HackPacketCheck.txt
Per-opcode anti-cheat packet rules. For each incoming packet, the server looks up the row keyed by opcode (and optional subcode), validates the encryption flag, then applies a two-threshold rate limiter: log-and-reject at MinCount, disconnect at MaxCount.
File Location#
Data/Hack/HackPacketCheck.txt
Loaded once at GameServer startup. Changes require a restart.
Format#
Plain text, whitespace-delimited, one packet rule per row. Comment lines start with //. File ends with end.
//Index Value Encrypt MaxDelay MinCount MaxCount //Comment
0 * 0 2000 3 5 //Chat message - anti spam
19 * 0 150 25 40 //Skill attack
Columns#
| Column | Type | Effect |
|---|---|---|
Index | int 0-255 | Packet opcode (also used for extended opcode headers like 0xF1, 0xF3, etc.) |
Value | int or * | Subcode filter. * = applies to all subcodes, number = match that subcode only. You may define a wildcard row plus specific subcode rows for the same opcode; the specific row wins for matching subcodes |
Encrypt | 0, 1, or * | 0 = packet must arrive unencrypted, 1 = packet must arrive with valid encryption, * = no encryption check |
MaxDelay | int ms | Rate-limiting window length. 0 disables the rate limiter for this row |
MinCount | int | Log-and-reject threshold. The MinCount+1-th packet in the window is dropped and logged. 0 disables this check |
MaxCount | int | Disconnect threshold. The MaxCount+1-th packet in the window drops the connection. 0 disables this check |
Rate-Limit Math#
For each packet arrival:
- If the opcode has no row in this file, log an "unknown packet" hack entry and disconnect.
- If
Encryptis0or1and the packet's actual encryption does not match, log and disconnect. - Serial check (always on, independent of this file): if the packet's serial is invalid, log and disconnect.
- If the current time is past the window (
MaxDelayms since the first packet of the window), reset the counter and timestamp. - Increment the counter. If it now exceeds
MinCount, log and reject the packet. If it also exceedsMaxCount, additionally disconnect. - Otherwise accept the packet.
Example: Index=0, MaxDelay=2000, MinCount=3, MaxCount=5 accepts the first 3 chat packets per 2-second window, drops the 4th and 5th with a hack log entry, and disconnects on the 6th.
Packet Categories#
The shipped file groups opcodes by function. Categories are cosmetic comments only; the engine treats every row independently.
| Range | Category |
|---|---|
0x00-0x0F | Login / character |
0x10-0x1E | Movement / action (combat 0x13-0x1A has the tightest limits) |
0x1F-0x2F | Item / inventory |
0x30-0x3F | NPC / shop |
0x40-0x4F | Party / guild |
0x50-0x5F | Trade |
0x80-0x8F | Storage |
0xC0-0xCF | Chat |
0xEC, 0xF1, 0xF3 | Extended / GDS / system handlers |
Examples#
0 * 0 2000 3 5 //Chat message
Chat allows 3 messages per 2-second window. The 4th and 5th are dropped with a hack log entry. The 6th disconnects.
19 * 0 150 25 40 //Skill attack
Allows up to 25 skill attacks per 150 ms window. Packets 26-40 are dropped with a log entry. Packet 41 drops the connection.
3 * 1 0 0 0 //Character create
No rate limit. Rejects any character-create packet that did not arrive with valid encryption.
77 * 0 0 0 0 //Default sub
77 0 1 0 0 0 //Sub 0 requires encryption
77 1 1 0 0 0 //Sub 1 requires encryption
Subcodes 0 and 1 must be encrypted. All other subcodes of opcode 77 pass with no encryption check.
243 * * 0 0 0 //0xF3 Special handler
Encrypt=* skips the encryption check. MaxDelay=0 disables the rate limiter. Packet accepted unconditionally (serial check still applies).
Relationship to Common.dat Hack Settings#
Common.dat Hack Settings govern behavioral anti-cheat (attack speed reporting, potion spam tracking, combo timing, serial seeds). This file governs packet-level rate limits and the encryption/plaintext contract.
Movement speed hacking is handled by always-on detectors (not configurable via either file).
Cross-File Dependencies#
| Value | Related in |
|---|---|
Encrypt=1 rows | Use the encryption blobs at Data/Hack/Dec1.dat and Enc2.dat |
| Hack log lines | Gated by Common.dat WriteHackLog |
| Behavioral anti-cheat | Common.dat Hack Settings |
| Chat spam filters | Filter.txt complements the opcode-0 rate limiter by blocking disallowed words |
Common Issues#
- Legit players randomly disconnected during combat -
MaxCounttoo low on opcode 19 (skill attack) or 20 (normal attack); raise in small increments. - All packets for an opcode rejected after adding a row - row uses
Encrypt=0while the client sends that opcode encrypted, or vice versa. SetEncrypt=*to disable the check. - Opcode disconnects immediately with "unknown" in hack log - opcode has no row at all. Every handled opcode must have at least one entry (wildcard row is fine).
- Chat spam not blocked - opcode 0 row has
MaxDelay=0or both count thresholds too high. Combine with Filter.txt for word-level filtering. Encrypt=1packets always rejected - encryption blobs missing or corrupt inData/Hack/, or the client build does not encrypt this opcode.- Warnings flood the log with no useful signal -
MinCountset too low; raise it to reduce noise while keepingMaxCountat the disconnect threshold. - File edits ignored - a row has fewer than 6 columns; the parser aborts on the malformed row (error popup at startup). Check the server console for the script error line number.
- Different players hit limits at different times - rate window is per-player, measured from their own most recent window reset. There are no shared/global limits in this file.