Jump to content

tma

Members
  • Posts

    173
  • Joined

  • Last visited

Posts posted by tma

  1. Thank you for the reply. To answer:

    + onPlayerScreenShot: This request was primarily driven by the fact I script for a DD/DM server and one of the tricks was to spam screenshots so altering your lag and thus collision. I wanted to trap this to determine who was trying to gain an advantage by doing so. I appreciate that recently the screenshot taking code was enhanced, but it might still be useful. I could also see it being potentially used on an RP server.

    + fileRename(): Yeah, I do have the work-around running at the moment. I was just thinking that a proper rename function would be a cleaner method. It would also stop me having to copy of up to 2mb of data only to then delete it (I'm doing this in a Ghost Driver playback script where older recordings are kept for roll-back purposes when cheater recordings are found).

    + I have submitted issues for setCameraTarget() and onPlayerChat().

    (Although the camera one appears to be a dupe)

  2. Hey, I just wanted to suggest a few things for consideration ...

    onPlayerScreenShot Event

    An event that is fired any time a client takes a screen shot, weather by a bind or /screenshot.

    fileRename()

    A server command to rename a file. Currently, you would have to copy the original file and then delete it.

    Ped as a camera target

    Currently, setCameraTarget() is limited to only players as targets. It would be really good if it could be set to other elements, especially peds e.g. for use in spectating a ghost driver playback.

    I'm not sure if these two are bugs/features but I will list them here ...

    + The onPlayerChat() event never seems to have a valid "client" value when it fires i.e. it's null. All other events seem to set "client" and "source" correctly so they can be validated to confirm that the correct client is firing the event. I don't know if there's a reason for "client" being null for this event but I thought I'd post it anyhow (this is present in 1.0.4 that I am using).

    + onTrailerAttach() doesn't seem to fire consistently for ped driven vehicles. It fires fine for normal players, but for peds, it only happens occasionally.

    Thanks - and still enjoying the mod after so many years.

    :)

  3. Hi,

    I do the scripting for a DD/DM server that uses the race resource, and one of the feature requests that's come up recently is the ability to change camera mode while spectating, as you can while playing (usually with 'v' or 'home' which are bound to 'change_camera').

    Now, I can't seem to make this happen. On join or death, spectate seems to stay with your current view mode until you (re)spawn. Is there a way to do this ? Or is this just how MTA works ? I appreciate I could go to the trouble of modifying race to provide these camera modes (using the MTA API) but I'd just like an easy way to use the same functionality as when alive. Is that possible ?

    Thanks.

  4. Eesh, I have a lot of custom events. I take it putting something like:

    if not (client and source and (client == source)) then
    	cancelEvent()
    	return
    end
    

    at the start of each of your custom events would work ? Maybe a more generic system like in the freeroam example you gave would be a better idea.

    I still can't think of how custom code is done though. Yes, I can see them faking an event for someone else, but the stuff like ped spawning ?

    Thanks again for the info, Kayl.

  5. On our server we also had a hacking problem but related to triggerServerEvent.

    At some points, all people on the server were warped at the same point, or all would start the masturbating animation for instance.

    Yep, had that.

    For us it had something to do with triggerServerEvent for client > server communication and to call serverside functions, either with our own events or using a mechanism similar to freeroam (metatable).

    When doing that, we usually specify getLocalPlayer() as the "source" of the event we trigger.

    And for some reason, the hacker is able to execute his own code (without runcode running) and triggers events putting one player at a time as the source.

    The fix we had to implement everywhere is that we now check, on the serverside triggered functions that the source equals the "client", an other hidden argument that represents the player's client from which it really comes.

    I would really like to know how the hacker is even able to do that, that pisses me off because now we fear implementing clientside features.

    Wow, really ? Thanks for the info. So I guess any logged in player with priveliges can be "attacked" ? The hack triggers an event for them so extra permissions are granted to do stuff ? Do you have a "normal" set of resources running ? i.e. nothing special ?

    I guess I will have to go through my code and change some stuff around ...

    Edit:

    Did you just edit your own resource to include this "client = source" check ? It's just that I'm not seeing how they run their own code. I mean, how does a hacker trigger an event for someone else to call what I assume is a custom-coded server event, that then does something it's not supposed to ?

    Say I have a server event that the client triggers to update their FPS. How can they use that to then run anything they like ? I could see how that would be a problem with the admin resource but that isn't even running and we've still got the problem.

  6. Only the server console itself can login as that, if you delete it, it will just be re-created when you next run the server. And have you got a resource called "runcode" running? I don't think the newer ones allow non-admins to execute codes but the older ones did I think.

    The runcode resource is not on the server.

  7. Also, does this account:

    <account name="Console" password="" />
    

    need to exist ? It seems to be in by default (at least on my local PC) but is it needed for things to work correctly ? (We don't use the server console at all). Can that be exploited ?

  8. Yeah I thought at first someone might have admin/ftp access but the passwords were changed to combat this. I checked the server log file also, looking for anything to do with "ADMIN:" but only found the usual bans / muting etc.

    I have seen this problem on another server also.

  9. Hey Norby, thanks for replying.

    The hacker problem I am referring to is not (?) s0beit as mentioned - the issue is random events. This has taken the form of:

    + Random ped spawning

    + Random vehicle changes

    + Gravity changes

    + Screen shaking

    I tracked this down initially to the fact that somehow, the admin resource on the server had been modified to include "extra" code. It had been amended to one of the admin resource LUA files. When I stopped this (removing the offending code), they then modified the meta.xml of the admin resource to include their own file. I do not know how they are modifying resource files, but I zipped up the admin resource to try and stop it. All seemed OK for a while, but yesterday it happened again (vehicle changing and camera shaking).

    I've tried tracking this down in a number of ways including examining client commands to see if "dodgy" things are going on - this is how I initially found the exploited admin resource - they were issuing commands to the extra code they had added. However, since yesterday I haven't so far found any iffy commands (or altered resources) so I'm currently at a loss how this is happening still. Do you know how they might do this ? Do any resources have possible exploits ? I have tried stopping various resources, especially those with raised admin privileges but it seems to not help. I can post the code they added to the admin resource and an example of the commands they were running if that helps ?

    I don't think we're running the latest version of the admin resource, but I have been through the one we have to remove all possible holes - mainly removing anything to do with the use of loadString().

  10. Hey,

    I was just wondering where the best place to ask about people hacking was ? I'm not talking about s0beit as that can be easily seen - but by spontaneous events happening in the server. Should I post about the problem here ?

    Thanks

  11. Is the image in your post the actual one in use ? It has dimensions 361px × 305px ? If so, try padding the image out to 512x512. Graphics cards are designed to work best/accurately with textures that are square and sized in powers of 2 e.g. 128x128,256x256. Sometimes, when they're not, the hardware will interpolate the data incorrectly during scaling and give you errors like this. I had the same problem embedding a logo bottom right in my mod - moving the texture up to 512x512 solved the issue.

  12.   
    function Script_onMapLoad () 
        barrier = createObject (968, 1544.714966, -1630.837036, 13.317049, 0,90,90) 
    end 
      
    addEventHandler ( "onResourceStart", getResourceRootElement(getThisResource()), Script_onMapLoad ) 
      
    addCommandHandler ( "open",  
        function(player,cmd,...) 
            outputChatBox ( "Barrier up!", player) 
            moveObject ( barrier, 2000, 1544.714966, -1630.837036, 13.317049, 0,-90,0 ) 
        end 
    ) 
      
    

    What was wrong:

    + You missed commas out on the moveObject() call

    + You angle parameters to createObject() and moveObject() where in radians not degrees

    + The incorrect use of outputChatBox() (as mentioned before)

  13. To get it to run I had to do two things:

      
    updaterate = 57     --Positions' update rate in miliseconds 
      
    

    The previous rate of 27 seemed to not work at all - maybe the min interval for timers has changed over the lifetime of MTA ?

    Also:

      
    function snow_moveFlake ( flakeID, speed ) 
        if isElement(snowflake[flakeID]) then 
            local fx, fy, fz = getElementPosition ( snowflake[flakeID] ) 
            setElementPosition ( snowflake[flakeID], fx, fy, fz - ( updaterate / 1000 * speed ) ) 
        end 
    end 
      
    

    Without the isElement() check it seems to barf - maybe it's to do with my time interval change.

    Anyhow, I really wouldn't use this script unless you make it client side. As it is, the server will be handling potentially hundreds of flakes and updating them multiple times per second.

  14. Bare with me but ... assume the random number gen uses some kind of 32 bit signed value (maybe the seed ?). 25 days of server up time is 25 * 24 * 60 * 60 * 1000 = 2160000000 milliseconds. The range of a 32 bit signed int is +/- (2^32)/2, so -2147483648 to +2147483647. That upper limit of 2147483648 is amazingly similar to 25 days of up time. If there is some internal 32 signed value that's used by the random number gen that is somehow connected to server up time I could see the randomness failing as the value wraps on the 25th day of uptime. Server time is often used to initially seed a random number generator on startup as it's a random value of sorts - so theoretically giving you a random sequence.

    Also why was randInt() provided by the MTA team when math.random() exists ? Are there known issues with math.random() ?

    Edit: After reading more on http://lua-users.org/wiki/MathLibraryTutorial

    'If a "serious" random number generator is needed we must use other (please, surf in the www).'

  15. Your engineLoadTXD() and engineLoadDFF() calls should have the full path names (as specified in your meta.xml)

    Also, replaceModel() is going to be called every second, forever, given the way you're using the timer. I'd suggest (untested):

      
    outputChatBox ( "At400 replaced" ) 
    function replaceModel() 
      txd = engineLoadTXD ( "at400.txd" ) 
      engineImportTXD ( txd, 577 ) 
      dff = engineLoadDFF ( "at400.dff", 577 ) 
      engineReplaceModel ( dff, 577 ) 
    end 
    addEventHandler ( "onClientResourceStart", getResourceRootElement(getThisResource()),  
        function() 
            replaceModel() 
            setTimer (replaceModel, 1000, 1) 
        end 
    ) 
      
    

  16. ID's as strings are pretty handy because they can be more descriptive (as in Mr. Hankey's examples) and they're just as easy to loop through:

      
    for index,value in pairs({["apples"] = 50,["pears"] = 99}) do 
        outputChatBox(index .. " are " .. value .. "p guv'ner.") 
    end 
      
    

  17. Based on Mr. Hankey's code:

      
    addCommandHandler("setflash", 
        function() 
            flashing = not flashing 
        end 
    ) 
      
    addEventHandler("onClientRender",getLocalPlayer(), 
        function() 
            local v = getPlayerOccupiedVehicle(getLocalPlayer()) 
      
            if v and flashing and getTickCount () > (previousTickCount or 0) then 
                previousTickCount = getTickCount() + 250 
                setVehicleOverrideLights(v,(getVehicleOverrideLights ( v ) == 2) and 1 or 2 ) 
            end 
        end 
    ) 
      
    

  18. Um Hi,

    I scanned all these maps with AVG Anti-Spyware. I found 2 problems with the maps champion805.map and bender 1.0.map

    The threat is named Heuristic.Win32.Morphine-Crypted

    I have no idea if it is harmful or not I thought i'd just let someone know about it.

    You can just ignore that. XML markup map files can not contain malicious code. And even if they did it could not harm you because of the way MTA is parsing it.

    There are actually two infected files as mentioned. Only the numerically-named maps are true race maps (7000 files)- there are also a few other "map" files (with alphanumeric names) that are differing file formats - Wav, Zip and EXE - two of which are infected. I'm not sure how these other files have turned up - maybe people tried to upload viruses to the old centre maliciously.

    But thanks for the maps - I have been looking for them. I don't suppose anyone has some kind of data table that contains the original names ? (from the original centre/website for example). I'd write a quick script to rename them all and re-upload if so.

  19. I'm not sure why this was posted as it doesn't work. tuPlayerHasPower() and the four lines with it are from a function I posted here a while back - but the function is incomplete. The event handler isn't hooked in either.

  20. That's why you should toggleCameraFixed mode and then add handling function to onClientRender, so it shouldn't be looking in the wrong direction.

    I've played with cams a bit too. I can't remember when exactly but when I tried to set camera position for the 1st time it was set to 0,0,0 but the next time camera was set to the position that was previously called. It was set to the previous position every time after that.

    Yeah but there's nothing in the function's Wiki to highlight the camera issues - that of delaying setting position/target. If you are doing stuff like a camera rotate round a fixed point, it's something people wouldn't notice (it failing the first time and being fine from then on). It's just that the first time I wanted to do camera stuff, I just wanted to set a position and angle and made the mistake of trying mode change/move/target all in one frame. Hence the timers in the code I wrote for the other thread. I now have a better system that does run on the client render.

×
×
  • Create New...