How is cheating possible?

[Zapmeister]

This is not a troll. I think it's important to discover how the recently-discovered cheating was perpetrated. Early in Stormbinder's thread, now closed, I speculated about the possibility of hacking the 2h file, to which Zen responded:

You would need the fatherland file to do this type of thing. Unless Norfleet has access to the Fatherland file then it is a hard thing for him to generate cheat hacks with just the 2h file.

So how was it done?

[archaeolept]

well, personally i've suspected for a while that esben's security had been compromised. Other than that, I have no idea how he accomplished it, other than through using a hex editor

[Gandalf Parker]

Early on Norfleet spoke of some skill with hex editing. I doubt that discussions along those lines will occur outside of the dominions beta forum at most.

[Zapmeister]

Early on Norfleet spoke of some skill with hex editing. I doubt that discussions along those lines will occur outside of the dominions beta forum at most.

Well, so long as it happens somewhere, that's good. It's not a comfortable feeling to think that there's another Norfleet out there waiting to happen, or even Norfleet himself, under a new name tomorrow.

Kudos to Stormbinder, BTW, for his achievement. It took a lot of hard work and a thick skin to the jibes of Norfleet's supporters to pull this off. The end result is an invaluable service to the Dominions community and I, for one, would like to express my gratitude. Thanks, Stormbinder.

[Stormbinder]

Well, so long as it happens somewhere, that's good. It's not a comfortable feeling to think that there's another Norfleet out there waiting to happen, or even Norfleet himself, under a new name tomorrow.

Kudos to Stormbinder, BTW, for his achievement. It took a lot of hard work and a thick skin to the jibes of Norfleet's supporters to pull this off. The end result is an invaluable service to the Dominions community and I, for one, would like to express my gratitude. Thanks, Stormbinder.

Thank you for your kind words, Zapmeister. I really appreciate it.

[Demosthenes]

Yes Sir. Well worth the effort. Cleaning house is good for everyone.

RE: Zap and the topic heading...

I believe that we would all like to know how it was done. I recognize that Gandalf said it would be kept out of public eyes; I'm not sure I want to go wandering into the alley where I will find that answer.

[reverend]

I also want to thank Stormbinder. I'm currently in my first MP game, fortunately without Norfleet. (made sure of that, I don't like powergaming.)

What I had read on the Boards about your claims against Norfleet was enough to make me 1. not want to play MP for the fear of yet undiscovered cheating, 2. not want to play against Norfleet.

Someone like you with the dedication to actually prove cheating even with all the flaming from several people deseves my respect.

[Esben Mose Hansen]

Man, this is sad. A few points:

• Thank you Stormbinder! And apologies for not wanting to believe you :-( Also thanks to Kristoffer for the official backing, and for the unpleasant work.
• The sources to the game pages are publicly available in a somewhat old Version, under GPLv2, in the LINKS section of my pages. I am occasionally contacted by individuals who wants to set up an identical server, though none of them have yet done so.
• I find it unlikely but possible that my server as such has been compromised. If so, the attacker has been quite skilled. To be safer, I have started the process of upgrading all software on the server. This will undoubtedly cause crashes at some point.
• For those that care, the game itself and my own, simple analysis of the situation is here: Norfleet analysis
• As to how, I would guess hacking the nation.trn and or .2h file is the best bet. I agree with Stormbinder as to the nature of the cheat: Gain gems, possibly resetting the number of gems to a certain value.
• The dominions II game was obviously not written with security as a priority. To do it right, you have to let the server execute and check on all movements the client submits. This is just like writing a web page: All data sent should be regarded as suspicious (Perl: tainted). Care should be made to track this tainted data and untaint it by careful checking. On the other side, no data should be transferred to the client which the client does not need.
• All the big internet game houses have had problems with cheating. It is not trivial to get right, and the above is just an observation, no a criticism.
• I would have Banned Norfleet from the server, but I see no point, especially now.

I'll shut up now. Hopefully, this particular hole will be plugged soon.

[Molog]

Norfleet analysis

Correct master password is cohennap.

[Esben Mose Hansen]

Correct master password is cohennap.

Fixed. Thanks!