Do you remember an addon called LazyScript for WoW? It was a framework that allowed players to create a "script" that would perform certain actions on a key press.
Basically, you would write or download a script and when you made a single key-press, it would evaluate all the rules in this script and choose the action that best suited the situation.
Decursive and several other healing addons performed similar functions, but I still believe that LazyScript was the real reason that Blizzard introduced the whole "taint" thing in WoW 2.0 that broke these addons.
Exploiting Warhammer Online
You might recall that back in August, I voiced some concerns about work-arounds. At that time, I had tinkered around a bit looking at some of the default interface code but really hadn't gotten my hands dirty.
My big suspicion was that it would be possible to swap out bindings as they are pressed and effectively allow you to bind several actions to a single button.
I was about 95% certain this was possible, but I didn't want to write a proof-of-concept to test it. It's my belief that Mythic would close this loophole at some point and I didn't want to cripple my playstyle into being dependent on an addon they would eventually break.
And so I waited... Becuase I knew it was only a matter of time until someone wrote it.
HotbarFun
The first addon using the method I suspected of being exploitive is called HotbarFun. Right now, the purpose of this addon is to simply swap actions in/out of a single action bar button based on whether or not it is on cooldown.
Imagine if Action A had a 10 second cooldown and Action B had no cooldown. Basically, if Action A were off cooldown, it would take that button slot. Otherwise, Action B would take the slot.
The important thing to note here is not WHY it can change, but that it CAN be changed. In this case, the author is not really doing much that is terribly expoitive. In his mind, it's more a matter of reducing two button slots into one slot.
The issue is that there is no reason that the criteria couldn't be a lot more complex.
Automation
The real threat here is the potential abuse that can be had by automating actions. Imagine if the button swaps were based on other criteria besides cooldown.
Is your health too low and bubble is off cooldown? Don't worry, that next key press will be a bubble.
Getting damaged by your Target? Don't worry, we'll detaunt him for you on the next key press.
Since Detonate requires your target to be Hexxed, we'll make sure your target has that debuff before we Detonate or cast one for you instead.
Does your target already have that HoT or DoT you were going to cast? Don't worry, we'll cast the right spell for you.
Casting a heal but your target is dead? Don't worry, we'll resurrect instead.
Are you an Archmage with 5 points in High Magic that was going to cast a HoT? Bad idea, your target is low health. Let's cast the big heal as an instant cast instead.
Get the idea?
My point here is that there is NO reason that the logic behind deciding which action gets swapped into the action slot can't be far more complex than a simple cooldown.
Mythic needs to take action
Closing this loophole is something they need to fix in one of the upcoming patches. I'm not trying to be doom-and-gloomy, but all the things I just described WILL be written if they don't work to nip it in the bud now.
BTW, as I wrote to the author of HotbarFun in the comments, he shouldn't be condemned for writing such an addon. Mythic shouldn't let this type of thing be possible. UI addons are great, but as Blizzard learned the hard way, you need secure the functions that allow players to take actions.
Thursday, October 30, 2008
Subscribe to:
Post Comments (Atom)
Posts
5 comments:
You are sooo right.. Especially in a game where you compete against other players such automated actions should be kept at a minimum or even better forbidden.
Letting a script evaluate what you should do is the worst thing that can happen in terms of competition.
But Mythic should further improve the UI in some responsive way so that such addons are not so much needed. I actually bite every time in my desk when I want to use a morale ability which is shown as available, but then, when executing it, I get the response that the cooldown is still up..Or a check if someone I'm currently healing dies while I cast.
There is still some discrepancy from what is animated, executed and shown in the target frames. (Target frame says dead, but healing within a short amount of time will still come through and the status changes from dead to low-health..)
This has to be improved so that I am more aware of what is happening out there, not needing a script to tell it to me or even decide what I'm going to do.
"Wanting people to listen, you can't just tap them on the shoulder anymore. You have to hit them with a sledgehammer, and then you'll notice you've got their strict attention."
Mythic's not the only company that ignores potential attack vectors until (or even after) they have a working exploit in front of them.
Limitations in the Blizzard addon API were not there in the beginning, either. Addons like AutoTravel, Decursive, CT_RaidAssist and Lazyscript are necessary in exploring what can (and should) be possible to accomplish with addons.
So go ahead, get creative. In the end, you're doing every WAR player out there a favor.
I never used any add-ons in WoW... I am curious, can you explain how this "taint" effect worked?
http://www.wowwiki.com/Secure_Execution_and_Tainting
Thanks for the link. Interesting the lengths they went to.
I think it speaks somewhat to the combat system of a game if it is possible to mod like this in meaningul ways.
I can see how WAR benefits from it. People tend to die relatively slowly and mana hardly ever runs out if you spam skills, so you can have a simple addon code that hits people under a certain amount of HP with a HoT or some such.
In a game like Guild Wars though, I've never heard of this being such a problem. I would never use a script in that game that did particular actions for me, as you really need to be watching the battlefield to correctly identify threats. And if you have a program using your skills for you willy nilly, you'd run out of mana quick fast.
Post a Comment