Official gpci() reply by Kalcor

This paste contains more information about what gpci() is, how it work and how you can use it. Be sure to read it thoroughly before making anything with it, since it is NOT unique.

------------------------------------------------------------------------------

http://webcache.googleusercontent.com/search?q=cache:jG5MEwZLqYgJ:forum.sa-mp.com/showthread.php%3Fp%3D1965706+&cd=8&hl=en&ct=clnk
http://webcache.googleusercontent.com/search?q=cache:_4QGjwkooroJ:forum.sa-mp.com/showthread.php%3Fp%3D1968244+&cd=1&hl=nl&ct=clnk&gl=be
// Links don't work anymore as of 22nd October 2012

------------------------------------------------------------------------------

Kalcor's reply

Xentiarox: What exactly is the purpose behind this thread?

It is not an SHA1. The fact that you think it is makes me think you are connected to some cheater/bot websites, which is exactly why the function exists and why it's not (and will never be) documented.

Here is all anyone needs to know about gpci:
  - It is a non-reversible (lossy) hash derived from information about your San Andreas installation path.
  - It is not a unique ID.
  - It was added to assist owners of large servers who deal with constant attacks from cheaters and botters.
  - It has been in SA-MP for 2 years.


The sad reality is that there are more people working on ways to attack SA-MP than there are people working on SA-MP. And it has been that way since the mod was first released. If that wasn't the case, there would be no need for such features like this and we could be open about every change made.

I have pledged that I would never add anything to SA-MP that I wouldn't use myself. So SA-MP will always be free of any spyware, malware or unique tracking codes.

You can use it in combination with an IP address range such as 111.111.*.* for banning. It just depends how concerned you are about accidently blocking innocent players. gpci isn't a unique ID.

------------------------------------------------------------------------------

[MM]IKKE's reply

Your windows user name is included in the hash.

If you use the default group "WINDOWS" with user "homeuser", and I do the same, we will both have the same serial. That's why this is - as Kalcor pointed out - not the ultimate method against cheaters. Many people use "WINDOWS\User" or comparable user accounts.

Though I do like what has been suggested before - save a unique serial in the registry of computers and keep it saved, even after uninstalling. A lot of programs do this to detect trial expirations etc.

Of course there will always be some people able to spoof everything they send to the server. However we should more be talking about the average cheaters - those who just download a certain program and use that program. Those who only know how they can change their IP. For instance, most of these average cheaters will not be able to change their MAC address.


------------------------------------------------------------------------------

Another note: most serials ARE unique. If you find a cheater and/or ban evader with a unique serial, you CAN make a ban system using the serial ONLY. However, be careful since most serials which are NOT unique are extremely common (up to 5% of your database can have the same serial).