Searching to Create an Exploit : SWG Premium Discussions

Hey everyone.

Ok so my theory is this. find what is client-side and hack it. Some of you are familiar with the ent buff exploit there was a few weeks ago. Well if I can find what is client side for SWG I can create more exploits fairly easy. Only problem is...I dont know what is client-side and what isnt. Anyone wanna help?

Sounds good, however most of the things are server side. They might look like you edited it but more than likely not. Games like rising force lots of things are client side, but SWG is not so much.

I think i'll look into the collision detection for entities and world objects. I know they are spawned by the server but i'm not sure if its the client that does the collision physics (ie: walk thru walls), If so its possible to make a cheat. I know some doors are handled by the server ie: dwb security doors, but ive managed to get thru em once usin intended outgoing packet-loss.

yes i'm also constantly searching for things to exploit, heres some things u can cross off your list.

Space mining - cpu given when selling at a space station.

Changed it to 10m CPU, client side shows this but the server returns and gives the correct amount.

Cooldown times - You lose all of your abilities excepty the one you modify and the cooldown resets but the special cannot be activated.

Ent buff - I can change the cost/times applied of the ent buff but when u click accept the server says an error occured.

Craft Experimentation - changed the amount of points u have to experiment with, similar to the old ent buff exploit. system message says craft failure.

Chnaged an Breastplate AA into an AA - the message displays do u want to attatch the item etc etc. click yes, nothing happens.

Changed the values of what buffs do. doesn't affect.

Changed the amount of xp given for quests. Client side shows but the server returns with the correct amount.

Chnaged what rewards you are given when completing a quest, shows clientside but server gives correctly.

Haven't yet tried removing certain tasks of a quest, so this may be possile.

Tried making quests repeatable, server ignores.

Tried making combat attacks ignore LOS as NPC attacks do. tends to ignore but may be worth more testing.

Tried many many others, but heres a list for you to cross off or double check.

sike49 wrote:yes i'm also constantly searching for things to exploit, heres some things u can cross off your list.

Space mining - cpu given when selling at a space station.

Changed it to 10m CPU, client side shows this but the server returns and gives the correct amount.

Cooldown times - You lose all of your abilities excepty the one you modify and the cooldown resets but the special cannot be activated.

Ent buff - I can change the cost/times applied of the ent buff but when u click accept the server says an error occured.

Craft Experimentation - changed the amount of points u have to experiment with, similar to the old ent buff exploit. system message says craft failure.

Chnaged an Breastplate AA into an AA - the message displays do u want to attatch the item etc etc. click yes, nothing happens.

Changed the values of what buffs do. doesn't affect.

Changed the amount of xp given for quests. Client side shows but the server returns with the correct amount.

Chnaged what rewards you are given when completing a quest, shows clientside but server gives correctly.

Haven't yet tried removing certain tasks of a quest, so this may be possile.

Tried making quests repeatable, server ignores.

Tried making combat attacks ignore LOS as NPC attacks do. tends to ignore but may be worth more testing.

Tried many many others, but heres a list for you to cross off or double check.

what you're basicly doing is finding adress of memory values with cheat Engine and turning them to something else.
Means you only affect what you "see" on client side.
This way I managed to give me over 99999 in all base stats (3 pointers for that: equiped stats, buffs, base stats), turned a stack of 5 stims to XXX, gave myself some +50 experimentation points, 999999M bank and cash...
But same, this is only what you see on the client and does not affect server at all.

Just a note too, alot of the time they are only the "Visual" values on the client. In most cases the client uses 2 variables, 1 for the actual value, and the other for the visual value (displayed on screen or w/e). So make sure your changing the right ones when testing (=

Example: When i made the AFK resource exploit, there was multiple values, one was the UI selection, the other was the value that gets transmittted to the server. Both the same, just used for different reasons.

The best things to test are stuff that gets transmitted to the server. Edit them and hope the server "assumes" the client has been coded correctly and doesnt apply any bounds checks.

Aren't some variables ony read from what server send? Means there would be nothing the client returns, so impossible to modify

They would be stored in the memory, and then you can edit that.
But alas, that's only client-side then. Won't do you any good.

djsdark wrote:

sike49 wrote:yes i'm also constantly searching for things to exploit, heres some things u can cross off your list.

Space mining - cpu given when selling at a space station.

Changed it to 10m CPU, client side shows this but the server returns and gives the correct amount.

Cooldown times - You lose all of your abilities excepty the one you modify and the cooldown resets but the special cannot be activated.

Ent buff - I can change the cost/times applied of the ent buff but when u click accept the server says an error occured.

Craft Experimentation - changed the amount of points u have to experiment with, similar to the old ent buff exploit. system message says craft failure.

Chnaged an Breastplate AA into an AA - the message displays do u want to attatch the item etc etc. click yes, nothing happens.

Changed the values of what buffs do. doesn't affect.

Changed the amount of xp given for quests. Client side shows but the server returns with the correct amount.

Chnaged what rewards you are given when completing a quest, shows clientside but server gives correctly.

Haven't yet tried removing certain tasks of a quest, so this may be possile.

Tried making quests repeatable, server ignores.

Tried making combat attacks ignore LOS as NPC attacks do. tends to ignore but may be worth more testing.

Tried many many others, but heres a list for you to cross off or double check.

what you're basicly doing is finding adress of memory values with cheat Engine and turning them to something else.
Means you only affect what you "see" on client side.
This way I managed to give me over 99999 in all base stats (3 pointers for that: equiped stats, buffs, base stats), turned a stack of 5 stims to XXX, gave myself some +50 experimentation points, 999999M bank and cash...


But same, this is only what you see on the client and does not affect server at all.

This isn;t actually just using cheat engine, many of these are from editing the actual game files. For instance the quest tasks are client side, yes the server returns the correct value for things like credits, xp, items rewarded etc, but does it check you completed a certain part of a quest? if i make the client think that task 3 of a quest is actually task 2, will the server check this, this I haven't tested yet as I haven't chose a quest to test with.

Im pretty sure the quest part are stored in SOE's database for each character (server side then).

djsdark wrote:Im pretty sure the quest part are stored in SOE's database for each character (server side then).

your journal is stored in their database yes, but the client tells the server when you have completed a part of the quest, the question is does the server "check" that you actually did or does it take the clients word for it.

the datatables for each quest is in the .tre files, i could easily take out the 2nd task of say the pre-quest to exar kun, and make the 1st part jump to the 3rd' i'm not saying this will work, i'm just saying theres a possibility I will do some testing over the weekend when I have time.

sike49 wrote:

djsdark wrote:Im pretty sure the quest part are stored in SOE's database for each character (server side then).

your journal is stored in their database yes, but the client tells the server when you have completed a part of the quest, the question is does the server "check" that you actually did or does it take the clients word for it.

the datatables for each quest is in the .tre files, i could easily take out the 2nd task of say the pre-quest to exar kun, and make the 1st part jump to the 3rd' i'm not saying this will work, i'm just saying theres a possibility I will do some testing over the weekend when I have time.

Wouldn't it make more sense to just mark certain tasks completed instead of removing them all together?

As for Exar Kun, I don't think this would be possible since there would be multiple users involved in the instance. (Unless you are talking about pre-reqs).

------
As for trying new exploits, How about looking into health and action manipulation... ie God mode for PvE. Maybe you can lock the return data from the client to the server at a certain value, even if the downloaded data tries to over right it. I'm no hacker, but it's a thought.

One more suggestion, a good and probably easier hack would be creating a 3rd character. The character creation process is client side and the server sends the data with the accept/deny the process to allow it to happen. If you can send a false positive to the client when trying to create a character, then you shouldn't have any problems creating a 3rd 4th or 5th character... although I wouldn't abuse it

yubinyankinov wrote:

sike49 wrote:

djsdark wrote:Im pretty sure the quest part are stored in SOE's database for each character (server side then).

your journal is stored in their database yes, but the client tells the server when you have completed a part of the quest, the question is does the server "check" that you actually did or does it take the clients word for it.

the datatables for each quest is in the .tre files, i could easily take out the 2nd task of say the pre-quest to exar kun, and make the 1st part jump to the 3rd' i'm not saying this will work, i'm just saying theres a possibility I will do some testing over the weekend when I have time.

Wouldn't it make more sense to just mark certain tasks completed instead of removing them all together?

As for Exar Kun, I don't think this would be possible since there would be multiple users involved in the instance. (Unless you are talking about pre-reqs).

------
As for trying new exploits, How about looking into health and action manipulation... ie God mode for PvE. Maybe you can lock the return data from the client to the server at a certain value, even if the downloaded data tries to over right it. I'm no hacker, but it's a thought.

One more suggestion, a good and probably easier hack would be creating a 3rd character. The character creation process is client side and the server sends the data with the accept/deny the process to allow it to happen. If you can send a false positive to the client when trying to create a character, then you shouldn't have any problems creating a 3rd 4th or 5th character... although I wouldn't abuse it

you can't mark objectives as completed because your jornal is updated via the server, however it seems that the client tells the server that you have just done x objective and to update it to y objective.

the character creation page has been changed as ppl wer deleting toons and getting them restored whilst they were in the process of making a new one, this has been nerfed.

Health/action can be manipulated however it is only visual the server still knows how much you should have and will react appropiately.

sike49 wrote:
the character creation page has been changed as ppl wer deleting toons and getting them restored whilst they were in the process of making a new one, this has been nerfed.

I wasn't referring to the work around everyone else was using. But rather run a sniffer and see what is exactly sent to the server telling it to allow the creation of a new toon.
Obviously the server checks to see if your slots are full, then gives the client a yes or no to proceeding to the next level. Give the client a false signal and let it create it anyway.

As for the nerfed part you are referring to, before the Dev's restore a toon, then disconnect your account from the login server while they restore it. Thus eliminating all chances of bypassing the lockout.

I still think this one is possible, I'm just well versed enough in the SWG code to attempt this.