Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(GetDataHandlers): handle and ignore NpcItemStrike(msgid 24) #3064

Merged
merged 1 commit into from
Mar 1, 2025

Conversation

LaoSparrow
Copy link
Contributor

@LaoSparrow LaoSparrow commented Feb 28, 2025

NpcItemStrike(msgid 24) will never be sent by a vanilla client(idk if it is true or not, I searched SendData(24 in decompiled source code and found no occurrence, except in the GetData code section shown below), but a modified client can manipulate it to bypass tshock's npc damage threshold and kill town npcs without any permission needed.

some lines from GetData that handles NpcItemStrike(msgid 24):

	case 24:
	{
		int num120 = reader.ReadInt16();
		int num121 = reader.ReadByte();
		if (Main.netMode == 2)
		{
			num121 = whoAmI;
		}
		Player player9 = Main.player[num121];
		Main.npc[num120].StrikeNPC(player9.inventory[player9.selectedItem].damage, player9.inventory[player9.selectedItem].knockBack, player9.direction, crit: false, noEffect: false, fromNet: false, Main.player[whoAmI]);
		if (Main.netMode == 2)
		{
			NetMessage.TrySendData(24, -1, whoAmI, null, num120, num121);
			NetMessage.TrySendData(23, -1, -1, null, num120);
		}
		break;
	}

As you see the npc is striked directly without any checks being done, and the damage depends on the player's currently selected item.

so by sending this packet while holding an item of high damage, everything can be killed.
https://github.com/UnrealMultiple/TerraAngel/blob/2b7661da732d8333855f0cdeadf2dbe7205e41da/TerraAngelPatches/Terraria/TerraAngel/Tools/Butcher.cs#L57

    public static void ButcherNPCBypassTShock(NPC npc, int hitCount = -1)
    {
        int trueHitCount = hitCount;
        if (hitCount == -1)
        {
            var player = Main.player[Main.myPlayer];
            trueHitCount = (int)Math.Ceiling((float)(npc.life + (int)Math.Ceiling(npc.defense / 2f)) / player.inventory[player.selectedItem].damage);
        }
        SpecialNetMessage.SendData(MessageID.PlayerControls, null, Main.myPlayer, npc.position.X, npc.position.Y, (float)Main.LocalPlayer.selectedItem);
        for (int j = 0; j < trueHitCount; j++)
        {
            // vvvv sending msg 24 vvvv
            NetMessage.TrySendData(MessageID.StrikeNPCWithHeldItem, -1, -1, null!, npc.whoAmI, Main.myPlayer);
        }
        NetMessage.SendData(MessageID.PlayerControls, -1, -1, null, Main.myPlayer);
    }

Screenshot_20250301_033038

@hakusaro hakusaro merged commit c9cbee1 into Pryaxis:general-devel Mar 1, 2025
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants