Tutorials Restricting Debug by RoleId / UserId as a Special GM Right

Some time ago Mr.int3 wrote a guide on how to restrict Debug for GM. But giving all GM the ability to use Debug is not a good idea, so I decided to restrict it by other criteria, namely: roleid, userid, make it a special GM right (added via the auth table in MySql).

We will edit the following functions in GS: gplayer_controller::CommandHandler and gplayer_controller::DebugCommandHandler.

All manipulations are performed on GS version 1.2.6, but on other versions everything is done in a similar way, except for the Debug limitation by userid.

So let's get started. Open gs in IDA and go to the gplayer_controller::DebugCommandHandler function. As in the guide from int 3, to limit debugging we will erase the function call: GLog::log.

1. Get the offset to RoleID and erase the function call.​

In the future, to limit Debug by RoleId and UserId, we will need the character's RoleId.
In the screenshot, number 1 points to the GLog::log function that needs to be erased, and number 2 points to the argument passed to the GLog::logfunction, which , by a lucky coincidence, is the Id of the character that uses Debug.

We click on the parameter indicated by the number 2 and press the J key to go to the assembler code, and we see:

The red frame highlights the call to the GLog::log function, which needs to be erased, and the yellow frame highlights the offset to the character's Id. Copy the yellow highlight to yourself.
We erase the function call, for this you can use the built-in Hex-radokr in IDA or any other, it should look like this:

2. Debug restriction by Roleid.​

In order for Debug to be able to use only a certain character, its id must be compared with the allowed one. This can be done by writing a check in place of the deleted call to the GLog::log function.
In assembler, the specified check would look like this:

mov     eax, [ebp+8]
mov     eax, [eax+4]
mov     eax, [eax+8]
cmp     dword ptr [eax+30h], 20h
jnz     2AAC

The specified commands must be translated into opcod and written into the selected area using a Hex editor.
20h - Character Id, in this case 32.
jnz 2AAC - exit from the function, where 2AAC is the difference between the destination address and the address of the command immediately following the jump. In this case: 80D4ECF - (080D241D + 6) = 2AAC. Where:
080D4ECF - function exit address
080D241D - the address where the jnz command is located
6 - the number of bytes occupied by the jnz command.

Commands and their corresponding opcodes

mov     eax, [ebp+8] - 8B 45 08
mov     eax, [eax+4] - 8B 40 04
mov     eax, [eax+8] - 8B 40 08
cmp     dword ptr [eax+30h], 20h - 83 78 30 20
jnz     2AAC - 0F 85 AC 2A 00 00

The whole Hex code: 8B 45 08 8B 40 04 8B 40 08 83 78 30 20 0F 85 AC 2A 00 00

It should look like this:
Hex:


Asm:


Pseudocode.


Save, upload GS to the server, start the server. After these changes, Debug will be available only to the character with Id equal to 32.

2. Debug limitation by User ID (Only for 1.2.6)​

And so in 1.2.6 UserID can be found using RoleID using the following formula: UserID = floor(RoleID / 16) * 16
So the assembly code for checking will look like this:

mov     eax, [ebp+this]
mov     eax, [eax+4]
mov     eax, [eax+8]
mov     eax, [eax+30h]
shr     eax, 4
shl     eax, 4
cmp     eax, 20h
jnz     2AA4

The specified commands must be translated into opcod and written into the selected area using a Hex editor.

20h is the account ID, in this case 32.
jnz 2AA4 - exit from the function, where 2AAC is the difference between the destination address and the address of the command immediately following the jump. In this case: 80D4ECF - (080D2425 + 6) = 2AAC. Where:
80D4ECF - function exit address
080D2425 - the address where the jnz command is located
6 - the number of bytes occupied by the jnz command.

Commands and their corresponding opcodes

mov     eax, [ebp+8] - 8B 45 08
mov     eax, [eax+4] - 8B 40 04
mov     eax, [eax+8] - 8B 40 08
mov     eax, [eax+30h] - 8B 40 30
shr     eax, 4 - C1 E8 04
shl     eax, 4 - C1 E0 04
cmp     eax, 20h - 83 F8 20
jnz     2AA4 - 0F 85 A4 2A 00 00

The whole Hex code: 8B 45 08 8B 40 04 8B 40 08 8B 40 30 C1 E8 04 C1 E0 04 83 F8 20 0F 85 A4 2A 00 00

It should look like this:
Hex


Asm


Pseudocode.


Save, upload GS to the server, start the server. After these changes, Debug will be available only to the account with ID equal to 32.

3. Debug as a special GM right (added via the auth table in MySql).​

In order to do this, you need to find out how the GM is checked for the right to perform an action. You also need to select a code for it that not only you like, but is also not occupied by another right.

Let's get started:
To find out how the check for GM's right to perform an action is carried out, you need to refer to the gplayer_controller::GMCommandHandler function, in which such a check is carried out.

The screenshot shows the check we are interested in in red. It shows that the function GNET:: Privilege::Has_Hide_BeGod is called. As the name suggests, this function checks whether the GM can use infidelity and invulnerability.
Double-click to go to the pseudocode of the specified function and see that it checks for equality to one of the value of the array element with an index equal to the GM right, which is written to MySql. The array itself has a fixed size of 256 bytes.

That is, in order to make Debug a special GM right, you need to choose any number you like in the range from 0 to 255, which is free, and perform a check for its equality to one. I chose the value 250.

And so, it is necessary to find out the offsets to this array.
We go to the gplayer_controller::GMCommandHandler function and see that _gm_auth is passed as a parameter to the GNET:: Privilege::Has_Hide_BeGod function, we go to the assembler code and see the following:


Let's move on to the assembler code of the GNET:: Privilege::Has_Hide_BeGod function and see:


So the assembly code for checking will look like this:

mov     eax, [ebp+8]
mov     eax, [eax+38h]
cmp     byte ptr [eax+0FAh], 1
jnz     2AAC

The specified commands must be translated into opcod and written into the selected area using a Hex editor.

0FAh- GM special right ID, in this case 250.
jnz 2AAC - exit from the function, where 2AAC is the difference between the destination address and the address of the command immediately following the jump. In this case: 80D4ECF - (080D241D+ 6) = 2AAC. Where:
080D4ECF - function exit address
080D241D - the address where the jnz command is located
6 - the number of bytes occupied by the jnz command.

Commands and their corresponding opcodes

mov     eax, [ebp+8] - 8B 45 08
mov     eax, [eax+38h] - 8B 40 38
cmp     byte ptr [eax+0FAh], 1 - 80 B8 FA 00 00 00 01
jnz     2AAC - 0F 85 AC 2A 00 00

The whole Hex code: 8B 45 08 8B 40 38 80 B8 FA 00 00 00 01 0F 85 AC 2A 00 00

It should look like this:
Hex.


Asm.


Pseudocode.


Save, upload GS to the server, start the server, issue GM rights with ID equal to 250 to those who need them. After these changes, Debug will be available only to accounts that have GM rights with ID equal to 250.

4. Final touches.​

So, the debug is limited by one of the above criteria and everything seems to be fine, but now teleportation by ctrl+left mouse button does not work for simple GMs.
To fix this, you need to edit the gplayer_controller::CommandHandler function, namely remove the following check from it:


In assembler it looks like this:


To do this, you need to erase the selected section of code.

It should look like this:
Hex.


Asm


Pseudocode.


We save, upload GS to the server, and start the server.
That's all. Now Debug is limited to one of the three methods listed above, and all GMs have teleportation via ctrl+left mouse click.