Ghostblock abuse

[c0dingnoobi]

Describe the bypass and how to replicate it

1. Get to a location where building is denied by the server
2. Delay outgoing packets for x ms & turn on scaffold
3. Build blocks

This is considered as "fly" since grim gives the build blocks back and resyncs the placed blocks. In the provided video there are two positions displayed, the position infront of players pov, is where the server sees the player (due to outgoing packet delaying)

(delaying incoming is unnecessary and can be turned off completly)

You can also see that the blocks are given back. This is most likely intentional (lag compensation) which is also why this issue should be adressed as abuse not as a bypass

Grim version

eed2a8268b2ea1249863cf7555c4bc4d4abba455

Server version

Spigot 1.8.8

Plugins

• Grim
• Core for /build command

[MWHunter]

If a player places a block surrounded by 2 blocks of air according to the server world state, deny the player's places

[c0dingnoobi]

Already tried, falses when placing and stepping on 2 ghost blocks (using rightclicker) Approach should be fine as long as only resynching yea Falses simulation and groundspoof if u manage to build up 3 ghostblocks high using a rightclicker while jumping and walking (due to resynchs)

[gNewl]

You can fix it by adding a setback to the last ground position whitout flagging, just to cancel the abuse. I think it is better like this because it will not be bad for the laggy players and will fix the bypass. I don't know very much about coding, but someone that can code can open a pull request fixing it.

[c0dingnoobi]

setback to the last ground position

players ground position changes when using that abuse, you would need to track the position before he started building which is kind of pain in ass to do accurately

[gNewl]

What if you check if the player's block placed (only placed by the player not updated by the server) do exist in the world by checking if the block is there, not using packets and then if doesn't it sets back to the last existing (not ghostblock) block position that are checked using the same method as described above? Sorry if I am saying bullshit, I don't know so much about coding.

[MWHunter]

You basically resync the world and setback the player without flagging. It clears the ghost block. Do this when the block clicked position isn't within 2 blocks of a real block.

[c0dingnoobi]

    @Override
    public void onBlockPlace(final BlockPlace place) {

        World world = player.bukkitPlayer.getWorld();
        Vector3i pos = place.getPlacedBlockPos();
        Vector3i posAgainst = place.getPlacedAgainstBlockLocation();

        for (int i = pos.getX() - 2; i <= pos.getX() + 2; i++) {
            for (int j = pos.getY() - 2; j <= pos.getY() + 2; j++) {
                for (int k = pos.getZ() - 2; k <= pos.getZ() + 2; k++) {
                    // skip the block pos itself
                    if (i == pos.getX() && j == pos.getY() && k == pos.getZ()) {
                        continue;
                    }
                    // skip the block placed against
                    if (i == posAgainst.getX() && j == posAgainst.getY() && k == posAgainst.getZ()) {
                        continue;
                    }
                    Block type = world.getBlockAt(i, j, k);
                    if (type.getType() != Material.AIR) {
                        return;
                    }
                }
            }
        }
        // every surrounding block is now air, resync
        place.resync();

    }

You basically resync the world and setback the player without flagging. It clears the ghost block. Do this when the block clicked position isn't within 2 blocks of a real block.

well this is basically what i have done. Using bukkit.world to get the servers world state and iterate throu every two block surrounding from placed blocks position (so 5x5x5) The only problem is that this "falses" (due to resyncs) groundspoof phase and simulation when placing blocks on a non build able area with an high cps right clicker where u manage to build up 3 blocks high

[gNewl]

The only problem is that this "falses" (due to resyncs) groundspoof phase and simulation when placing blocks on a non build able area with an high cps right clicker where u manage to build up 3 blocks high

Maybe if you setback before the player manage to get to 3 blocks, but needs more testing, like testing if lag abuse (blink) will not bypass this check or if it will not eat performance or if every block is air within the range what do we do and if the server is removing blocks from above the player in a minigame like Hypixel's pixel party and the player jumps in this or every skywars cage that the player can jump while in it, this also changes. If it gets added will be better make it experimental and toggleable, or we test it to highly improve before we add it to make it stable and I recommend open a pull request for it.

[gNewl]

So we have to review/improve:

• bypasses using lag abuse/blink
• surroundings are all air
• server updates block from above

[c0dingnoobi]

Maybe if you setback before the player manage to get to 3 blocks

Setting back a player as soon as he is on a ghostblock? I mean i would still need to resync which still would cause the "false flags" (and in general this doesnt rlly sound good imo)

if lag abuse (blink)

that check is supposed to be against lag abuse (delaying outgoing). using blink this ghostblock abuse does not work at all

Hypixel's pixel party and the player jumps in this or every skywars cage that the player can jump

the only case where this check would do something against that case is, when player places a block while that cage f.e gets removed, which would cause a resync so that ghostblock would disappear. thats all

As define mentioned, as long as this only runs as a setbacking check (not an alerting one) this shouldnt be a problem.

Servers updating blocks generally might need a deep dig if it would cause any issues (which i doubt since as said its only resynching)

[gNewl]

If everything is in order, we can add it and make it enabled by default, with an option to toggle it in the configuration file.

[c0dingnoobi]

If a player places a block surrounded by 2 blocks of air according to the server world state, deny the player's places

Also ive thinked about this. Wouldn't it be enough to check at 1 block surrounding like +1 -1 so basically a 3x3x3 instead of 5x5x5 (+2 -2) Without exempting the blocked placed against it works. Any specific reasons why to iterate at 2 block surroundings instead of 1?
We could do less iterations thus improve performance

[MWHunter]

Grim is sync to netty, not minecraft. It can take up to 50 ms to see minecraft apply the block place