Meh, google gives me nothing. Explain.
That's because that "I cast the Spell of Mastery" was a reference to Master of Magic. I examined Terraria's network protocol / packet system, found that it was horribly insecure, and wrote a program which sits between the client and server and does certain things, either with button presses, or automatically if checkboxes are checked or what-have-you. It was all For Science!, of course. The last thing I did was figure out a way to crash a server, because I realized I hadn't done that yet and it was kind of obligatory that I have a button to do that just as a demonstration if I was going to send this to Red. Turns out that there's code in the server's networking routines which is supposed to prevent crashes by catching all exceptions that originate from networking stuff. I found a way around it, of course, by sending a packet which changes a field to something that it shouldn't be set to, which rather than causing an exception then, instead causes an exception later when the field is used in an unprotected section of code. The reason this is possible is because there's no input validation on pretty much anything the client sends - There are almost no checks to make sure things are in any kind of bounds or have sane values, and many packets don't verify whether the client sending them is the client being acted on (some packets force the player being acted on to be the player sending the packet).
So, what do I mean? These are all possible, and I've proven them all: The client can say "I have 30000 HP and 30000 max HP" and the server will do it. The client can say "By the way, I have a velocity of 0,-100" and the server will send the client's character rocketing up towards the top of the map. The client can say "Turn on Player 2's PVP flag" and the server will do it. The client can say "Player 3 explodes into a spray of blood now"
and the server will do it. Creating lava and water was fairly easy. It's just a matter of telling the server (and the client) that liquid is being created on a specific tile (it's the same thing that's done when a bucket is dumped - the same packet is sent). The server just accepts it without question and creates the liquid as instructed.
I theorize that perhaps the networking was looked at from the point of view of making it so that when the client or server did something, it needed to send packets to tell the other how to replicate the changes to its state. In this way, it makes sense, but it's terrible for security. (There are packets for things like doing damage, creating and destroying tiles and walls, killing players, changing your life and mana, setting the player's position and velocity and sending its controls and facing and such, but no packets for what you'd expect if it implemented things as the client sending actions to the server to be simulated and sent back, e.g. use bucket on tile, mine tile, hammer tile, use weapon, etc - combat and all these things are all client-side, with the client determining the results and sending messages indicating changes to the worldstate to the server. The client-side simulation of the world goes so far that you can remove items from the world and put them in your inventory after the server crashes, and they'll still be in the world when the server comes back up because you only removed them in the client's simulation of the world. There was no server listening to the client saying "So I just dismantled this hellforge in the world, and there's a hellforge in my inventory now," and the lack of a server on the other end doesn't stop the client from letting you do it, if you do it before your client realizes that nobody's answering it (which takes several minutes).)
I intend to send my source code to Red at some point so he can see what weaknesses I've found, but first I'll have to upload it somewhere (preferably using svn or something) and second find an email address for him or the like. Or perhaps PM him on the Terraria Online forums.
Note: The program I wrote for this is a separate program which I wrote from scratch, not a modified version of Terraria, and is not based on Terraria, unlike what I have heard other people have done (I don't know if anyone has done anything as comprehensive, either, but it would be difficult to know, considering the rules on the Terraria Online forums forbid talking about this kind of thing).
Author
Topic: Terraria - 1.3 released. Big Patch! (Read 1319559 times)