oscar-broman / samp-weapon-config

A more consistent and responsive damage system with many new features
Apache License 2.0
93 stars 83 forks source link

Goggles effect check improvements #267

Closed NexiusTailer closed 1 year ago

NexiusTailer commented 1 year ago

Alright, I did some improvements to this check again, but this time it's a real found exploit which was reported a few weeks ago and I couldn't figure out what was the way of reproducing this all those days, trying out different theories.

The issue which fixed in this PR is:

  1. A cheater can send the first packet with the desired weapons (44/45)
  2. The second packet can be without any holding weapon, but with KEY_FIRE pressed
  3. The game of the other players for some reason interpret it as a still-working way to enable goggles effect (and funny enough, but only goggles are subject to this)

The current implementation also considers any cases when the cheater is sending a bunch of packets to bypass server checks making some "valid gap" between two packets that is checked, like:

> Send onfoot with weapon 44
> Send the same onfoot but both without weapon 44 and key pressed, doing it all together with the first packet, so the server could possibly send only the first for others (as it has some buffer of packets before sending)
> Send key press without the weapon after some short time

This was well tested and finally solves the found issue.