taultunleashed

I've noticed a bunch of things in this game are done client side... To the point where I almost wouldn't be surprised if changing the number of bullets in your inventory using a memory editor would let you keep firing even though you should be out.

Most noteable thing I find is when you first log in, if you run right away before the city has finished loading and stuff, you can literally run straight through walls because they haven't been drawn yet. You can login the middle of town and it will seem like you are in the middle of nowhere with a few NPC's standing around. I'm only lvl 6, so haven't found an actual strategical use for this yet, but I imagine if there's a quest that requires you to kill JimBob, and Jimbob is in the middle of a big building that requires alot of fighting to get to, you could quit outside the building, log back in, and just run straight for him going through the walls.

This has happened to me inadvertantly during log-in. What happened was I was 'moved' out of the wall into the street area---with the same type of motion/graphic effect as when you mount a vehicle/horse.

Glass. You are right about some of your reasoning. The physics interactions are indeed done client side. But MANY of the other characteristics are done server side.

I've looked at FE a bit in IDA and windbg/olly. They have a very robust system in that almost every directly important action is done server side. For example if you use CheatEngine to modify/increase stamina you still can't use abilities that require more stamina than what you "actually" have.

My theory on the behavior is that the server verifies all "important" actions are allowed to happen via a callback like mechanism from the client.

It is a courtesy system with verification:
Client checks it can use ability (I have enough stamiina)
Client asks server to perform abillity.
Server checks. (not enough)
Client gets "not allowed" response.

The important thing to see here is that The client check is simply a courtesy to prevent the server from getting extraneous requests that are only going to be denied.

What you will need to do is focus on finding things that are not considered "important" or things they cannot possibly do totally serverside(due to workload etc).

As you've found out physics is one thing they cannot do server side for every computer.

As an interesting experiment...if you can find the value for number of objects to display (as selected from the options menu 20%-100%) and force it to 0% you can walk through objects because the client will not be processing any objects:) (and therefore will not process physics against those objects).