For the complete documentation index, see llms.txt. This page is also available as Markdown.

📑HackPacketCheck

Anti-hack validation rules for each type of packet sent by the client to the GameServer.

Column
Accepted values
Description

Index

Number from 0 to 255

The packet type (protocol opcode) this rule applies to.

Value

Number, or *

Specific sub-value for this packet. * = the rule applies to any sub-value of this packet. A specific number = the rule applies only to packets with exactly that sub-value (see notes).

Encrypt

0, 1, or *

Encryption type the packet must use to be accepted. * = the encryption type is not checked.

MaxDelay

Number, in milliseconds, or 0

Time window used to count repeated occurrences of this packet. 0 = disables repeat counting for this packet (MinCount and MaxCount are ignored).

MinCount

Number, or 0

Within the time window (MaxDelay), how many times this packet may be received before it is considered suspicious. Once this limit is exceeded, the packet is ignored (the connection remains active). 0 = disabled.

MaxCount

Number, or 0

Higher limit within the same time window. If exceeded, the player's connection is immediately terminated. 0 = disabled.

Notes

  • When an Index has multiple entries with specific Value values (instead of *), they act as a whitelist: only the listed sub-values are accepted for that Index. Any other unlisted sub-value is treated as an unknown packet, and the connection is immediately terminated. This is the case for packet indices 77, 78, and 236 in the default file, which accept only the explicitly listed sub-values.

  • MinCount and MaxCount work together: exceeding MinCount marks the packet as suspicious and records it in the log (that packet instance is discarded), while exceeding MaxCount causes the player's connection to be terminated.

  • In the default configuration, repeat detection (MaxDelay/MinCount/MaxCount) is enabled only for Index 24. All other packet types have these three fields set to 0, meaning no repeat checking is performed—only the encryption check (Encrypt), when applicable.

Last updated