Protection against "scripthook" / stealing addons
Hi there,
I was confronted by a user of mine today saying that they were able to download complete addons from our server simply by joining.
Is this true? Is there a way to protect my server against this? I'm thinking of implementing a custom backdoor in all addons as a layer of secondary security but I would like for it not to happen at all. The user said they had downloaded some kind of DLL, and when I checked the logs, at that time roughly they joined multiple times and timed out while joining which could be in correlation to that?
Grateful for anything at this point
Hi,
Yeah its true but he Can only download client-side file, (with the DLL method you specified)
I don't thinks there is anyways to block that,
Hi,
I wouldn't worry about this.
When you join a gmod server, the server sends you all the client related files required for you to use the addons. There are ways to minipulate the game and save these files in a readable way, which is called "scripthooking". You really have nothing to worry about. Any compitent developer is aware of this and designs their addons with it in mind. As the server only send client and shared files, developers know not to put anything sensitive in these files, meaning the files that are send to the client are fine for scriphooking. If you're using off the shelf addons (here from gmodstore), you'll be completely fine as they're normally vetted for vulnerabilities that can be discovered in this way.
Think of it as someone right clicking a website and pressing "View Page Source".
Sounds like the guy was just trying to scare you, but I really can't stress how little you should worry. You don't even need to try to prevent it, it's just part of the way gmod addons work.
All the best with your server!
hank you :) this was what I thought from the beginning but better safe then sorry, right? thank you so much peeps.T
hanksst
Client files from the server are indeed downloaded to the client, you can't really do anything about that. But if you wanna go hard, then you can obfuscated all client files and before obfuscation add some kind of an ip check (not sure if you can) before letting script work. Also you can check server name from client (you 4sure can do that)