offline shop or not
    std::auto_ptr<SQLMsg> pmsg(DBManager::instance().DirectQuery("SELECT COUNT(*) FROM player.offline_shop_npc WHERE owner_id = %u", ch->GetPlayerID()));
    MYSQL_ROW row = mysql_fetch_row(pmsg->Get()->pSQLResult);
    
    BYTE bResult = 0;
    str_to_number(bResult, row[0]);
    
    if (!bResult)
    {
        ch->ChatPacket(CHAT_TYPE_INFO, "Nu ai un magazin privat deschis!");
        return;
    }
    // End Of Check player has offline shop or not

    LPITEM pkItem = ch->GetInventoryItem(bPos);
    
    if (!pkItem)
        return;

    // Check
    const TItemTable * itemTable = pkItem->GetProto();
    if (IS_SET(itemTable->dwAntiFlags, ITEM_ANTIFLAG_GIVE | ITEM_ANTIFLAG_MY_OFFLINE_SHOP))
    {
        ch->ChatPacket(CHAT_TYPE_INFO, "Acest item nu poate fi vandut!");
        return;
    }

    if (pkItem->isLocked())
        return;

    if (pkItem->IsEquipped())
    {
        ch->ChatPacket(CHAT_TYPE_INFO, "Nu poti sa vinzi itemele echipate!");
        return;
    }

    char szColumns[QUERY_MAX_LEN], szValues[QUERY_MAX_LEN];

    int iLen = snprintf(szColumns, sizeof(szColumns), "id,owner_id,pos,count,price,vnum");
    int iUpdateLen = snprintf(szValues, sizeof(szValues), "%u,%u,%d,%u,%d,%u", pkItem->GetID(), ch->GetPlayerID(), bDisplayPos, pkItem->GetCount(), iPrice, pkItem->GetVnum());

    if (g_bOfflineShopSocketMax == 3)
    {
        iLen += snprintf(szColumns + iLen, sizeof(szColumns) - iLen, ",socket0,socket1,socket2");
        iUpdateLen += snprintf(szValues + iUpdateLen, sizeof(szValues) - iUpdateLen, ",%ld,%ld,%ld", pkItem->GetSocket(0), pkItem->GetSocket(1), pkItem->GetSocket(2));
    }
    else if(g_bOfflineShopSocketMax == 4)
    {
        iLen += snprintf(szColumns + iLen, sizeof(szColumns) - iLen, ",socket0,socket1,socket2,socket3");
        iUpdateLen += snprintf(szValues + iUpdateLen, sizeof(szValues) - iUpdateLen, ",%ld,%ld,%ld,%ld", pkItem->GetSocket(0), pkItem->GetSocket(1), pkItem->GetSocket(2), pkItem->GetSocket(3));        
    }
    else if(g_bOfflineShopSocketMax == 5)
    {
        iLen += snprintf(szColumns + iLen, sizeof(szColumns) - iLen, ",socket0,socket1,socket2,socket3,socket4");
        iUpdateLen += snprintf(szValues + iUpdateLen, sizeof(szValues) - iUpdateLen, ",%ld,%ld,%ld,%ld,%ld", pkItem->GetSocket(0), pkItem->GetSocket(1), pkItem->GetSocket(2), pkItem->GetSocket(3), pkItem->GetSocket(4));        
    }
    else if(g_bOfflineShopSocketMax == 6)
    {
        iLen += snprintf(szColumns + iLen, sizeof(szColumns) - iLen, ",socket0,socket1,socket2,socket3,socket4,socket5");
        iUpdateLen += snprintf(szValues + iUpdateLen, sizeof(szValues) - iUpdateLen, ",%ld,%ld,%ld,%ld,%ld,%ld", pkItem->GetSocket(0), pkItem->GetSocket(1), pkItem->GetSocket(2), pkItem->GetSocket(3), pkItem->GetSocket(4), pkItem->GetSocket(5));        
    }

    iLen += snprintf(szColumns + iLen, sizeof(szColumns) - iLen, ", attrtype0, attrvalue0, attrtype1, attrvalue1, attrtype2, attrvalue2, attrtype3, attrvalue3, attrtype4, attrvalue4, attrtype5, attrvalue5, attrtype6, attrvalue6, applytype0, applyvalue0, applytype1, applyvalue1, applytype2, applyvalue2, applytype3, applyvalue3, applytype4, applyvalue4, applytype5, applyvalue5, applytype6, applyvalue6, applytype7, applyvalue7");
    iUpdateLen += snprintf(szValues + iUpdateLen, sizeof(szValues) - iUpdateLen, ",%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d",
        pkItem->GetAttributeType(0), pkItem->GetAttributeValue(0),
        pkItem->GetAttributeType(1), pkItem->GetAttributeValue(1),
        pkItem->GetAttributeType(2), pkItem->GetAttributeValue(2),
        pkItem->GetAttributeType(3), pkItem->GetAttributeValue(3),
        pkItem->GetAttributeType(4), pkItem->GetAttributeValue(4),
        pkItem->GetAttributeType(5), pkItem->GetAttributeValue(5),
        pkItem->GetAttributeType(6), pkItem->GetAttributeValue(6),
        pkItem->GetAttributeType(7), pkItem->GetAttributeValue(7),
        pkItem->GetAttributeType(8), pkItem->GetAttributeValue(8),
        pkItem->GetAttributeType(9), pkItem->GetAttributeValue(9),
        pkItem->GetAttributeType(10), pkItem->GetAttributeValue(10),
        pkItem->GetAttributeType(11), pkItem->GetAttributeValue(11),
        pkItem->GetAttributeType(12), pkItem->GetAttributeValue(12),
        pkItem->GetAttributeType(12), pkItem->GetAttributeValue(13),
        pkItem->GetAttributeType(14), pkItem->GetAttributeValue(14));

    char szInsertQuery[QUERY_MAX_LEN];
    snprintf(szInsertQuery, sizeof(szInsertQuery), "INSERT INTO %soffline_shop_item (%s) VALUES (%s)", get_table_postfix(), szColumns, szValues);
    std::auto_ptr<SQLMsg> pMsg(DBManager::instance().DirectQuery(szInsertQuery));
    pkItem->RemoveFromCharacter();
    
    LPCHARACTER npc = CHARACTER_MANAGER::instance().Find(FindMyOfflineShop(ch->GetPlayerID()));
    if (!npc)
        return;

    LPOFFLINESHOP pkOfflineShop = FindOfflineShop(npc->GetVID());
    if (!pkOfflineShop)
        return;

    pkOfflineShop->BroadcastUpdateItem(bDisplayPos, ch->GetPlayerID());
    LogManager::instance().ItemLog(ch, pkItem, "ADD ITEM OFFLINE SHOP", "");
}

 

[terrorr 14]

20 hours ago, VegaS said:

I see you've already added my fix for function opening.

All you have to do now is to use your brain 10% to implement and AddItem function.

LoL ! You are idiot? Always you say to peoples , usr brain , not free, etc... So why you add something? We know , your brain is best in the world. If you dont wanna answer , so please be quiet you fucking idiot !  Take your systems from comunity and f..k off you dirty prostitute. Now you can suck...

[Alesta2 7]

5 hours ago, terrorr said:

LoL ! You are idiot? Always you say to peoples , usr brain , not free, etc... So why you add something? We know , your brain is best in the world. If you dont wanna answer , so please be quiet you fucking idiot !  Take your systems from comunity and f..k off you dirty romanian prostitute. Now you can suck...

buddy calm down. I think this guy need to more brain cuz... he missed his father material xD

[alberto2010 139]

I didn't solve this but , i deleted functions add item , change time , change price and remove item from system ... it works perfectly only with open shop , close shop and bank.

I already said im beginner in metin2 source so i can't solve these things on my own , i hope i will in the past , but now i chose the easy way to delete functions add item , change time , change price and remove item from system.

Vegas , i know you are a nice guy and you tell peoples to use their brains to solve problems just for their good to learn to solve problems in their own, but you see.. if you are a beginner you can't without a good person to guide you. 

[pbuzz 31]

you can: modify "money" column in bigint and val 255 + in source (server & client) change "money" variable (in offlineshop_manager, and in packets) from DWORD to long long