The Castle Doctrine Forums

Discuss the massively-multiplayer home defense game.

You are not logged in.

#1 Re: Main Forum » exploits » 2014-02-01 09:46:58

largestherb wrote:

we wouldn't have infamous villains such as adrian ernest pounds if everyone saw a different list!

largestherb wrote:

also, with 24 hour chills, knowing the name of your other house is not that useful at all.

good points

DaVinci wrote:

His system wouldn't do anything though. A cd-key based name gathering would not do much as the guy who has multiple accounts could easily have the names reverted

Easily correlated yes, reverted no.  Not that there's much practical difference.

DaVinci wrote:

OR could build himself a new copy without this feature// Encrypting upon 1 key.

Because it's server side, it doesn't matter what client you use, the crc32 of the player id and the house player id will be different for every client, the names are generated at the server not the client.

The main weakness is that, looking at other information, like the $, visits, and deaths you could just identify each house on those attributes without looking at the name.  But full day chills would make it impractical anyway.  And it makes the names meaningless.

I actually like the idea of increasing the chills length best, because it limits the number of attempts, and encourages addictive behaviour to come back and repair every few hours.

#2 Re: Main Forum » exploits » 2014-01-31 23:53:42

Ok here's some better code for unique names for each of the other player's names, that are still consistent.  So you can do revenge.

This makes it "impossible" for people to lan hack, or multi-account hack based on the character name, but it still lets them hack based on the money, so it just makes things more difficult.

in cd_listHouses around 4961 instead of

        $house_user_id = mysql_result( $result, $i, "user_id" );
        $character_name = mysql_result( $result, $i, "character_name" );

do something like

        $house_user_id = mysql_result( $result, $i, "user_id" );
        $character_name = mysql_result( $result, $i, "character_name" );
	$seedRand = crc32( $user_id . " ". $house_user_id . " " . $character_name);
	$character_name = cd_pickFullName( $seedRand );

and then bubble that $seedRand up into the actual random like this:

function cd_pickName( $inTableName, $seedRand = null ) {
    global $tableNamePrefix;
	
	$tableName = $tableNamePrefix . $inTableName;
	
	if ($seedRand === null) {
		// get a rand from MySQL

		$query = "SELECT FLOOR( RAND() * MAX( cumulative_count) ) FROM ".
			$tableName .";";

	} else {
		// rand seed passed in, potentially different for every player player combo.

		mt_srand($seedRand);

		$rand = floatval(mt_rand(1, 1000000)) / 1000000.0;
			
		$query = "SELECT FLOOR( $rand * MAX( cumulative_count) ) FROM ".
			$tableName .";";

	}
	$result = cd_queryDatabase( $query );
	
    $cumulativeTarget = mysql_result( $result, 0, 0 );
    ...

#3 Re: Main Forum » exploits » 2014-01-31 22:31:29

Here's an idea.  The other player's names are generated based on each player's key.

So, you cannot share the name of the house with another player or account, because your name for B is not the same as your friend's name for player B.  The only correlation is the amount of cash.

Or just completely random each server query:

Change line 4948 in server.php from:
        $character_name = mysql_result( $result, $i, "character_name" );
to:
    $character_name = cd_pickFullName();

Board footer

Powered by FluxBB 1.5.8