Patch for Bouquet Sync Damage Exploit

[Khabib Nurmagomedov 388]

I am not going to make this longer than needed, some hacks are using the bouquet to deal insta damage to mobs/stones and bypass every anticheat there is, not a single one will stop it, so here is how you can fix it.

In UserInterface/InstanceBase.cpp under BOOL CInstanceBase::IsHoldingPickAxe() add this ->
 

Spoiler

BOOL CInstanceBase::IsWearingBouquet()
{
	const int c_iBouqetteStart = 50201;
	const int c_iBouqetteEnd = 50204;
	return m_awPart[CRaceData::PART_WEAPON] >= c_iBouqetteStart && m_awPart[CRaceData::PART_WEAPON] <= c_iBouqetteEnd;
}

Inside the bool CInstanceBase::CanAttack() function in the same file add this ->

 

Spoiler

	if (IsWearingBouquet())
		return false;

In the InstanceBase.h file under BOOL IsHoldingPickAxe(); add this ->
 

Spoiler

BOOL IsWearingBouquet();

If your client is running 64bit then you should not worry, you can't waithack on 64bit clients, if you aren't, then you might wanna have a look. Please do not try to tell me that this does not work as i've took half an hour to recreate the same exploit myself and it simply works, tested on CShield and other turkish anticheats on the market.

[Lufbert 21]

Its clientside, it will not fix anything.
I mean, it will fix it maybe temporary but for cheat creators to bypass it it will be like 10 extra minutes of work.

[Khabib Nurmagomedov 388]

37 minutes ago, Lufbert said:

Its clientside, it will not fix anything.
I mean, it will fix it maybe temporary but for cheat creators to bypass it it will be like 10 extra minutes of work.

Please have a look what the CanAttack function does. If you tell the client not to send attack packets with that certain item, it won't and you won't be able to do anything about it unless someone bytepatches the code, which is going to be useless as proper servers will constantly verify the checksum of the client upon launching.

[Gurgarath 3693]

Thank you for the release, but as a rule of thumb, it is always better to also (and mainly) enforce that on the server, which can be done easily in ::Attack(). Only doing that on the client side can still leave you open to spoofed attack packets, even if it is a deterrent. I was not aware of this issue, the share is really appreciated! 

[msnas 2343]

56 minutes ago, Gurgarath said:

Thank you for the release, but as a rule of thumb, it is always better to also (and mainly) enforce that on the server, which can be done easily in ::Attack(). Only doing that on the client side can still leave you open to spoofed attack packets, even if it is a deterrent. I was not aware of this issue, the share is really appreciated! 

Following this message, enforcing on the server would be something like this:

bool CHARACTER::Attack(LPCHARACTER pkVictim, uint8_t bType)
{
	....
	
	if (IsPC())
	{
		if (IS_SPEED_HACK(this, pkVictim, dwCurrentTime))
			return false;

		if (bType == 0 && dwCurrentTime < GetSkipComboAttackByTime())
			return false;

		const uint16_t part_weapon = GetPart(PART_WEAPON);
		if (part_weapon >= 50201 && part_weapon <= 50204)
			return false;
	}
}

 

[Lufbert 21]

1 hour ago, FrenchForeignLegion said:

Please have a look what the CanAttack function does. If you tell the client not to send attack packets with that certain item, it won't and you won't be able to do anything about it unless someone bytepatches the code, which is going to be useless as proper servers will constantly verify the checksum of the client upon launching.

Most cheats dont even use that CanAttack function, just sent plain attack packet to specific vid

[DianaPoupescu 0]

Thanks, your fix is very helpful, I wasn't aware of this exploit.

[martysama0134 10748]

The bouquet is using the subtype 10, and it's not in the ESubWeaponTypes enum.

In the CHARACTER::Damage you can do this:

bool CHARACTER::Damage(LPCHARACTER pAttacker, int dam, EDamageType type) // returns true if dead
{
    if (pAttacker && pAttacker->IsPC() && pAttacker->GetWear(WEAR_WEAPON) && pAttacker->GetWear(WEAR_WEAPON)->GetSubType() >= WEAPON_NUM_TYPES)
    {
        SendDamagePacket(pAttacker, 0, DAMAGE_BLOCK);
        return false;
    }

Otherwise you create WEAPON_BOUQUET = 10, and edit it with

bool CHARACTER::Damage(LPCHARACTER pAttacker, int dam, EDamageType type) // returns true if dead
{
    if (pAttacker && pAttacker->IsPC() && pAttacker->GetWear(WEAR_WEAPON) && pAttacker->GetWear(WEAR_WEAPON)->GetSubType() == WEAPON_BOUQUET)
    {
        SendDamagePacket(pAttacker, 0, DAMAGE_BLOCK);
        return false;
    }

Or a mix of both:

	if (pAttacker && pAttacker->IsPC())
	{
		const auto weapon = pAttacker->GetWear(WEAR_WEAPON);
		if (weapon && (weapon->GetSubType() >= WEAPON_NUM_TYPES || weapon->GetSubType() == WEAPON_BOUQUET))
		{
			SendDamagePacket(pAttacker, 0, DAMAGE_BLOCK);
			return false;
		}
	}

 

Edited January 18, 2025 by martysama0134

[MT2Dev 1566]

Hello, first of all, thank you for revealing this problem. I wrote a serverside check for the solution to this problem and more, it is quite detailed, i am sharing it in case it may be useful to someone;

 

char.cpp

This is the hidden content, please

• Sign In
• or
• Sign Up

Best regards, MT2Dev.

[minigutza 78]

I have this error. I already checked for DAMAGE_BLOCK inside of enum DamageFlag from char_battle.cpp. What's missing or what i did wrong? Thank you.

Edited February 19 by Metin2 Dev International
Core X - External 2 Internal