client.dll autobunny exploit/cheat

[NightMare-]

PC Specs: Processor: AMD Phenom II x6 1100T Black Edition Motherboard: Gigabyte 990-FXA-UD3 Graphics Card: Gigabyte Radeon HD 7770 OC Ram: 8gb DDR3

I play a mod for Half-Life called Adrenaline Gamer. The special alias function enabled the use of "auto bunnyhop". However, an exploit has been released which apparently is a modified client.dll and replaces the default file.

The significance of this issue entails the legitimacy of gameplay, especially those played for tourneys etc... Valve, is it acceptable to replace or modify this file (client.dll), or any other than the config/userconfig? I'm not against autobunny particularly, however, something doesn't seem right about this...

In conclusion, I completely respect and admire Valve's hard work updating Half-Life and improving many things. If no further action is taken I accept that but I would like a definitive answer. Please, "yes or no" regarding the approval and acceptance of modifying, replacing, and using such files for Half-Life and associated mods. An explanation regarding your answer would be greatly appreciated. Thanks!

Modified client.dll: http://rghost.net/46137092

[AnAkkk]

Have you even tried to use it? This is impossible unless you modify it on the server as well, as Adrenaline Gamer servers check for the client.dll MD5. This shouldn't be in this tracker anyway, this is about a third party mod.

[NightMare-]

I have not used it. Many of us grew accustomed to autobunny via special alias. However, since this function's omission, players modified dll files thus, accommodating this issue. This results in potentially an unfair advantage against players who don't modify such files.

[AnAkkk]

I've told you twice that you can't use that file, and yet, you still ignore it.

[NightMare-]

Sorry if I appeared to ignore you but that's not my intention. I understand the issue better now however I just wanted something done (officially) to prevent admins from abusing this feature to exploit players who havn't modified such dll's. If there is nothing that can be done to prevent admins from exploiting this, then life moves on. Half-Life forever!

[anzz1]

MD5 checking of client.dll by VAC should definitely be implemented, as currently it's way too easy to cheat using client.dll hacks.

I know the game is old and not much of a priority, but this simple check would be simple to add now that the HL25 updates are being done anyway. Ultimately the lack of trust in integrity of the games will erode what's left of the playerbase in these games if cheaters aren't being stopped at all.

Related client.dll hack : https://github.com/tmp64/BugfixedHL-Rebased/issues/214

[0Ky]

@anzz1 There is the ENGINE_FORCE_UNMODIFIED callback function to ensure the client has the same file as the server.

https://github.com/ValveSoftware/halflife/blob/c7240b965743a53a29491dd49320c88eecf6257b/engine/eiface.h#L255-L258

I believe this is possible in AMXX with the Files Check plugin that leverages the _ENGINE_FORCEUNMODIFIED callback function.

[0Ky]

Unfortunately, that file consistency check can be bypassed through methods such as placing modified files in the valve_addon directory. This leads to the game engine prioritizing the loading of files from the valve_addon directory over those in the valve directory, effectively allowing the modified files to overwrite the original ones. Additionally, the consistency check called by the server upon connection can be circumvented by simply replacing the file at runtime after the game loads the DLL file.

However, you may be able to minimize modifications made to the DLL file by hosting a server using ReHLDS along with the Resources Checker plugin for Metamod. This should enhance file integrity verification by checking client files through their MD5 checksums and detecting the presence of unwanted files in specified paths on the client.

If you're creating a listen server with Steam Networking feature enabled, then it's not possible to utilize the Resources Checker plugin for Metamod. It would be nice if Valve addressed consistency check, maybe we need something like a pure server mode.