[OSWO]

Working Fix: https://forums.alliedmods.net/showpo...9&postcount=22

Title:
Anti-Setinfo

Description:
Anti-Setinfo and records data to a file.

Commands:
None.

Plugin Info:
Credits to @Element and @Neuro Toxin

Change log:

v1.00
Release

[Bara]

You can remove the attached .smx-file. (web compiler works fine)

[Neuro Toxin]

This hasn't been verified.

Someone needs to confirm the crash method used by the latest aimware release.

[Peace-Maker]

Make sure to always loop all clients including MaxClients like

PHP Code:

for (int i = 1; i <= MaxClients; i++) 


You should also include a time frame in your check, so legimate players changing some settings over a long time wouldn't be kicked eventually.

[Lial]

i think these better

[Neuro Toxin]

This is what I had done before this thread was made.

static int s_iClientSettingsChangedCount[MAXPLAYERS+1];

public void OnPluginStart()
{
    CreateTimer(1.0, OnClientCountSettingsChanged, _, TIMER_REPEAT);
}

public OnClientConnected(int client)
{
    s_iClientSettingsChangedCount[client] = 0;
}

public void OnClientSettingsChanged(int client)
{
    if (IsFakeClient(client))
        return;
    
    s_iClientSettingsChangedCount[client]++;
}

public Action OnClientCountSettingsChanged(Handle timer, any data)
{
    for (int client = 1; client <= MaxClients; client++)
    {
        if (!IsClientInGame(client))
            continue;
        
        if (IsFakeClient(client))
            continue;
        
        if (s_iClientSettingsChangedCount[client] > 10)
        {
            PrintToChatAll("[SM] %N was kicked for trying to crash the server.", client);
            KickClient(client, "Client suspected of setinfo exploit!");
            continue;
        }
        
        s_iClientSettingsChangedCount[client] = 0;
    }
}

As also stated: This plugin shouldnt be labeled "Aimware Anti-Crash" because no-one has actually confirmed if this is how the new Aimware crash works.

This does however block name change abuse and the setinfo exploit.

The OP was just wanting to get a plugin out without taking the time to go through the confirmation process.

Edit: I will mention the above code has been confirmed to block the setinfo attack.

[OSWO]

Alright, This has lead to no fix.

I'd wait for Valve to update since they're affected too - and they know best about their own game. This still works for name changers as Neuro stated. Had a 2 hour trial and error with someone with Aimware, and no client commands were being picked up by the server, even though a ClientSetting was being changed.

The crash only managed to trigger about 20 ClientSetting changes in a span of 20 or 30 seconds, which cannot be blocked since inspect weapons and all other things too trigger a ClientSetting Change so it's impossible to check against a overflow or spam attack.

I'ld like the name to be changed to Anti-Setinfo if possible please, thanks.

[PresidentEvil]

thanks for trying

[sneaK]

Originally Posted by PresidentEvil thanks for trying

Yes indeed, thank you sir

[lasthero34]

Anyone tell me please its work ?

I think they doing with aimware. https://www.youtube.com/watch?v=FSNLVnnlLt8