Update Dockerfile, license, and readme

* Add Email column to Account table

* Add LastPasswordReset timestamp column, missing DB version bump

.github/workflows/check-builds.yaml

@@ -9,12 +9,13 @@ on:
         - CMakeLists.txt
         - Makefile
   pull_request:
-    types: ready_for_review
+    types: [opened, reopened, synchronize, ready_for_review]
     paths:
         - src/**
         - vendor/**
         - CMakeLists.txt
         - Makefile
+  workflow_dispatch:
 
 jobs:
   ubuntu-build:
@@ -28,7 +29,7 @@ jobs:
           submodules: recursive
           fetch-depth: 0
       - name: Install dependencies
-        run: sudo apt install clang cmake snap -y && sudo snap install powershell --classic
+        run: sudo apt install clang cmake snap libsqlite3-dev -y && sudo snap install powershell --classic
       - name: Check compilation
         run: |
           $versions = "104", "728", "1013"
@@ -51,9 +52,9 @@ jobs:
           Copy-Item -Path "config.ini" -Destination "bin"
         shell: pwsh
       - name: Upload build artifact
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v4
         with:
-          name: 'ubuntu20_04-bin-x64-${{ env.SHORT_SHA }}'
+          name: 'ubuntu22_04-bin-x64-${{ env.SHORT_SHA }}'
           path: bin
 
   windows-build:
@@ -105,7 +106,7 @@ jobs:
           }
         shell: pwsh
       - name: Upload build artifact
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v4
         with:
           name: 'windows-vs2019-bin-x64-${{ env.SHORT_SHA }}'
           path: bin
@@ -126,7 +127,7 @@ jobs:
           GITDESC=$(git describe --tags)
           mkdir $GITDESC
           echo "ARTDIR=$GITDESC" >> $GITHUB_ENV
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4
         with:
           path: ${{ env.ARTDIR }}
       - name: Upload artifacts

.github/workflows/push-docker-image.yml

@@ -0,0 +1,38 @@
+name: Push Docker Image
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+jobs:
+  push-docker-image:
+    name: Push Docker Image
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - name: Retrieve major version
+        uses: winterjung/split@v2
+        id: split
+        with:
+          msg: ${{ github.ref_name }}
+          separator: .
+      - name: Log in to registry
+        uses: docker/login-action@v3
+        with:
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Build and push the Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ secrets.DOCKERHUB_REPOSITORY }}:${{ github.ref_name }},${{ secrets.DOCKERHUB_REPOSITORY }}:${{ steps.split.outputs._0 }},${{ secrets.DOCKERHUB_REPOSITORY }}:latest

.vscode/launch.json

@@ -0,0 +1,26 @@
+{
+    "version": "0.2.0",
+    "configurations": [
+        {
+            "name": "Debug (Linux)",
+            "type": "cppdbg",
+            "request": "launch",
+            "program": "${workspaceFolder}/bin/fusion",
+            "cwd": "${workspaceFolder}"
+        },
+        {
+            "name": "Debug (Windows)",
+            "type": "cppvsdbg",
+            "request": "launch",
+            "program": "${workspaceFolder}/bin/Debug/winfusion.exe",
+            "cwd": "${workspaceFolder}"
+        },
+        {
+            "name": "Release (Windows)",
+            "type": "cppvsdbg",
+            "request": "launch",
+            "program": "${workspaceFolder}/bin/Release/winfusion.exe",
+            "cwd": "${workspaceFolder}"
+        }
+    ]
+}

CMakeLists.txt

@@ -45,7 +45,7 @@ add_executable(openfusion ${SOURCES})
 set_target_properties(openfusion PROPERTIES OUTPUT_NAME ${BIN_NAME})
 
 # find sqlite3 and use it
-find_package(sqlite3 REQUIRED)
+find_package(SQLite3 REQUIRED)
 target_include_directories(openfusion PRIVATE ${SQLite3_INCLUDE_DIRS})
 target_link_libraries(openfusion PRIVATE ${SQLite3_LIBRARIES})
 
@@ -57,5 +57,5 @@ set_property(TARGET openfusion PROPERTY VS_DEBUGGER_WORKING_DIRECTORY "${CMAKE_S
 # It's not something you should do, but it's there if you need it...
 if (NOT CMAKE_GENERATOR MATCHES "Visual Studio" AND NOT CMAKE_CXX_COMPILER_ID STREQUAL "MSVC" AND NOT CMAKE_GENERATOR MATCHES "MinGW Makefiles")
 	find_package(Threads REQUIRED)
-	target_link_libraries(openfusion pthread)
+	target_link_libraries(openfusion PRIVATE pthread)
 endif()

CONTRIBUTING.md

@@ -26,7 +26,7 @@ Both are pretty short reads and following them will get you up to speed with bra
 
 I will now cover a few examples of the complications people have encountered contributing to this project, how to understand them, overcome them and henceforth avoid them.
 
-## Dirty pull requests
+### Dirty pull requests
 
 Many Pull Requests OpenFusion receives fail to present a clean set of commits to merge.
 These are generally either:
@@ -44,7 +44,7 @@ If you read the above links, you'll note that this isn't exactly a perfect solut
 The obvious issue, then, is that the people submitting dirty PRs are the exact people who don't *know* how to rebase their fork to continue submitting their work cleanly.
 So they end up creating countless merge commits when pulling upstream on top of their own incompatible histories, and then submitting those merge commits in their PRs and the cycle continues.
 
-## The details
+### The details
 
 A git commit is uniquely identified by its SHA1 hash.
 Its hash is generated from its contents, as well as the hash(es) of its parent commit(s).
@@ -52,7 +52,7 @@ Its hash is generated from its contents, as well as the hash(es) of its parent c
 That means that even if two commits are exactly the same in terms of content, they're not the same commit if their parent commits differ (ex. if they've been rebased).
 So if you keep issuing `git pull`s after upstream has merged a rebased version of your PR, you will never re-synchronize with it, and will instead construct an alternate history polluted by pointless merge commits.
 
-## The solution
+### The solution
 
 If you already have a messed-up fork and you have no changes on it that you're afraid to lose, the solution is simple:
 
@@ -67,7 +67,7 @@ If you do have some committed changes that haven't yet been merged upstream, you
 If you do end up messing something up, don't worry, it most likely isn't really lost and `git reflog` is your friend.
 (You can checkout an arbitrary commit, and make it into its own branch with `git checkout -b BRANCH` or set a pre-exisitng branch to it with `git reset --hard COMMIT`)
 
-## Avoiding the problem
+### Avoiding the problem
 
 When working on a changeset you want to submit back upstream, don't do it on the main branch.
 Create a work branch just for your changeset with `git checkout -b work`.
@@ -81,3 +81,34 @@ That way you can always keep master in sync with upstream with `git pull --ff-on
 Creating new branches for the rebase isn't strictly necessary since you can always return a branch to its previous state with `git reflog`.
 
 For moving uncommited changes around between branches, `git stash` is a real blessing.
+
+## Code guidelines
+
+Alright, you're up to speed on Git and ready to go. Here are a few specific code guidelines to try and follow:
+
+### Match the styling
+
+Pretty straightforward, make sure your code looks similar to the code around it. Match whitespacing, bracket styling, variable naming conventions, etc.
+
+### Prefer short-circuiting
+
+To minimize branching complexity (as this makes the code hard to read), we prefer to keep the number of `if-else` statements as low as possible. One easy way to achieve this is by doing an early return after branching into an `if` block and then writing the code for the other path outside the block entirely. You can find examples of this in practically every source file. Note that in a few select situations, this might actually make your code less elegant, which is why this isn't a strict rule. Lean towards short-circuiting and use your better judgement.
+
+### Follow the include convention
+
+This one matters a lot as it can cause cyclic dependencies and other code-breaking issues.
+
+FOR HEADER FILES (.hpp):
+- everything you use IN THE HEADER must be EXPLICITLY INCLUDED with the exception of things that fall under Core.hpp
+- you may NOT include ANYTHING ELSE
+
+FOR SOURCE FILES (.cpp):
+- you can #include whatever you want as long as the partner header is included first
+- anything that gets included by another include is fair game
+- redundant includes are ok because they'll be harmless AS LONG AS our header files stay lean.
+
+The point of this is NOT to optimize the number of includes used all around or make things more efficient necessarily. it's to improve readability & coherence and make it easier to avoid cyclical issues.
+
+## When in doubt, ask
+
+If you still have questions that were not answered here, feel free to ping a dev in the Discord server or on GitHub.

Dockerfile

@@ -0,0 +1,41 @@
+# build
+FROM alpine:3 as build
+
+WORKDIR /usr/src/app
+
+RUN apk update && apk upgrade && apk add \
+linux-headers \
+git \
+clang18 \
+make \
+sqlite-dev
+
+COPY src ./src
+COPY vendor ./vendor
+COPY .git ./.git
+COPY Makefile CMakeLists.txt version.h.in ./
+
+RUN sed -i 's/^CC=clang$/&-18/' Makefile
+RUN sed -i 's/^CXX=clang++$/&-18/' Makefile
+
+RUN make nosandbox -j$(nproc)
+
+# prod
+FROM alpine:3
+
+WORKDIR /usr/src/app
+
+RUN apk update && apk upgrade && apk add \
+libstdc++ \
+sqlite-dev
+
+COPY --from=build /usr/src/app/bin/fusion /bin/fusion
+COPY sql ./sql
+
+CMD ["/bin/fusion"]
+
+EXPOSE 23000/tcp
+EXPOSE 23001/tcp
+EXPOSE 8003/tcp
+
+LABEL Name=openfusion Version=2.0.0

LICENSE.md

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2020-2022 OpenFusion Contributors
+Copyright (c) 2020-2025 OpenFusion Contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

Makefile

@@ -95,8 +95,6 @@ CXXHDR=\
 	vendor/bcrypt/BCrypt.hpp\
 	vendor/INIReader.hpp\
 	vendor/JSON.hpp\
-	vendor/INIReader.hpp\
-	vendor/JSON.hpp\
 	src/Buffs.hpp\
 	src/Chat.hpp\
 	src/CustomCommands.hpp\
@@ -117,6 +115,7 @@ CXXHDR=\
 	src/settings.hpp\
 	src/Transport.hpp\
 	src/TableData.hpp\
+	src/Bucket.hpp\
 	src/Chunking.hpp\
 	src/Buddies.hpp\
 	src/Groups.hpp\
@@ -135,6 +134,8 @@ HDR=$(CHDR) $(CXXHDR)
 all: $(SERVER)
 
 windows: $(SERVER)
+nosandbox: $(SERVER)
+nolandlock: $(SERVER)
 
 # assign Windows-specific values if targeting Windows
 windows : CC=$(WIN_CC)
@@ -144,6 +145,9 @@ windows : CXXFLAGS=$(WIN_CXXFLAGS)
 windows : LDFLAGS=$(WIN_LDFLAGS)
 windows : SERVER=$(WIN_SERVER)
 
+nosandbox : CFLAGS+=-DCONFIG_NOSANDBOX=1
+nolandlock : CFLAGS+=-DCONFIG_NOLANDLOCK=1
+
 .SUFFIXES: .o .c .cpp .h .hpp
 
 .c.o:
@@ -165,7 +169,7 @@ version.h:
 
 src/main.o: version.h
 
-.PHONY: all windows clean nuke
+.PHONY: all windows nosandbox nolandlock clean nuke
 
 # only gets rid of OpenFusion objects, so we don't need to
 # recompile the libs every time

README.md

@@ -1,33 +1,35 @@
-<p align="center"><img width="640" src="res/openfusion-hero.png" alt=""></p>
+<p align="center"><img width="640" src="res/openfusion-hero.png" alt="OpenFusion Logo"></p>
 
 <p align="center">
     <a href="https://github.com/OpenFusionProject/OpenFusion/releases/latest"><img src="https://img.shields.io/github/v/release/OpenFusionProject/OpenFusion" alt="Current Release"></a>
     <a href="https://github.com/OpenFusionProject/OpenFusion/actions/workflows/check-builds.yaml"><img src="https://github.com/OpenFusionProject/OpenFusion/actions/workflows/check-builds.yaml/badge.svg" alt="Workflow"></a>
+    <a href="https://hub.docker.com/repository/docker/openfusion/openfusion/"><img src="https://badgen.net/docker/pulls/openfusion/openfusion?icon=docker&label=pulls"></a>
     <a href="https://discord.gg/DYavckB"><img src="https://img.shields.io/badge/chat-on%20discord-7289da.svg?logo=discord" alt="Discord"></a>
     <a href="https://github.com/OpenFusionProject/OpenFusion/blob/master/LICENSE.md"><img src="https://img.shields.io/github/license/OpenFusionProject/OpenFusion" alt="License"></a>
 </p>
 
-OpenFusion is a reverse-engineered server for FusionFall. It primarily targets versions `beta-20100104` and `beta-20111013` of the original game, with [limited support](https://github.com/OpenFusionProject/OpenFusion/wiki/FusionFall-Version-Support) for others.
+OpenFusion is a reverse-engineered server for FusionFall. It primarily targets versions `beta-20100104` and `beta-20111013` of the original game, with [limited support](https://openfusion.dev/docs/reference/fusionfall-version-support/) for others.
 
 ## Usage
 
 ### Getting Started
 #### Method A: Installer (Easiest)
-1. Download the client installer by clicking [here](https://github.com/OpenFusionProject/OpenFusion/releases/download/1.4/OpenFusionClient-1.4-Installer.exe) - choose to run the file.
-2. After a few moments, the client should open: you will be given a choice between two public servers by default. Select the one you wish to play and click connect.
+1. Download the launcher installer by clicking [here](https://github.com/OpenFusionProject/OpenFusionLauncher/releases/latest/download/OpenFusionLauncher-Windows-Installer.exe) - choose to run the file.
+2. After a few moments, the launcher should open: you will be given a choice between two public servers by default. Select the one you wish to play and click connect.
 3. To create an account, simply enter the details you wish to use at the login screen then click Log In. Do *not* click register, as this will just lead to a blank screen.
 4. Make a new character, and enjoy the game! Your progress will be saved automatically, and you can resume playing by entering the login details you used in step 3.
 
 #### Method B: Standalone .zip file
-1. Download the client from [here](https://github.com/OpenFusionProject/OpenFusion/releases/download/1.4/OpenFusionClient-1.4.zip).
+1. Download the launcher from [here](https://github.com/OpenFusionProject/OpenFusionLauncher/releases/latest/download/OpenFusionLauncher-Windows-Portable.zip).
 2. Extract it to a folder of your choice. Note: if you are upgrading from an older version, it is preferable to start with a fresh folder rather than overwriting a previous install.
-3. Run OpenFusionClient.exe - you will be given a choice between two public servers by default. Select the one you wish to play and click connect.
+3. Run OpenFusionLauncher.exe - you will be given a choice between two public servers by default. Select the one you wish to play and click connect.
 4. To create an account, simply enter the details you wish to use at the login screen then click Log In. Do *not* click register, as this will just lead to a blank screen.
 5. Make a new character, and enjoy the game! Your progress will be saved automatically, and you can resume playing by entering the login details you used in step 4.
 
-### Hosting a server
+Instructions for getting the client to run on Linux through Wine can be found [here](https://openfusion.dev/docs/guides/running-on-linux/).
 
-1. Grab `OpenFusionServer-1.4-original.zip` or `OpenFusionServer-1.4-academy.zip` from [here](https://github.com/OpenFusionProject/OpenFusion/releases/tag/1.4).
+### Hosting a server
+1. Grab `OpenFusionServer-Windows-Original.zip` or `OpenFusionServer-Windows-Academy.zip` from [here](https://github.com/OpenFusionProject/OpenFusion/releases/latest).
 2. Extract it to a folder of your choice, then run `winfusion.exe` (Windows) or `fusion` (Linux) to start the server.
 3. Add a new server to the client's list:
     1. For Description, enter anything you want. This is what will show up in the server list.
@@ -35,7 +37,7 @@ OpenFusion is a reverse-engineered server for FusionFall. It primarily targets v
     3. Lastly Game Version - select `beta-20100104` if you downloaded the original zip, or `beta-20111013` if you downloaded the academy zip.
 5. Once you've added the server to the list, connect to it and log in. If you're having trouble with this, refer to steps 4 and 5 from the previous section.
 
-If you want, [compiled binaries (artifacts) for each functional commit can be found here.](http://cdn.dexlabs.systems/of-builds/)
+If you want to run the latest development builds of the server, [compiled binaries (artifacts) for each functional commit can be found here.](http://cdn.dexlabs.systems/of-builds/)
 
 For a more detailed overview of the game's architecture and how to configure it, read the following sections.
 
@@ -52,10 +54,7 @@ FusionFall consists of the following components:
 
 The original game made use of the player's actual web browser to launch the game, but since then the NPAPI plugin interface the game relied on has been deprecated and is no longer available in most modern browsers. Both Retro and OpenFusion get around this issue by distributing an older version of Electron, a software package that is essentially a specialized web browser.
 
-The browser/Electron client opens a web page with an `<embed>` tag of MIME type `application/vnd.unity`, where the `src` param is the address of the game's `.unity3d` entrypoint.
-
-This triggers the browser to load an NPAPI plugin that handles this MIME type, the Unity Web Player, which the browser looks for in `C:\Users\%USERNAME%\AppData\LocalLow\Unity\WebPlayer`.
-The Web Player was previously copied there by `installUnity.bat`.
+The browser/Electron client opens a web page with an `<embed>` tag of the appropriate MIME type, where the `src` param is the address of the game's `.unity3d` entrypoint. This triggers the browser to load an NPAPI plugin that handles said MIME type, in this case the Unity Web Player.
 
 Note that the version of the web player distributed with OpenFusion expects a standard `UnityWeb` magic number for all assets, instead of Retro's modified `streamed` magic number.
 This will potentially become relevant later, as people start experimenting and mixing and matching versions.
@@ -64,7 +63,7 @@ The web player will execute the game code, which will request the following file
 
 `/assetInfo.php` contains the address from which to fetch the rest of the game's assets (the "dongresources").
 Normally those would be hosted on the same web server as the gateway, but the OpenFusion distribution (in it's default configuration) doesn't use a web server at all!
-It loads the web pages locally using the `file://` schema, and fetches the game's assets from Turner's CDN (which is still hosting them to this day!).
+It instead loads the web pages locally using the `file://` schema, and fetches the game's assets from a standard web server.
 
 `/loginInfo.php` contains the IP:port pair of the FusionFall login server, which the client will connect to. This login server drives the client while it's in the Character Selection menu, as well as Character Creation and the Tutorial.
 
@@ -81,17 +80,17 @@ This just works if you're all under the same LAN, but if you want to play over t
 
 ## Compiling 
 
-OpenFusion has one external dependency: SQLite. You can install it on Windows using `vcpkg`, and on Unix/Linux using your distribution's package manager. For a more indepth guide on how to set up vcpkg, [read this guide on the wiki](https://github.com/OpenFusionProject/OpenFusion/wiki/Installing-SQLite-on-Windows-using-vcpkg).
+OpenFusion has one external dependency: SQLite. The oldest compatible version is `3.33.0`. You can install it on Windows using `vcpkg`, and on Unix/Linux using your distribution's package manager. For a more indepth guide on how to set up vcpkg, [read this guide](https://openfusion.dev/docs/development/installing-sqlite-on-windows-using-vcpkg/).
 
 You have two choices for compiling OpenFusion: the included Makefile and the included CMakeLists file.
 
 ### Makefile
 
-A detailed compilation guide is available for Windows users in the wiki [using MinGW-w64 and MSYS2](https://github.com/OpenFusionProject/OpenFusion/wiki/Compilation-on-Windows). Otherwise, to compile it for the current platform you're on, just run `make` with the correct build tools installed (currently make and clang).
+A detailed compilation guide is available for Windows users on the website [using MinGW-w64 and MSYS2](https://openfusion.dev/docs/development/compilation-on-windows-msys2-mingw/). Otherwise, to compile it for the current platform you're on, just run `make` with the correct build tools installed (currently make and clang).
 
 ### CMake
 
-A detailed guide is available [on the wiki](https://github.com/OpenFusionProject/OpenFusion/wiki/Compilation-with-CMake-or-Visual-Studio) for people using regular old CMake or the version of CMake that comes with Visual Studio. tl;dr: `cmake -B build`
+A detailed guide is available [in our documentation](https://openfusion.dev/docs/development/compilation-with-cmake-or-visual-studio/) for people using regular old CMake or the version of CMake that comes with Visual Studio. TL;DR: `cmake -B build`
 
 ## Contributing
 
@@ -100,26 +99,13 @@ If you'd like to contribute to this project, please read [CONTRIBUTING.md](CONTR
 ## Gameplay
 
 The goal of the project is to faithfully recreate the game as it was at the time of the targeted build.
-The server is not yet complete, however, and some functionality is still missing.
+While most features are implemented and the game is playable start to finish, there may be missing functionality or bugs present.
 
-Because the server is still in development, ordinary players are allowed access to a few admin commands:
+Depending on the server configuration, you'll have access to certain commands.
 
-![](res/sane_upsell.png)
+For the public servers: Original has item spawning, the ability to set player speed/jump height, and teleportation enabled (default account level 50).
+Meanwhile the Academy server is more meant for legitimate playthroughs (default account level 99).
 
-### Movement commands
-* A `/speed` of around 2400 or 3000 is nice.
-* A `/jump` of about 50 will send you soaring
-* [This map](res/dong_number_map.png) (credit to Danny O) is useful for `/warp` coordinates.
-* `/goto` is useful for more precise teleportation (ie. for getting into Infected Zones, etc.).
+When hosting a local server, you will have access to all commands by default (account level 1).
 
-### Item commands
-* `/itemN [type] [itemId] [amount]`
-  (Refer to the [item list](https://docs.google.com/spreadsheets/d/1mpoJ9iTHl_xLI4wQ_9UvIDYNcsDYscdkyaGizs43TCg/))
-
-### Nano commands
-* `/nano [id] (1-36)`
-* `/nano_equip [id] (1-36) [slot] (0-2)`
-* `/nano_unequip [slot] (0-2)`
-* `/nano_active [slot] (0-2)`
-
-### A full list of commands can be found [here](https://github.com/OpenFusionProject/OpenFusion/wiki/Ingame-Command-list).
+For a list of available commands, see [this page](https://openfusion.dev/docs/reference/ingame-command-list/).

config.ini

@@ -12,11 +12,17 @@ sandbox=true
 [login]
 # must be kept in sync with loginInfo.php
 port=23000
+# will all name wheel names be approved instantly?
+acceptallwheelnames=true
 # will all custom names be approved instantly?
 acceptallcustomnames=true
 # should attempts to log into non-existent accounts
 # automatically create them?
 autocreateaccounts=true
+# list of supported authentication methods (comma-separated)
+# password = allow logging in with plaintext passwords
+# cookie = allow logging in with one-shot auth cookies
+authmethods=password
 # how often should everything be flushed to the database?
 # the default is 4 minutes
 dbsaveinterval=240
@@ -66,6 +72,9 @@ motd=Welcome to OpenFusion!
 # location of the database
 #dbpath=database.db
 
+# should there be a score cap for infected zone races?
+#izracescorecapped=true
+
 # should tutorial flags be disabled off the bat?
 disablefirstuseflag=true
 
@@ -95,5 +104,8 @@ eventmode=0
 enabled=false
 # the port to listen for connections on
 port=8003
+# The local IP to listen on.
+# Do not change this unless you know what you're doing.
+listenip=127.0.0.1
 # how often the listeners should be updated (in milliseconds)
 interval=5000

docker-compose.yml

@@ -0,0 +1,14 @@
+services:
+  openfusion:
+    build:
+      context: .
+      dockerfile: ./Dockerfile
+    image: openfusion/openfusion:latest
+    volumes:
+      - ./config.ini:/usr/src/app/config.ini
+      - ./database.db:/usr/src/app/database.db
+      - ./tdata:/usr/src/app/tdata
+    ports:
+      - "23000:23000"
+      - "23001:23001"
+      - "8003:8003"

sql/migration4.sql

@@ -0,0 +1,19 @@
+/*
+    It is recommended in the SQLite manual to turn off
+    foreign keys when making schema changes that involve them
+*/
+PRAGMA foreign_keys=OFF;
+BEGIN TRANSACTION;
+-- New table to store auth cookies
+CREATE TABLE Auth (
+    AccountID   INTEGER NOT NULL,
+    Cookie      TEXT NOT NULL,
+    Expires     INTEGER DEFAULT 0 NOT NULL,
+    FOREIGN KEY(AccountID) REFERENCES Accounts(AccountID) ON DELETE CASCADE,
+    UNIQUE (AccountID)
+);
+-- Update DB Version
+UPDATE Meta SET Value = 5 WHERE Key = 'DatabaseVersion';
+UPDATE Meta SET Value = strftime('%s', 'now') WHERE Key = 'LastMigration';
+COMMIT;
+PRAGMA foreign_keys=ON;

sql/migration5.sql

@@ -0,0 +1,8 @@
+BEGIN TRANSACTION;
+-- New Columns
+ALTER TABLE Accounts ADD Email TEXT DEFAULT '' NOT NULL;
+ALTER TABLE Accounts ADD LastPasswordReset INTEGER DEFAULT 0 NOT NULL;
+-- Update DB Version
+UPDATE Meta SET Value = 6 WHERE Key = 'DatabaseVersion';
+UPDATE Meta SET Value = strftime('%s', 'now') WHERE Key = 'LastMigration';
+COMMIT;

sql/tables.sql

@@ -1,14 +1,16 @@
 CREATE TABLE IF NOT EXISTS Accounts (
-    AccountID    INTEGER NOT NULL,
-    Login        TEXT    NOT NULL UNIQUE COLLATE NOCASE,
-    Password     TEXT    NOT NULL,
-    Selected     INTEGER  DEFAULT 1 NOT NULL,
-    AccountLevel INTEGER NOT NULL,
-    Created      INTEGER DEFAULT (strftime('%s', 'now')) NOT NULL,
-    LastLogin    INTEGER DEFAULT (strftime('%s', 'now')) NOT NULL,
-    BannedUntil  INTEGER DEFAULT 0 NOT NULL,
-    BannedSince  INTEGER DEFAULT 0 NOT NULL,
-    BanReason    TEXT    DEFAULT '' NOT NULL,
+    AccountID         INTEGER NOT NULL,
+    Login             TEXT    NOT NULL UNIQUE COLLATE NOCASE,
+    Password          TEXT    NOT NULL,
+    Selected          INTEGER  DEFAULT 1 NOT NULL,
+    AccountLevel      INTEGER NOT NULL,
+    Created           INTEGER DEFAULT (strftime('%s', 'now')) NOT NULL,
+    LastLogin         INTEGER DEFAULT (strftime('%s', 'now')) NOT NULL,
+    BannedUntil       INTEGER DEFAULT 0 NOT NULL,
+    BannedSince       INTEGER DEFAULT 0 NOT NULL,
+    BanReason         TEXT    DEFAULT '' NOT NULL,
+    Email             TEXT    DEFAULT '' NOT NULL,
+    LastPasswordReset INTEGER DEFAULT 0 NOT NULL,
     PRIMARY KEY(AccountID AUTOINCREMENT)
 );
 
@@ -143,7 +145,7 @@ CREATE TABLE IF NOT EXISTS EmailItems (
     UNIQUE (PlayerID, MsgIndex, Slot)
 );
 
-CREATE TABLE IF NOT EXISTS RaceResults(
+CREATE TABLE IF NOT EXISTS RaceResults (
     EPID      INTEGER NOT NULL,
     PlayerID  INTEGER NOT NULL,
     Score     INTEGER NOT NULL,
@@ -153,9 +155,17 @@ CREATE TABLE IF NOT EXISTS RaceResults(
     FOREIGN KEY(PlayerID) REFERENCES Players(PlayerID) ON DELETE CASCADE
 );
 
-CREATE TABLE IF NOT EXISTS RedeemedCodes(
+CREATE TABLE IF NOT EXISTS RedeemedCodes (
     PlayerID    INTEGER NOT NULL,
     Code        TEXT NOT NULL,
     FOREIGN KEY(PlayerID) REFERENCES Players(PlayerID) ON DELETE CASCADE,
     UNIQUE (PlayerID, Code)
-)
+);
+
+CREATE TABLE IF NOT EXISTS Auth (
+    AccountID   INTEGER NOT NULL,
+    Cookie      TEXT NOT NULL,
+    Expires     INTEGER DEFAULT 0 NOT NULL,
+    FOREIGN KEY(AccountID) REFERENCES Accounts(AccountID) ON DELETE CASCADE,
+    UNIQUE (AccountID)
+);

src/Abilities.cpp

@@ -1,11 +1,12 @@
 #include "Abilities.hpp"
 
+#include "servers/CNShardServer.hpp"
+
 #include "NPCManager.hpp"
 #include "PlayerManager.hpp"
 #include "Buffs.hpp"
 #include "Nanos.hpp"
-
-#include <assert.h>
+#include "MobAI.hpp"
 
 using namespace Abilities;
 
@@ -47,16 +48,107 @@ static SkillResult handleSkillHealHP(SkillData* skill, int power, ICombatant* so
 }
 
 static SkillResult handleSkillDamageNDebuff(SkillData* skill, int power, ICombatant* source, ICombatant* target) {
-    // TODO abilities
+    // take aggro
+    target->takeDamage(source->getRef(), 0);
+
+    int duration = 0;
+    int strength = 0;
+    bool blocked = target->hasBuff(ECSB_FREEDOM);
+    if(!blocked) {
+        duration = skill->durationTime[power];
+        strength = skill->values[0][power];
+        BuffStack debuff = {
+            (duration * 100) / MS_PER_COMBAT_TICK, // ticks
+            strength, // value
+            source->getRef(), // source
+            BuffClass::NANO, // buff class
+        };
+        int timeBuffId = Abilities::getCSTBFromST(skill->skillType);
+        target->addBuff(timeBuffId,
+            [](EntityRef self, Buff* buff, int status, BuffStack* stack) {
+                Buffs::timeBuffUpdate(self, buff, status, stack);
+                if(status == ETBU_DEL) Buffs::timeBuffTimeout(self);
+            },
+            [](EntityRef self, Buff* buff, time_t currTime) {
+                Buffs::timeBuffTick(self, buff);
+            },
+            &debuff);
+    }
+
     sSkillResult_Damage_N_Debuff result{};
+
+    result.iDamage = duration / 10; // we use the duration as the damage number (why?)
+    result.iHP = target->getCurrentHP();
     result.eCT = target->getCharType();
     result.iID = target->getID();
-    result.bProtected = false;
+    result.bProtected = blocked;
     result.iConditionBitFlag = target->getCompositeCondition();
+
+    // for player targets, make sure to update Nano stamina
+    if (target->getCharType() == 1) {
+        Player *plr = dynamic_cast<Player*>(target);
+        result.iStamina = plr->getActiveNano()->iStamina;
+    }
+
     return SkillResult(sizeof(sSkillResult_Damage_N_Debuff), &result);
 }
 
+static SkillResult handleSkillLeech(SkillData* skill, int power, ICombatant* source, ICombatant* target) {
+    EntityRef sourceRef = source->getRef();
+    int heal = skill->values[0][power];
+    int healed = source->heal(sourceRef, heal);
+    int damage = heal * 2;
+    int dealt = target->takeDamage(sourceRef, damage);
+
+    sSkillResult_Leech result{};
+
+    result.Damage.eCT = target->getCharType();
+    result.Damage.iID = target->getID();
+    result.Damage.bProtected = dealt <= 0;
+    result.Damage.iDamage = dealt;
+    result.Damage.iHP = target->getCurrentHP();
+
+    result.Heal.eCT = result.Damage.eCT;
+    result.Heal.iID = result.Damage.iID;
+    result.Heal.iHealHP = healed;
+    result.Heal.iHP = source->getCurrentHP();
+
+    return SkillResult(sizeof(sSkillResult_Leech), &result);
+}
+
 static SkillResult handleSkillBuff(SkillData* skill, int power, ICombatant* source, ICombatant* target) {
+    int duration = skill->durationTime[power];
+    int strength = skill->values[0][power];
+    BuffStack passiveBuff = {
+        // if the duration is 0, it needs to be recast every tick
+        duration == 0 ? 1 : (duration * 100) / MS_PER_COMBAT_TICK, // ticks
+        strength, // value
+        source->getRef(), // source
+        source == target ? BuffClass::NANO : BuffClass::GROUP_NANO, // buff class
+    };
+
+    int timeBuffId = Abilities::getCSTBFromST(skill->skillType);
+    SkillDrainType drainType = skill->drainType;
+    int combatLifetime = 0;
+    if(!target->addBuff(timeBuffId,
+        [drainType](EntityRef self, Buff* buff, int status, BuffStack* stack) {
+            if(buff->id == ECSB_BOUNDINGBALL && status == ETBU_ADD) {
+                // drain
+                ICombatant* combatant = dynamic_cast<ICombatant*>(self.getEntity());
+                combatant->takeDamage(buff->getLastSource(), 0); // aggro
+            }
+            Buffs::timeBuffUpdate(self, buff, status, stack);
+            if(drainType == SkillDrainType::ACTIVE && status == ETBU_DEL)
+                Buffs::timeBuffTimeout(self);
+        },
+        [combatLifetime](EntityRef self, Buff* buff, time_t currTime) mutable {
+            if(buff->id == ECSB_BOUNDINGBALL &&
+                combatLifetime % COMBAT_TICKS_PER_DRAIN_PROC == 0)
+                Buffs::tickDrain(self, buff, COMBAT_TICKS_PER_DRAIN_PROC); // drain
+            combatLifetime++;
+        },
+        &passiveBuff)) return SkillResult();
+
     sSkillResult_Buff result{};
     result.eCT = target->getCharType();
     result.iID = target->getID();
@@ -71,19 +163,24 @@ static SkillResult handleSkillBatteryDrain(SkillData* skill, int power, ICombata
     Player* plr = dynamic_cast<Player*>(target);
 
     const double scalingFactor = (18 + source->getLevel()) / 36.0;
+    const bool blocked = target->hasBuff(ECSB_PROTECT_BATTERY);
 
-    int boostDrain = (int)(skill->values[0][power] * scalingFactor);
-    if(boostDrain > plr->batteryW) boostDrain = plr->batteryW;
-    plr->batteryW -= boostDrain;
+    int boostDrain = 0;
+    int potionDrain = 0;
+    if(!blocked) {
+        boostDrain = (int)(skill->values[0][power] * scalingFactor);
+        if(boostDrain > plr->batteryW) boostDrain = plr->batteryW;
+        plr->batteryW -= boostDrain;
 
-    int potionDrain = (int)(skill->values[1][power] * scalingFactor);
-    if(potionDrain > plr->batteryN) potionDrain = plr->batteryN;
-    plr->batteryN -= potionDrain;
+        potionDrain = (int)(skill->values[1][power] * scalingFactor);
+        if(potionDrain > plr->batteryN) potionDrain = plr->batteryN;
+        plr->batteryN -= potionDrain;
+    }
 
     sSkillResult_BatteryDrain result{};
     result.eCT = target->getCharType();
     result.iID = target->getID();
-    result.bProtected = target->hasBuff(ECSB_PROTECT_BATTERY);
+    result.bProtected = blocked;
     result.iDrainW = boostDrain;
     result.iBatteryW = plr->batteryW;
     result.iDrainN = potionDrain;
@@ -97,8 +194,13 @@ static SkillResult handleSkillBatteryDrain(SkillData* skill, int power, ICombata
 static SkillResult handleSkillMove(SkillData* skill, int power, ICombatant* source, ICombatant* target) {
     if(source->getCharType() != 1)
         return SkillResult(); // only Players are valid sources for recall
+
     Player* plr = dynamic_cast<Player*>(source);
-    PlayerManager::sendPlayerTo(source->getRef().sock, plr->recallX, plr->recallY, plr->recallZ, plr->recallInstance);
+    if(source == target) {
+        // no trailing struct for self
+        PlayerManager::sendPlayerTo(target->getRef().sock, plr->recallX, plr->recallY, plr->recallZ, plr->recallInstance);
+        return SkillResult();
+    }
 
     sSkillResult_Move result{};
     result.eCT = target->getCharType();
@@ -120,56 +222,66 @@ static SkillResult handleSkillResurrect(SkillData* skill, int power, ICombatant*
 #pragma endregion
 
 static std::vector<SkillResult> handleSkill(SkillData* skill, int power, ICombatant* src, std::vector<ICombatant*> targets) {
-    size_t resultSize = 0;
     SkillResult (*skillHandler)(SkillData*, int, ICombatant*, ICombatant*) = nullptr;
     std::vector<SkillResult> results;
 
     switch(skill->skillType)
     {
-        case EST_DAMAGE:
-            resultSize = sizeof(sSkillResult_Damage);
+        case SkillType::CORRUPTIONATTACK:
+        case SkillType::CORRUPTIONATTACKLOSE:
+        case SkillType::CORRUPTIONATTACKWIN:
+        //  skillHandler = handleSkillCorruptionReflect;
+        //  break;
+        case SkillType::DAMAGE:
             skillHandler = handleSkillDamage;
             break;
-        case EST_HEAL_HP:
-        case EST_RETURNHOMEHEAL:
-            resultSize = sizeof(sSkillResult_Heal_HP);
+        case SkillType::HEAL_HP:
+        case SkillType::RETURNHOMEHEAL:
             skillHandler = handleSkillHealHP;
             break;
-        case EST_JUMP:
-        case EST_RUN:
-        case EST_FREEDOM:
-        case EST_PHOENIX:
-        case EST_INVULNERABLE:
-        case EST_MINIMAPENEMY:
-        case EST_MINIMAPTRESURE:
-        case EST_NANOSTIMPAK:
-        case EST_PROTECTBATTERY:
-        case EST_PROTECTINFECTION:
-        case EST_REWARDBLOB:
-        case EST_REWARDCASH:
-        case EST_STAMINA_SELF:
-        case EST_STEALTH:
-            resultSize = sizeof(sSkillResult_Buff);
+        case SkillType::KNOCKDOWN:
+        case SkillType::SLEEP:
+        case SkillType::SNARE:
+        case SkillType::STUN:
+            skillHandler = handleSkillDamageNDebuff;
+            break;
+        case SkillType::JUMP:
+        case SkillType::RUN:
+        case SkillType::STEALTH:
+        case SkillType::MINIMAPENEMY:
+        case SkillType::MINIMAPTRESURE:
+        case SkillType::PHOENIX:
+        case SkillType::PROTECTBATTERY:
+        case SkillType::PROTECTINFECTION:
+        case SkillType::REWARDBLOB:
+        case SkillType::REWARDCASH:
+        // case SkillType::INFECTIONDAMAGE:
+        case SkillType::FREEDOM:
+        case SkillType::BOUNDINGBALL:
+        case SkillType::INVULNERABLE:
+        case SkillType::STAMINA_SELF:
+        case SkillType::NANOSTIMPAK:
+        case SkillType::BUFFHEAL:
             skillHandler = handleSkillBuff;
             break;
-        case EST_BATTERYDRAIN:
-            resultSize = sizeof(sSkillResult_BatteryDrain);
-            skillHandler = handleSkillBatteryDrain;
+        case SkillType::BLOODSUCKING:
+            skillHandler = handleSkillLeech;
             break;
-        case EST_RECALL: // still soft lock
-        case EST_RECALL_GROUP: // works for player who uses it
-            resultSize = sizeof(sSkillResult_Move);
-            skillHandler = handleSkillMove;
-            break;
-        case EST_PHOENIX_GROUP: // broken
-            resultSize = sizeof(sSkillResult_Resurrect);
-            skillHandler = handleSkillResurrect;
-            break;
-        case EST_RETROROCKET_SELF:
+        case SkillType::RETROROCKET_SELF:
             // no-op
             return results;
+        case SkillType::PHOENIX_GROUP:
+            skillHandler = handleSkillResurrect;
+            break;
+        case SkillType::RECALL:
+        case SkillType::RECALL_GROUP:
+            skillHandler = handleSkillMove;
+            break;
+        case SkillType::BATTERYDRAIN:
+            skillHandler = handleSkillBatteryDrain;
+            break;
         default:
-            std::cout << "[WARN] Unhandled skill type " << skill->skillType << std::endl;
+            std::cout << "[WARN] Unhandled skill type " << (int)skill->skillType << std::endl;
             return results;
     }
 
@@ -177,8 +289,8 @@ static std::vector<SkillResult> handleSkill(SkillData* skill, int power, ICombat
         assert(target != nullptr);
         SkillResult result = skillHandler(skill, power, src != nullptr ? src : target, target);
         if(result.size == 0) continue; // skill not applicable
-        if(result.size != resultSize) {
-            std::cout << "[WARN] bad skill result size for " << skill->skillType << " from " << (void*)handleSkillBuff << std::endl;
+        if(result.size > MAX_SKILLRESULT_SIZE) {
+            std::cout << "[WARN] bad skill result size for " << (int)skill->skillType << " from " << (void*)handleSkillBuff << std::endl;
             continue;
         }
         results.push_back(result);
@@ -186,38 +298,44 @@ static std::vector<SkillResult> handleSkill(SkillData* skill, int power, ICombat
     return results;
 }
 
-static void attachSkillResults(std::vector<SkillResult> results, size_t resultSize, uint8_t* pivot) {
+static void attachSkillResults(std::vector<SkillResult> results, uint8_t* pivot) {
     for(SkillResult& result : results) {
-        memcpy(pivot, result.payload, resultSize);
-        pivot += resultSize;
+        size_t sz = result.size;
+        memcpy(pivot, result.payload, sz);
+        pivot += sz;
     }
 }
 
 void Abilities::useNanoSkill(CNSocket* sock, SkillData* skill, sNano& nano, std::vector<ICombatant*> affected) {
 
     Player* plr = PlayerManager::getPlayer(sock);
+    ICombatant* combatant = dynamic_cast<ICombatant*>(plr);
 
     int boost = 0;
     if (Nanos::getNanoBoost(plr))
         boost = 3;
 
-    nano.iStamina -= skill->batteryUse[boost];
-    if (nano.iStamina < 0)
-        nano.iStamina = 0;
+    if(skill->drainType == SkillDrainType::ACTIVE) {
+        nano.iStamina -= skill->batteryUse[boost];
+        if (nano.iStamina <= 0)
+            nano.iStamina = 0;
+    }
 
-    std::vector<SkillResult> results = handleSkill(skill, boost, plr, affected);
-    size_t resultSize = 0; // guaranteed to be the same for every item
-    if (!results.empty()) resultSize = results.back().size;
+    std::vector<SkillResult> results = handleSkill(skill, boost, combatant, affected);
+    if(results.empty()) return; // no effect; no need for confirmation packets
 
-    if (!validOutVarPacket(sizeof(sP_FE2CL_NANO_SKILL_USE_SUCC), results.size(), resultSize)) {
+    // lazy validation since skill results might be different sizes
+    if (!validOutVarPacket(sizeof(sP_FE2CL_NANO_SKILL_USE_SUCC), results.size(), MAX_SKILLRESULT_SIZE)) {
         std::cout << "[WARN] bad sP_FE2CL_NANO_SKILL_USE_SUCC packet size\n";
         return;
     }
 
     // initialize response struct
-    size_t resplen = sizeof(sP_FE2CL_NANO_SKILL_USE_SUCC) + results.size() * resultSize;
-    uint8_t respbuf[CN_PACKET_BUFFER_SIZE];
-    memset(respbuf, 0, resplen);
+    size_t resplen = sizeof(sP_FE2CL_NANO_SKILL_USE_SUCC);
+    for(SkillResult& sr : results)
+        resplen += sr.size;
+    uint8_t respbuf[CN_PACKET_BODY_SIZE];
+    memset(respbuf, 0, CN_PACKET_BODY_SIZE);
 
     sP_FE2CL_NANO_SKILL_USE_SUCC* pkt = (sP_FE2CL_NANO_SKILL_USE_SUCC*)respbuf;
     pkt->iPC_ID = plr->iID;
@@ -225,15 +343,17 @@ void Abilities::useNanoSkill(CNSocket* sock, SkillData* skill, sNano& nano, std:
     pkt->iSkillID = nano.iSkillID;
     pkt->iNanoStamina = nano.iStamina;
     pkt->bNanoDeactive = nano.iStamina <= 0;
-    pkt->eST = skill->skillType;
+    pkt->eST = (int32_t)skill->skillType;
     pkt->iTargetCnt = (int32_t)results.size();
 
-    attachSkillResults(results, resultSize, (uint8_t*)(pkt + 1));
+    attachSkillResults(results, (uint8_t*)(pkt + 1));
     sock->sendPacket(pkt, P_FE2CL_NANO_SKILL_USE_SUCC, resplen);
-    PlayerManager::sendToViewable(sock, pkt, P_FE2CL_NANO_SKILL_USE_SUCC, resplen);
 
-    if (nano.iStamina <= 0)
-        Nanos::summonNano(sock, -1);
+    if(skill->skillType == SkillType::RECALL_GROUP)
+        // group recall packet is sent only to group members
+        PlayerManager::sendToGroup(sock, pkt, P_FE2CL_NANO_SKILL_USE, resplen);
+    else
+        PlayerManager::sendToViewable(sock, pkt, P_FE2CL_NANO_SKILL_USE, resplen);
 }
 
 void Abilities::useNPCSkill(EntityRef npc, int skillID, std::vector<ICombatant*> affected) {
@@ -248,32 +368,58 @@ void Abilities::useNPCSkill(EntityRef npc, int skillID, std::vector<ICombatant*>
     SkillData* skill = &SkillTable[skillID];
 
     std::vector<SkillResult> results = handleSkill(skill, 0, src, affected);
-    size_t resultSize = results.back().size; // guaranteed to be the same for every item
 
-    if (!validOutVarPacket(sizeof(sP_FE2CL_NPC_SKILL_HIT), results.size(), resultSize)) {
+    // lazy validation since skill results might be different sizes
+    if (!validOutVarPacket(sizeof(sP_FE2CL_NPC_SKILL_HIT), results.size(), MAX_SKILLRESULT_SIZE)) {
         std::cout << "[WARN] bad sP_FE2CL_NPC_SKILL_HIT packet size\n";
         return;
     }
 
     // initialize response struct
-    size_t resplen = sizeof(sP_FE2CL_NPC_SKILL_HIT) + results.size() * resultSize;
-    uint8_t respbuf[CN_PACKET_BUFFER_SIZE];
-    memset(respbuf, 0, resplen);
+    size_t resplen = sizeof(sP_FE2CL_NPC_SKILL_HIT);
+    for(SkillResult& sr : results)
+        resplen += sr.size;
+    uint8_t respbuf[CN_PACKET_BODY_SIZE];
+    memset(respbuf, 0, CN_PACKET_BODY_SIZE);
 
     sP_FE2CL_NPC_SKILL_HIT* pkt = (sP_FE2CL_NPC_SKILL_HIT*)respbuf;
     pkt->iNPC_ID = npc.id;
     pkt->iSkillID = skillID;
-    pkt->eST = skill->skillType;
+    pkt->eST = (int32_t)skill->skillType;
     pkt->iTargetCnt = (int32_t)results.size();
+    if(npc.kind == EntityKind::MOB) {
+        Mob* mob = dynamic_cast<Mob*>(entity);
+        pkt->iValue1 = mob->hitX;
+        pkt->iValue2 = mob->hitY;
+        pkt->iValue3 = mob->hitZ;
+    }
 
-    attachSkillResults(results, resultSize, (uint8_t*)(pkt + 1));
+    attachSkillResults(results, (uint8_t*)(pkt + 1));
     NPCManager::sendToViewable(entity, pkt, P_FE2CL_NPC_SKILL_HIT, resplen);
 }
 
-std::vector<ICombatant*> Abilities::matchTargets(SkillData* skill, int count, int32_t *ids) {
+static std::vector<ICombatant*> entityRefsToCombatants(std::vector<EntityRef> refs) {
+    std::vector<ICombatant*> combatants;
+    for(EntityRef ref : refs) {
+        if(ref.kind == EntityKind::PLAYER)
+            combatants.push_back(dynamic_cast<ICombatant*>(PlayerManager::getPlayer(ref.sock)));
+        else if(ref.kind == EntityKind::COMBAT_NPC || ref.kind == EntityKind::MOB)
+            combatants.push_back(dynamic_cast<ICombatant*>(ref.getEntity()));
+    }
+    return combatants;
+}
 
+std::vector<ICombatant*> Abilities::matchTargets(ICombatant* src, SkillData* skill, int count, int32_t *ids) {
+
+    if(skill->targetType == SkillTargetType::GROUP)
+        return entityRefsToCombatants(src->getGroupMembers());
+
+    // this check *has* to happen after the group check above due to cases like group recall that use both
+    if(skill->effectTarget == SkillEffectTarget::SELF)
+        return {src}; // client sends 0 targets for certain self-targeting skills (recall)
+
+    // individuals
     std::vector<ICombatant*> targets;
-
     for (int i = 0; i < count; i++) {
         int32_t id = ids[i];
         if (skill->targetType == SkillTargetType::MOBS) {
@@ -286,8 +432,8 @@ std::vector<ICombatant*> Abilities::matchTargets(SkillData* skill, int count, in
                 }
             }
             std::cout << "[WARN] skill: invalid mob target (id " << id << ")\n";
-        } else if(skill->targetType == SkillTargetType::SELF || skill->targetType == SkillTargetType::GROUP) {
-            // players (?)
+        } else if(skill->targetType == SkillTargetType::PLAYERS) {
+            // player
             Player* plr = PlayerManager::getPlayerFromID(id);
             if (plr != nullptr) {
                 targets.push_back(dynamic_cast<ICombatant*>(plr));
@@ -301,63 +447,69 @@ std::vector<ICombatant*> Abilities::matchTargets(SkillData* skill, int count, in
 }
 
 /* ripped from client (enums emplaced) */
-int Abilities::getCSTBFromST(int eSkillType) {
+int Abilities::getCSTBFromST(SkillType skillType) {
     int result = 0;
-    switch (eSkillType)
+    switch (skillType)
     {
-    case EST_RUN:
+    case SkillType::RUN:
         result = ECSB_UP_MOVE_SPEED;
         break;
-    case EST_JUMP:
+    case SkillType::JUMP:
         result = ECSB_UP_JUMP_HEIGHT;
         break;
-    case EST_STEALTH:
+    case SkillType::STEALTH:
         result = ECSB_UP_STEALTH;
         break;
-    case EST_PHOENIX:
+    case SkillType::PHOENIX:
         result = ECSB_PHOENIX;
         break;
-    case EST_PROTECTBATTERY:
+    case SkillType::PROTECTBATTERY:
         result = ECSB_PROTECT_BATTERY;
         break;
-    case EST_PROTECTINFECTION:
+    case SkillType::PROTECTINFECTION:
         result = ECSB_PROTECT_INFECTION;
         break;
-    case EST_SNARE:
-        result = ECSB_DN_MOVE_SPEED;
-        break;
-    case EST_SLEEP:
-        result = ECSB_MEZ;
-        break;
-    case EST_MINIMAPENEMY:
+    case SkillType::MINIMAPENEMY:
         result = ECSB_MINIMAP_ENEMY;
         break;
-    case EST_MINIMAPTRESURE:
+    case SkillType::MINIMAPTRESURE:
         result = ECSB_MINIMAP_TRESURE;
         break;
-    case EST_REWARDBLOB:
+    case SkillType::REWARDBLOB:
         result = ECSB_REWARD_BLOB;
         break;
-    case EST_REWARDCASH:
+    case SkillType::REWARDCASH:
         result = ECSB_REWARD_CASH;
         break;
-    case EST_INFECTIONDAMAGE:
-        result = ECSB_INFECTION;
-        break;
-    case EST_FREEDOM:
+    case SkillType::FREEDOM:
         result = ECSB_FREEDOM;
         break;
-    case EST_BOUNDINGBALL:
-        result = ECSB_BOUNDINGBALL;
-        break;
-    case EST_INVULNERABLE:
+    case SkillType::INVULNERABLE:
         result = ECSB_INVULNERABLE;
         break;
-    case EST_BUFFHEAL:
+    case SkillType::BUFFHEAL:
         result = ECSB_HEAL;
         break;
-    case EST_NANOSTIMPAK:
+    case SkillType::NANOSTIMPAK:
         result = ECSB_STIMPAKSLOT1;
+        // shift as necessary
+        break;
+    case SkillType::SNARE:
+        result = ECSB_DN_MOVE_SPEED;
+        break;
+    case SkillType::STUN:
+        result = ECSB_STUN;
+        break;
+    case SkillType::SLEEP:
+        result = ECSB_MEZ;
+        break;
+    case SkillType::INFECTIONDAMAGE:
+        result = ECSB_INFECTION;
+        break;
+    case SkillType::BOUNDINGBALL:
+        result = ECSB_BOUNDINGBALL;
+        break;
+    default:
         break;
     }
     return result;

src/Abilities.hpp

@@ -7,9 +7,52 @@
 
 #include <map>
 #include <vector>
+#include <assert.h>
 
+const int COMBAT_TICKS_PER_DRAIN_PROC = 2;
 constexpr size_t MAX_SKILLRESULT_SIZE = sizeof(sSkillResult_BatteryDrain);
 
+enum class SkillType {
+    DAMAGE = 1,
+    HEAL_HP = 2,
+    KNOCKDOWN = 3, // uses DamageNDebuff
+    SLEEP = 4, // uses DamageNDebuff
+    SNARE = 5, // uses DamageNDebuff
+    HEAL_STAMINA = 6,
+    STAMINA_SELF = 7,
+    STUN = 8, // uses DamageNDebuff
+    WEAPONSLOW = 9,
+    JUMP = 10,
+    RUN = 11,
+    STEALTH = 12,
+    SWIM = 13,
+    MINIMAPENEMY = 14,
+    MINIMAPTRESURE = 15,
+    PHOENIX = 16,
+    PROTECTBATTERY = 17,
+    PROTECTINFECTION = 18,
+    REWARDBLOB = 19,
+    REWARDCASH = 20,
+    BATTERYDRAIN = 21,
+    CORRUPTIONATTACK = 22,
+    INFECTIONDAMAGE = 23,
+    KNOCKBACK = 24,
+    FREEDOM = 25,
+    PHOENIX_GROUP = 26,
+    RECALL = 27,
+    RECALL_GROUP = 28,
+    RETROROCKET_SELF = 29,
+    BLOODSUCKING = 30,
+    BOUNDINGBALL = 31,
+    INVULNERABLE = 32,
+    NANOSTIMPAK = 33,
+    RETURNHOMEHEAL = 34,
+    BUFFHEAL = 35,
+    EXTRABANK = 36,
+    CORRUPTIONATTACKWIN = 38,
+    CORRUPTIONATTACKLOSE = 39,
+};
+
 enum class SkillEffectTarget {
     POINT = 1,
     SELF = 2,
@@ -21,7 +64,7 @@ enum class SkillEffectTarget {
 
 enum class SkillTargetType {
     MOBS = 1,
-    SELF = 2,
+    PLAYERS = 2,
     GROUP = 3
 };
 
@@ -34,6 +77,7 @@ struct SkillResult {
     size_t size;
     uint8_t payload[MAX_SKILLRESULT_SIZE];
     SkillResult(size_t len, void* dat) {
+        assert(len <= MAX_SKILLRESULT_SIZE);
         size = len;
         memcpy(payload, dat, len);
     }
@@ -43,7 +87,7 @@ struct SkillResult {
 };
 
 struct SkillData {
-    int skillType; // eST
+    SkillType skillType; // eST
     SkillEffectTarget effectTarget;
     int effectType; // always 1?
     SkillTargetType targetType;
@@ -63,6 +107,6 @@ namespace Abilities {
     void useNanoSkill(CNSocket*, SkillData*, sNano&, std::vector<ICombatant*>);
     void useNPCSkill(EntityRef, int skillID, std::vector<ICombatant*>);
 
-    std::vector<ICombatant*> matchTargets(SkillData*, int, int32_t*);
-    int getCSTBFromST(int eSkillType);
+    std::vector<ICombatant*> matchTargets(ICombatant*, SkillData*, int, int32_t*);
+    int getCSTBFromST(SkillType skillType);
 }

src/Bucket.hpp

@@ -0,0 +1,40 @@
+#pragma once
+
+#include <array>
+#include <optional>
+
+#include <assert.h>
+
+template<class T, size_t N>
+class Bucket {
+    std::array<T, N> buf;
+    size_t sz;
+public:
+    Bucket() {
+        sz = 0;
+    }
+
+    void add(const T& item) {
+        assert(sz < N);
+        buf[sz++] = item;
+    }
+
+    std::optional<T> get(size_t idx) const {
+        if (idx < sz) {
+            return buf[idx];
+        }
+        return std::nullopt;
+    }
+
+    size_t size() const {
+        return sz;
+    }
+
+    bool isFull() const {
+        return sz == N;
+    }
+
+    void clear() {
+        sz = 0;
+    }
+};

src/Buddies.cpp

@@ -30,7 +30,7 @@ static bool playerHasBuddyWithID(Player* plr, int buddyID) {
 #pragma endregion
 
 // Refresh buddy list
-void Buddies::refreshBuddyList(CNSocket* sock) {
+void Buddies::sendBuddyList(CNSocket* sock) {
     Player* plr = PlayerManager::getPlayer(sock);
     int buddyCnt = Database::getNumBuddies(plr);
 
@@ -41,9 +41,9 @@ void Buddies::refreshBuddyList(CNSocket* sock) {
 
     // initialize response struct
     size_t resplen = sizeof(sP_FE2CL_REP_PC_BUDDYLIST_INFO_SUCC) + buddyCnt * sizeof(sBuddyBaseInfo);
-    uint8_t respbuf[CN_PACKET_BUFFER_SIZE];
+    uint8_t respbuf[CN_PACKET_BODY_SIZE];
 
-    memset(respbuf, 0, resplen);
+    memset(respbuf, 0, CN_PACKET_BODY_SIZE);
 
     sP_FE2CL_REP_PC_BUDDYLIST_INFO_SUCC* resp = (sP_FE2CL_REP_PC_BUDDYLIST_INFO_SUCC*)respbuf;
     sBuddyBaseInfo* respdata = (sBuddyBaseInfo*)(respbuf + sizeof(sP_FE2CL_REP_PC_BUDDYLIST_INFO_SUCC));
@@ -277,15 +277,6 @@ static void reqFindNameBuddyAccept(CNSocket* sock, CNPacketData* data) {
 // Getting buddy state
 static void reqPktGetBuddyState(CNSocket* sock, CNPacketData* data) {
     Player* plr = PlayerManager::getPlayer(sock);
-
-    /*
-     * If the buddy list wasn't synced a second time yet, sync it.
-     * Not sure why we have to do it again for the client not to trip up.
-     */
-    if (!plr->buddiesSynced) {
-        refreshBuddyList(sock);
-        plr->buddiesSynced = true;
-    }
     
     INITSTRUCT(sP_FE2CL_REP_GET_BUDDY_STATE_SUCC, resp);
     

src/Buddies.hpp

@@ -6,5 +6,5 @@ namespace Buddies {
     void init();
 
     // Buddy list
-    void refreshBuddyList(CNSocket* sock);
+    void sendBuddyList(CNSocket* sock);
 }

src/Buffs.cpp

@@ -95,6 +95,12 @@ int Buff::getValue(BuffValueSelector selector) {
     return value;
 }
 
+EntityRef Buff::getLastSource() {
+    if(stacks.empty())
+        return self;
+    return stacks.back().source;
+}
+
 bool Buff::isStale() {
     return stacks.empty();
 }
@@ -137,15 +143,56 @@ void Buffs::timeBuffUpdate(EntityRef self, Buff* buff, int status, BuffStack* st
     self.sock->sendPacket((void*)&pkt, P_FE2CL_PC_BUFF_UPDATE, sizeof(sP_FE2CL_PC_BUFF_UPDATE));
 }
 
+void Buffs::timeBuffTick(EntityRef self, Buff* buff) {
+    if(self.kind != EntityKind::COMBAT_NPC && self.kind != EntityKind::MOB)
+        return; // not implemented
+    Entity* entity = self.getEntity();
+    ICombatant* combatant = dynamic_cast<ICombatant*>(entity);
+
+    INITSTRUCT(sP_FE2CL_CHAR_TIME_BUFF_TIME_TICK, pkt);
+    pkt.eCT = combatant->getCharType();
+    pkt.iID = combatant->getID();
+    pkt.iTB_ID = buff->id;
+    NPCManager::sendToViewable(entity, &pkt, P_FE2CL_CHAR_TIME_BUFF_TIME_TICK, sizeof(sP_FE2CL_CHAR_TIME_BUFF_TIME_TICK));
+}
+
 void Buffs::timeBuffTimeout(EntityRef self) {
     if(self.kind != EntityKind::PLAYER && self.kind != EntityKind::COMBAT_NPC && self.kind != EntityKind::MOB)
         return; // not a combatant
     Entity* entity = self.getEntity();
     ICombatant* combatant = dynamic_cast<ICombatant*>(entity);
     INITSTRUCT(sP_FE2CL_CHAR_TIME_BUFF_TIME_OUT, pkt); // send a buff timeout to other players
-    pkt.eCT = combatant->getCharType();
+    int32_t eCharType = combatant->getCharType();
+    pkt.eCT = eCharType == 4 ? 2 : eCharType; // convention not followed by client here
     pkt.iID = combatant->getID();
     pkt.iConditionBitFlag = combatant->getCompositeCondition();
     NPCManager::sendToViewable(entity, &pkt, P_FE2CL_CHAR_TIME_BUFF_TIME_OUT, sizeof(sP_FE2CL_CHAR_TIME_BUFF_TIME_OUT));
 }
+
+void Buffs::tickDrain(EntityRef self, Buff* buff, int mult) {
+    if(self.kind != EntityKind::COMBAT_NPC && self.kind != EntityKind::MOB)
+        return; // not implemented
+    Entity* entity = self.getEntity();
+    ICombatant* combatant = dynamic_cast<ICombatant*>(entity);
+    int damage = combatant->getMaxHP() / 100 * mult;
+    int dealt = combatant->takeDamage(buff->getLastSource(), damage);
+
+    size_t resplen = sizeof(sP_FE2CL_CHAR_TIME_BUFF_TIME_TICK) + sizeof(sSkillResult_Damage);
+    assert(resplen < CN_PACKET_BODY_SIZE);
+    uint8_t respbuf[CN_PACKET_BODY_SIZE];
+    memset(respbuf, 0, CN_PACKET_BODY_SIZE);
+
+    sP_FE2CL_CHAR_TIME_BUFF_TIME_TICK *pkt = (sP_FE2CL_CHAR_TIME_BUFF_TIME_TICK*)respbuf;
+    pkt->iID = self.id;
+    pkt->eCT = combatant->getCharType();
+    pkt->iTB_ID = ECSB_BOUNDINGBALL;
+
+    sSkillResult_Damage *drain = (sSkillResult_Damage*)(respbuf + sizeof(sP_FE2CL_CHAR_TIME_BUFF_TIME_TICK));
+    drain->iDamage = dealt;
+    drain->iHP = combatant->getCurrentHP();
+    drain->eCT = pkt->eCT;
+    drain->iID = pkt->iID;
+
+    NPCManager::sendToViewable(self.getEntity(), (void*)&respbuf, P_FE2CL_CHAR_TIME_BUFF_TIME_TICK, resplen);
+}
 #pragma endregion

src/Buffs.hpp

@@ -66,6 +66,7 @@ public:
     BuffClass maxClass();
 
     int getValue(BuffValueSelector selector);
+    EntityRef getLastSource();
 
     /* 
      * In general, a Buff object won't exist
@@ -86,5 +87,7 @@ public:
 
 namespace Buffs {
     void timeBuffUpdate(EntityRef self, Buff* buff, int status, BuffStack* stack);
+    void timeBuffTick(EntityRef self, Buff* buff);
     void timeBuffTimeout(EntityRef self);
+    void tickDrain(EntityRef self, Buff* buff, int mult);
 }

src/BuiltinCommands.cpp

@@ -72,31 +72,41 @@ static void setValuePlayer(CNSocket* sock, CNPacketData* data) {
 
     // Handle serverside value-changes
     switch (setData->iSetValueType) {
-    case 1:
-        plr->HP = setData->iSetValue;
+    case CN_GM_SET_VALUE_TYPE__HP:
+        response.iSetValue = plr->HP = setData->iSetValue;
         break;
-    case 2:
+    case CN_GM_SET_VALUE_TYPE__WEAPON_BATTERY :
         plr->batteryW = setData->iSetValue;
+
         // caps
         if (plr->batteryW > 9999)
             plr->batteryW = 9999;
+
+        response.iSetValue = plr->batteryW;
         break;
-    case 3:
+    case CN_GM_SET_VALUE_TYPE__NANO_BATTERY:
         plr->batteryN = setData->iSetValue;
+
         // caps
         if (plr->batteryN > 9999)
             plr->batteryN = 9999;
+
+        response.iSetValue = plr->batteryN;
         break;
-    case 4:
+    case CN_GM_SET_VALUE_TYPE__FUSION_MATTER:
         Missions::updateFusionMatter(sock, setData->iSetValue - plr->fusionmatter);
+        response.iSetValue = plr->fusionmatter;
         break;
-    case 5:
-        plr->money = setData->iSetValue;
+    case CN_GM_SET_VALUE_TYPE__CANDY:
+        response.iSetValue = plr->money = setData->iSetValue;
+        break;
+    case CN_GM_SET_VALUE_TYPE__SPEED:
+    case CN_GM_SET_VALUE_TYPE__JUMP:
+        response.iSetValue = setData->iSetValue;
         break;
     }
 
     response.iPC_ID = setData->iPC_ID;
-    response.iSetValue = setData->iSetValue;
     response.iSetValueType = setData->iSetValueType;
 
     sock->sendPacket(response, P_FE2CL_GM_REP_PC_SET_VALUE);

src/Chat.cpp

@@ -1,6 +1,7 @@
 #include "Chat.hpp"
 
 #include "servers/CNShardServer.hpp"
+#include "servers/Monitor.hpp"
 
 #include "Player.hpp"
 #include "PlayerManager.hpp"
@@ -8,8 +9,6 @@
 
 #include <assert.h>
 
-std::vector<std::string> Chat::dump;
-
 using namespace Chat;
 
 static void chatHandler(CNSocket* sock, CNPacketData* data) {
@@ -28,7 +27,7 @@ static void chatHandler(CNSocket* sock, CNPacketData* data) {
     std::string logLine = "[FreeChat] " + PlayerManager::getPlayerName(plr, true) + ": " + fullChat;
 
     std::cout << logLine << std::endl;
-    dump.push_back(logLine);
+    Monitor::chats.push_back(logLine);
 
     // send to client
     INITSTRUCT(sP_FE2CL_REP_SEND_FREECHAT_MESSAGE_SUCC, resp);
@@ -51,7 +50,7 @@ static void menuChatHandler(CNSocket* sock, CNPacketData* data) {
     std::string logLine = "[MenuChat] " + PlayerManager::getPlayerName(plr, true) + ": " + fullChat;
 
     std::cout << logLine << std::endl;
-    dump.push_back(logLine);
+    Monitor::chats.push_back(logLine);
 
     // send to client
     INITSTRUCT(sP_FE2CL_REP_SEND_MENUCHAT_MESSAGE_SUCC, resp);
@@ -103,14 +102,14 @@ static void announcementHandler(CNSocket* sock, CNPacketData* data) {
     memcpy(msg.szAnnounceMsg, announcement->szAnnounceMsg, sizeof(msg.szAnnounceMsg));
     std::map<CNSocket*, Player*>::iterator it;
 
+    // This value is completely arbitrary, but these make the most sense when you consider the architecture of the game
     switch (announcement->iAreaType) {
     case 0: // area (all players in viewable chunks)
         sock->sendPacket(msg, P_FE2CL_GM_REP_PC_ANNOUNCE);
         PlayerManager::sendToViewable(sock, msg, P_FE2CL_GM_REP_PC_ANNOUNCE);
         break;
-    case 1: // shard
-    case 2: // world
-        break; // not applicable to OpenFusion
+    case 1: // channel
+    case 2: // shard
     case 3: // global (all players)
         for (it = PlayerManager::players.begin(); it != PlayerManager::players.end(); it++) {
             CNSocket* allSock = it->first;
@@ -120,9 +119,12 @@ static void announcementHandler(CNSocket* sock, CNPacketData* data) {
         break;
     }
 
-    std::string logLine = "[Bcast " + std::to_string(announcement->iAreaType) + "] " + PlayerManager::getPlayerName(plr, false) + ": " + AUTOU16TOU8(msg.szAnnounceMsg);
-    std::cout << logLine << std::endl;
-    dump.push_back("**" + logLine + "**");
+    std::string logLine = std::to_string(announcement->iAreaType) + " "
+                        + std::to_string(announcement->iAnnounceType) + " "
+                        + std::to_string(announcement->iDuringTime) + " "
+                        + PlayerManager::getPlayerName(plr, false) + ": " + AUTOU16TOU8(msg.szAnnounceMsg);
+    std::cout << "Broadcast " << logLine << std::endl;
+    Monitor::bcasts.push_back(logLine);
 }
 
 // Buddy freechatting
@@ -155,7 +157,7 @@ static void buddyChatHandler(CNSocket* sock, CNPacketData* data) {
 
     std::string logLine = "[BuddyChat] " + PlayerManager::getPlayerName(plr) + " (to " + PlayerManager::getPlayerName(otherPlr) + "): " + fullChat;
     std::cout << logLine << std::endl;
-    dump.push_back(logLine);
+    Monitor::chats.push_back(logLine);
 
     U8toU16(fullChat, (char16_t*)&resp.szFreeChat, sizeof(resp.szFreeChat));
 
@@ -185,7 +187,7 @@ static void buddyMenuChatHandler(CNSocket* sock, CNPacketData* data) {
     std::string logLine = "[BuddyMenuChat] " + PlayerManager::getPlayerName(plr) + " (to " + PlayerManager::getPlayerName(otherPlr) + "): " + fullChat;
 
     std::cout << logLine << std::endl;
-    dump.push_back(logLine);
+    Monitor::chats.push_back(logLine);
 
     U8toU16(fullChat, (char16_t*)&resp.szFreeChat, sizeof(resp.szFreeChat));
 
@@ -218,7 +220,7 @@ static void tradeChatHandler(CNSocket* sock, CNPacketData* data) {
     std::string logLine = "[TradeChat] " + PlayerManager::getPlayerName(plr) + " (to " + PlayerManager::getPlayerName(otherPlr) + "): " + fullChat;
 
     std::cout << logLine << std::endl;
-    dump.push_back(logLine);
+    Monitor::chats.push_back(logLine);
 
     resp.iEmoteCode = pacdat->iEmoteCode;
     sock->sendPacket(resp, P_FE2CL_REP_PC_TRADE_EMOTES_CHAT);
@@ -241,7 +243,7 @@ static void groupChatHandler(CNSocket* sock, CNPacketData* data) {
 
     std::string logLine = "[GroupChat] " + PlayerManager::getPlayerName(plr, true) + ": " + fullChat;
     std::cout << logLine << std::endl;
-    dump.push_back(logLine);
+    Monitor::chats.push_back(logLine);
 
     // send to client
     INITSTRUCT(sP_FE2CL_REP_SEND_ALL_GROUP_FREECHAT_MESSAGE_SUCC, resp);
@@ -264,7 +266,7 @@ static void groupMenuChatHandler(CNSocket* sock, CNPacketData* data) {
     std::string logLine = "[GroupMenuChat] " + PlayerManager::getPlayerName(plr, true) + ": " + fullChat;
 
     std::cout << logLine << std::endl;
-    dump.push_back(logLine);
+    Monitor::chats.push_back(logLine);
 
     // send to client
     INITSTRUCT(sP_FE2CL_REP_SEND_ALL_GROUP_MENUCHAT_MESSAGE_SUCC, resp);

src/Chat.hpp

@@ -8,7 +8,6 @@
 #include <vector>
 
 namespace Chat {
-    extern std::vector<std::string> dump;
     void init();
 
     void sendServerMessage(CNSocket* sock, std::string msg); // uses MOTD

src/Chunking.cpp

@@ -1,7 +1,9 @@
 #include "Chunking.hpp"
 
+#include "Player.hpp"
 #include "MobAI.hpp"
 #include "NPCManager.hpp"
+#include "Bucket.hpp"
 
 #include <assert.h>
 
@@ -11,6 +13,12 @@ using namespace Chunking;
  * The initial chunkPos value before a player is placed into the world.
  */
 const ChunkPos Chunking::INVALID_CHUNK = {};
+constexpr size_t MAX_PC_PER_AROUND = (CN_PACKET_BODY_SIZE - sizeof(int32_t)) / sizeof(sPCAppearanceData);
+constexpr size_t MAX_NPC_PER_AROUND = (CN_PACKET_BODY_SIZE - sizeof(int32_t)) / sizeof(sNPCAppearanceData);
+constexpr size_t MAX_SHINY_PER_AROUND = (CN_PACKET_BODY_SIZE - sizeof(int32_t)) / sizeof(sShinyAppearanceData);
+constexpr size_t MAX_TRANSPORTATION_PER_AROUND = (CN_PACKET_BODY_SIZE - sizeof(int32_t)) / sizeof(sTransportationAppearanceData);
+constexpr size_t MAX_IDS_PER_AROUND_DEL = (CN_PACKET_BODY_SIZE - sizeof(int32_t)) / sizeof(int32_t);
+constexpr size_t MAX_TRANSPORTATION_IDS_PER_AROUND_DEL = MAX_IDS_PER_AROUND_DEL - 1; // 1 less for eTT
 
 std::map<ChunkPos, Chunk*> Chunking::chunks;
 
@@ -75,11 +83,80 @@ void Chunking::untrackEntity(ChunkPos chunkPos, const EntityRef ref) {
         deleteChunk(chunkPos);
 }
 
+template<class T, size_t N>
+static void sendAroundPackets(const EntityRef recipient, std::vector<Bucket<T, N>>& buckets, uint32_t packetId) {
+    assert(recipient.kind == EntityKind::PLAYER);
+
+    uint8_t pktBuf[CN_PACKET_BODY_SIZE];
+    for (const auto& bucket : buckets) {
+        memset(pktBuf, 0, CN_PACKET_BODY_SIZE);
+        int count = bucket.size();
+        *((int32_t*)pktBuf) = count;
+        T* data = (T*)(pktBuf + sizeof(int32_t));
+        for (size_t i = 0; i < count; i++) {
+            data[i] = bucket.get(i).value();
+        }
+        recipient.sock->sendPacket(pktBuf, packetId, sizeof(int32_t) + (count * sizeof(T)));
+    }
+}
+
+template<size_t N>
+static void sendAroundDelPackets(const EntityRef recipient, std::vector<Bucket<int32_t, N>>& buckets, uint32_t packetId) {
+    assert(recipient.kind == EntityKind::PLAYER);
+
+    uint8_t pktBuf[CN_PACKET_BODY_SIZE];
+    for (const auto& bucket : buckets) {
+        memset(pktBuf, 0, CN_PACKET_BODY_SIZE);
+        int count = bucket.size();
+        assert(count <= N);
+
+        size_t baseSize;
+        if (packetId == P_FE2CL_AROUND_DEL_TRANSPORTATION) {
+            sP_FE2CL_AROUND_DEL_TRANSPORTATION* pkt = (sP_FE2CL_AROUND_DEL_TRANSPORTATION*)pktBuf;
+            pkt->eTT = 3;
+            pkt->iCnt = count;
+            baseSize = sizeof(sP_FE2CL_AROUND_DEL_TRANSPORTATION);
+        } else {
+            *((int32_t*)pktBuf) = count;
+            baseSize = sizeof(int32_t);
+        }
+        int32_t* ids = (int32_t*)(pktBuf + baseSize);
+
+        for (size_t i = 0; i < count; i++) {
+            ids[i] = bucket.get(i).value();
+        }
+        recipient.sock->sendPacket(pktBuf, packetId, baseSize + (count * sizeof(int32_t)));
+    }
+}
+
+template<class T, size_t N>
+static void bufferAppearanceData(std::vector<Bucket<T, N>>& buckets, const T& data) {
+    if (buckets.empty())
+        buckets.push_back({});
+    auto& bucket = buckets[buckets.size() - 1];
+    bucket.add(data);
+    if (bucket.isFull())
+        buckets.push_back({});
+}
+
+template<size_t N>
+static void bufferIdForDisappearance(std::vector<Bucket<int32_t, N>>& buckets, int32_t id) {
+    if (buckets.empty())
+        buckets.push_back({});
+    auto& bucket = buckets[buckets.size() - 1];
+    bucket.add(id);
+    if (bucket.isFull())
+        buckets.push_back({});
+}
+
 void Chunking::addEntityToChunks(std::set<Chunk*> chnks, const EntityRef ref) {
     Entity *ent = ref.getEntity();
     bool alive = ent->isExtant();
 
-    // TODO: maybe optimize this, potentially using AROUND packets?
+    std::vector<Bucket<sPCAppearanceData, MAX_PC_PER_AROUND>> pcAppearances;
+    std::vector<Bucket<sNPCAppearanceData, MAX_NPC_PER_AROUND>> npcAppearances;
+    std::vector<Bucket<sShinyAppearanceData, MAX_SHINY_PER_AROUND>> shinyAppearances;
+    std::vector<Bucket<sTransportationAppearanceData, MAX_TRANSPORTATION_PER_AROUND>> transportationAppearances;
     for (Chunk *chunk : chnks) {
         for (const EntityRef otherRef : chunk->entities) {
             // skip oneself
@@ -95,7 +172,38 @@ void Chunking::addEntityToChunks(std::set<Chunk*> chnks, const EntityRef ref) {
 
             // notify this *player* of the existence of all visible Entities
             if (ref.kind == EntityKind::PLAYER && other->isExtant()) {
-                other->enterIntoViewOf(ref.sock);
+                sPCAppearanceData pcData;
+                sNPCAppearanceData npcData;
+                sShinyAppearanceData eggData;
+                sTransportationAppearanceData busData;
+                switch(otherRef.kind) {
+                case EntityKind::PLAYER:
+                    pcData = dynamic_cast<Player*>(other)->getAppearanceData();
+                    bufferAppearanceData(pcAppearances, pcData);
+                    break;
+                case EntityKind::SIMPLE_NPC:
+                    npcData = dynamic_cast<BaseNPC*>(other)->getAppearanceData();
+                    bufferAppearanceData(npcAppearances, npcData);
+                    break;
+                case EntityKind::COMBAT_NPC:
+                    npcData = dynamic_cast<CombatNPC*>(other)->getAppearanceData();
+                    bufferAppearanceData(npcAppearances, npcData);
+                    break;
+                case EntityKind::MOB:
+                    npcData = dynamic_cast<Mob*>(other)->getAppearanceData();
+                    bufferAppearanceData(npcAppearances, npcData);
+                    break;
+                case EntityKind::EGG:
+                    eggData = dynamic_cast<Egg*>(other)->getShinyAppearanceData();
+                    bufferAppearanceData(shinyAppearances, eggData);
+                    break;
+                case EntityKind::BUS:
+                    busData = dynamic_cast<Bus*>(other)->getTransportationAppearanceData();
+                    bufferAppearanceData(transportationAppearances, busData);
+                    break;
+                default:
+                    break;
+                }
             }
 
             // for mobs, increment playersInView
@@ -105,13 +213,27 @@ void Chunking::addEntityToChunks(std::set<Chunk*> chnks, const EntityRef ref) {
                 ((Mob*)other)->playersInView++;
         }
     }
+
+    if (ref.kind == EntityKind::PLAYER) {
+        if (!pcAppearances.empty())
+            sendAroundPackets(ref, pcAppearances, P_FE2CL_PC_AROUND);
+        if (!npcAppearances.empty())
+            sendAroundPackets(ref, npcAppearances, P_FE2CL_NPC_AROUND);
+        if (!shinyAppearances.empty())
+            sendAroundPackets(ref, shinyAppearances, P_FE2CL_SHINY_AROUND);
+        if (!transportationAppearances.empty())
+            sendAroundPackets(ref, transportationAppearances, P_FE2CL_TRANSPORTATION_AROUND);
+    }
 }
 
 void Chunking::removeEntityFromChunks(std::set<Chunk*> chnks, const EntityRef ref) {
     Entity *ent = ref.getEntity();
     bool alive = ent->isExtant();
 
-    // TODO: same as above
+    std::vector<Bucket<int32_t, MAX_IDS_PER_AROUND_DEL>> pcDisappearances;
+    std::vector<Bucket<int32_t, MAX_IDS_PER_AROUND_DEL>> npcDisappearances;
+    std::vector<Bucket<int32_t, MAX_IDS_PER_AROUND_DEL>> shinyDisappearances;
+    std::vector<Bucket<int32_t, MAX_TRANSPORTATION_IDS_PER_AROUND_DEL>> transportationDisappearances;
     for (Chunk *chunk : chnks) {
         for (const EntityRef otherRef : chunk->entities) {
             // skip oneself
@@ -127,7 +249,29 @@ void Chunking::removeEntityFromChunks(std::set<Chunk*> chnks, const EntityRef re
 
             // notify this *player* of the departure of all visible Entities
             if (ref.kind == EntityKind::PLAYER && other->isExtant()) {
-                other->disappearFromViewOf(ref.sock);
+                int32_t id;
+                switch(otherRef.kind) {
+                case EntityKind::PLAYER:
+                    id = dynamic_cast<Player*>(other)->iID;
+                    bufferIdForDisappearance(pcDisappearances, id);
+                    break;
+                case EntityKind::SIMPLE_NPC:
+                case EntityKind::COMBAT_NPC:
+                case EntityKind::MOB:
+                    id = dynamic_cast<BaseNPC*>(other)->id;
+                    bufferIdForDisappearance(npcDisappearances, id);
+                    break;
+                case EntityKind::EGG:
+                    id = dynamic_cast<Egg*>(other)->id;
+                    bufferIdForDisappearance(shinyDisappearances, id);
+                    break;
+                case EntityKind::BUS:
+                    id = dynamic_cast<Bus*>(other)->id;
+                    bufferIdForDisappearance(transportationDisappearances, id);
+                    break;
+                default:
+                    break;
+                }
             }
 
             // for mobs, decrement playersInView
@@ -137,6 +281,17 @@ void Chunking::removeEntityFromChunks(std::set<Chunk*> chnks, const EntityRef re
                 ((Mob*)other)->playersInView--;
         }
     }
+
+    if (ref.kind == EntityKind::PLAYER) {
+        if (!pcDisappearances.empty())
+            sendAroundDelPackets(ref, pcDisappearances, P_FE2CL_AROUND_DEL_PC);
+        if (!npcDisappearances.empty())
+            sendAroundDelPackets(ref, npcDisappearances, P_FE2CL_AROUND_DEL_NPC);
+        if (!shinyDisappearances.empty())
+            sendAroundDelPackets(ref, shinyDisappearances, P_FE2CL_AROUND_DEL_SHINY);
+        if (!transportationDisappearances.empty())
+            sendAroundDelPackets(ref, transportationDisappearances, P_FE2CL_AROUND_DEL_TRANSPORTATION);
+    }
 }
 
 static void emptyChunk(ChunkPos chunkPos) {

src/Combat.cpp

@@ -21,13 +21,14 @@ std::map<int32_t, std::map<int8_t, Bullet>> Combat::Bullets;
 
 #pragma region Player
 bool Player::addBuff(int buffId, BuffCallback<int, BuffStack*> onUpdate, BuffCallback<time_t> onTick, BuffStack* stack) {
-    EntityRef self = PlayerManager::getSockFromID(iID);
+    if(!isAlive())
+        return false;
 
     if(!hasBuff(buffId)) {
-        buffs[buffId] = new Buff(buffId, self, onUpdate, onTick, stack);
+        buffs[buffId] = new Buff(buffId, getRef(), onUpdate, onTick, stack);
         return true;
     }
-    
+
     buffs[buffId]->updateCallbacks(onUpdate, onTick);
     buffs[buffId]->addStack(stack);
     return false;
@@ -48,9 +49,10 @@ void Player::removeBuff(int buffId) {
     }
 }
 
-void Player::removeBuff(int buffId, int buffClass) {
+void Player::removeBuff(int buffId, BuffClass buffClass) {
     if(hasBuff(buffId)) {
-        buffs[buffId]->clear((BuffClass)buffClass);
+        buffs[buffId]->clear(buffClass);
+        // buff might not be stale since another buff class might remain
         if(buffs[buffId]->isStale()) {
             delete buffs[buffId];
             buffs.erase(buffId);
@@ -58,6 +60,16 @@ void Player::removeBuff(int buffId, int buffClass) {
     }
 }
 
+void Player::clearBuffs(bool force) {
+    auto it = buffs.begin();
+    while(it != buffs.end()) {
+        Buff* buff = (*it).second;
+        if(!force) buff->clear();
+        delete buff;
+        it = buffs.erase(it);
+    }
+}
+
 bool Player::hasBuff(int buffId) {
     auto buff = buffs.find(buffId);
     return buff != buffs.end() && !buff->second->isStale();
@@ -156,29 +168,78 @@ void Player::step(time_t currTime) {
     // buffs
     for(auto buffEntry : buffs) {
         buffEntry.second->combatTick(currTime);
+        if(!isAlive())
+            break; // unsafe to keep ticking if we're dead
     }
 }
 #pragma endregion
 
 #pragma region CombatNPC
-bool CombatNPC::addBuff(int buffId, BuffCallback<int, BuffStack*> onUpdate, BuffCallback<time_t> onTick, BuffStack* stack) { /* stubbed */
+bool CombatNPC::addBuff(int buffId, BuffCallback<int, BuffStack*> onUpdate, BuffCallback<time_t> onTick, BuffStack* stack) {
+    if(!isAlive())
+        return false;
+
+    if (this->state != AIState::COMBAT && this->state != AIState::ROAMING)
+        return false;
+
+    if(!hasBuff(buffId)) {
+        buffs[buffId] = new Buff(buffId, getRef(), onUpdate, onTick, stack);
+        return true;
+    }
+
+    buffs[buffId]->updateCallbacks(onUpdate, onTick);
+    buffs[buffId]->addStack(stack);
     return false;
 }
 
-Buff* CombatNPC::getBuff(int buffId) { /* stubbed */
+Buff* CombatNPC::getBuff(int buffId) {
+    if(hasBuff(buffId)) {
+        return buffs[buffId];
+    }
     return nullptr;
 }
 
-void CombatNPC::removeBuff(int buffId) { /* stubbed */ }
-
-void CombatNPC::removeBuff(int buffId, int buffClass) { /* stubbed */ }
-
-bool CombatNPC::hasBuff(int buffId) { /* stubbed */
-    return false;
+void CombatNPC::removeBuff(int buffId) {
+    if(hasBuff(buffId)) {
+        buffs[buffId]->clear();
+        delete buffs[buffId];
+        buffs.erase(buffId);
+    }
 }
 
-int CombatNPC::getCompositeCondition() { /* stubbed */
-    return 0;
+void CombatNPC::removeBuff(int buffId, BuffClass buffClass) {
+    if(hasBuff(buffId)) {
+        buffs[buffId]->clear(buffClass);
+        // buff might not be stale since another buff class might remain
+        if(buffs[buffId]->isStale()) {
+            delete buffs[buffId];
+            buffs.erase(buffId);
+        }
+    }
+}
+
+void CombatNPC::clearBuffs(bool force) {
+    auto it = buffs.begin();
+    while(it != buffs.end()) {
+        Buff* buff = (*it).second;
+        if(!force) buff->clear();
+        delete buff;
+        it = buffs.erase(it);
+    }
+}
+
+bool CombatNPC::hasBuff(int buffId) {
+    auto buff = buffs.find(buffId);
+    return buff != buffs.end() && !buff->second->isStale();
+}
+
+int CombatNPC::getCompositeCondition() {
+    int conditionBitFlag = 0;
+    for(auto buff : buffs) {
+        if(!buff.second->isStale() && buff.second->id > 0)
+            conditionBitFlag |= CSB_FROM_ECSB(buff.first);
+    }
+    return conditionBitFlag;
 }
 
 int CombatNPC::takeDamage(EntityRef src, int amt) {
@@ -249,19 +310,19 @@ void CombatNPC::step(time_t currTime) {
 }
 
 void CombatNPC::transition(AIState newState, EntityRef src) {
-
     state = newState;
+
     if (transitionHandlers.find(newState) != transitionHandlers.end())
         transitionHandlers[newState](this, src);
     else {
         std::cout << "[WARN] Transition to " << (int)state << " has no handler; going inactive" << std::endl;
         transition(AIState::INACTIVE, id);
     }
-    /* TODO: fire any triggered events
+
+    // trigger special NPCEvents, if applicable
     for (NPCEvent& event : NPCManager::NPCEvents)
-        if (event.trigger == ON_KILLED && event.npcType == type)
-            event.handler(src, this);
-    */
+        if (event.triggerState == newState && event.npcType == type)
+            event.handler(this);
 }
 #pragma endregion
 
@@ -304,11 +365,40 @@ static std::pair<int,int> getDamage(int attackPower, int defensePower, bool shou
     return ret;
 }
 
+static bool checkRapidFire(CNSocket *sock, int targetCount, bool allowManyTargets) {
+    Player *plr = PlayerManager::getPlayer(sock);
+    time_t currTime = getTime();
+
+    if (currTime - plr->lastShot < plr->fireRate * 80)
+        plr->suspicionRating += plr->fireRate * 100 + plr->lastShot - currTime; // gain suspicion for rapid firing
+    else if (currTime - plr->lastShot < plr->fireRate * 180 && plr->suspicionRating > 0)
+        plr->suspicionRating += plr->fireRate * 100 + plr->lastShot - currTime; // lose suspicion for delayed firing
+
+    plr->lastShot = currTime;
+
+    // 3+ targets should never be possible
+    if (!allowManyTargets && targetCount > 3)
+        plr->suspicionRating += 10001;
+
+    // kill the socket when the player is too suspicious
+    if (plr->suspicionRating > 10000) {
+        sock->kill();
+        CNShardServer::_killConnection(sock);
+        return true;
+    }
+
+    return false;
+}
+
 static void pcAttackNpcs(CNSocket *sock, CNPacketData *data) {
     auto pkt = (sP_CL2FE_REQ_PC_ATTACK_NPCs*)data->buf;
     Player *plr = PlayerManager::getPlayer(sock);
     auto targets = (int32_t*)data->trailers;
 
+    // kick the player if firing too rapidly
+    if (settings::ANTICHEAT && checkRapidFire(sock, pkt->iNPCCnt, false))
+        return;
+
     /*
      * IMPORTANT: This validates memory safety in addition to preventing
      * ordinary cheating. If the client sends a very large number of trailing
@@ -449,9 +539,9 @@ static void dealGooDamage(CNSocket *sock) {
         return; // ignore completely
 
     size_t resplen = sizeof(sP_FE2CL_CHAR_TIME_BUFF_TIME_TICK) + sizeof(sSkillResult_DotDamage);
-    assert(resplen < CN_PACKET_BUFFER_SIZE - 8);
-    uint8_t respbuf[CN_PACKET_BUFFER_SIZE];
-    memset(respbuf, 0, resplen);
+    assert(resplen < CN_PACKET_BODY_SIZE);
+    uint8_t respbuf[CN_PACKET_BODY_SIZE];
+    memset(respbuf, 0, CN_PACKET_BODY_SIZE);
 
     sP_FE2CL_CHAR_TIME_BUFF_TIME_TICK *pkt = (sP_FE2CL_CHAR_TIME_BUFF_TIME_TICK*)respbuf;
     sSkillResult_DotDamage *dmg = (sSkillResult_DotDamage*)(respbuf + sizeof(sP_FE2CL_CHAR_TIME_BUFF_TIME_TICK));
@@ -543,9 +633,9 @@ static void pcAttackChars(CNSocket *sock, CNPacketData *data) {
 
     // initialize response struct
     size_t resplen = sizeof(sP_FE2CL_PC_ATTACK_CHARs_SUCC) + pkt->iTargetCnt * sizeof(sAttackResult);
-    uint8_t respbuf[CN_PACKET_BUFFER_SIZE];
+    uint8_t respbuf[CN_PACKET_BODY_SIZE];
 
-    memset(respbuf, 0, resplen);
+    memset(respbuf, 0, CN_PACKET_BODY_SIZE);
 
     sP_FE2CL_PC_ATTACK_CHARs_SUCC *resp = (sP_FE2CL_PC_ATTACK_CHARs_SUCC*)respbuf;
     sAttackResult *respdata = (sAttackResult*)(respbuf+sizeof(sP_FE2CL_PC_ATTACK_CHARs_SUCC));
@@ -747,15 +837,19 @@ static void projectileHit(CNSocket* sock, CNPacketData* data) {
         return;
     }
 
+    // kick the player if firing too rapidly
+    if (settings::ANTICHEAT && checkRapidFire(sock, pkt->iTargetCnt, true))
+        return;
+
     /*
      * initialize response struct
      * rocket style hit doesn't work properly, so we're always sending this one
      */
 
     size_t resplen = sizeof(sP_FE2CL_PC_GRENADE_STYLE_HIT) + pkt->iTargetCnt * sizeof(sAttackResult);
-    uint8_t respbuf[CN_PACKET_BUFFER_SIZE];
+    uint8_t respbuf[CN_PACKET_BODY_SIZE];
 
-    memset(respbuf, 0, resplen);
+    memset(respbuf, 0, CN_PACKET_BODY_SIZE);
 
     sP_FE2CL_PC_GRENADE_STYLE_HIT* resp = (sP_FE2CL_PC_GRENADE_STYLE_HIT*)respbuf;
     sAttackResult* respdata = (sAttackResult*)(respbuf + sizeof(sP_FE2CL_PC_GRENADE_STYLE_HIT));
@@ -845,9 +939,12 @@ static void playerTick(CNServer *serv, time_t currTime) {
             if (Abilities::SkillTable.find(nano->iSkillID) != Abilities::SkillTable.end()) {
                 // nano has skill data
                 SkillData* skill = &Abilities::SkillTable[nano->iSkillID];
-                if (skill->drainType == SkillDrainType::PASSIVE)
-                    Nanos::applyNanoBuff(skill, plr);
-                // ^ composite condition calculation is separate from combat for responsiveness
+                if (skill->drainType == SkillDrainType::PASSIVE) {
+                    ICombatant* src = dynamic_cast<ICombatant*>(plr);
+                    int32_t targets[] = { plr->iID };
+                    std::vector<ICombatant*> affectedCombatants = Abilities::matchTargets(src, skill, 1, targets);
+                    Abilities::useNanoSkill(sock, skill, *nano, affectedCombatants);
+                }
             }
         }
 
@@ -867,6 +964,7 @@ static void playerTick(CNServer *serv, time_t currTime) {
         auto it = plr->buffs.begin();
         while(it != plr->buffs.end()) {
             Buff* buff = (*it).second;
+            //buff->combatTick() gets called in Player::step
             buff->tick(currTime);
             if(buff->isStale()) {
                 // garbage collect

src/CustomCommands.cpp

@@ -83,7 +83,77 @@ static void helpCommand(std::string full, std::vector<std::string>& args, CNSock
 }
 
 static void accessCommand(std::string full, std::vector<std::string>& args, CNSocket* sock) {
-    Chat::sendServerMessage(sock, "Your access level is " + std::to_string(PlayerManager::getPlayer(sock)->accountLevel));
+    if (args.size() < 2) {
+        Chat::sendServerMessage(sock, "Usage: /access <id> [new_level]");
+        Chat::sendServerMessage(sock, "Use . for id to select yourself");
+        return;
+    }
+
+    char *tmp;
+
+    Player* self = PlayerManager::getPlayer(sock);
+    int selfAccess = self->accountLevel;
+
+    Player* player;
+    if (args[1].compare(".") == 0) {
+        player = self;
+    } else {
+        int id = std::strtol(args[1].c_str(), &tmp, 10);
+        if (*tmp) {
+            Chat::sendServerMessage(sock, "Invalid player ID " + args[1]);
+            return;
+        }
+
+        player = PlayerManager::getPlayerFromID(id);
+        if (player == nullptr) {
+            Chat::sendServerMessage(sock, "Could not find player with ID " + std::to_string(id));
+            return;
+        }
+
+        // Messing with other players requires a baseline access of 30
+        if (player != self && selfAccess > 30) {
+            Chat::sendServerMessage(sock, "Can't check or change other players access levels (insufficient privileges)");
+            return;
+        }
+    }
+
+    std::string playerName = PlayerManager::getPlayerName(player);
+    int currentAccess = player->accountLevel;
+    if (args.size() < 3) {
+        // just check
+        Chat::sendServerMessage(sock, playerName + " has access level " + std::to_string(currentAccess));
+        return;
+    }
+
+    // Can't change the access level of someone with stronger privileges
+    // N.B. lower value = stronger privileges
+    if (currentAccess <= selfAccess) {
+        Chat::sendServerMessage(sock, "Can't change this player's access level (insufficient privileges)");
+        return;
+    }
+
+    int newAccess = std::strtol(args[2].c_str(), &tmp, 10);
+    if (*tmp) {
+        Chat::sendServerMessage(sock, "Invalid access level " + args[2]);
+        return;
+    }
+
+    // Can only assign an access level weaker than yours
+    if (newAccess <= selfAccess) {
+        Chat::sendServerMessage(sock, "Can only assign privileges weaker than your own");
+        return;
+    }
+
+    player->accountLevel = newAccess;
+
+    // Save to database
+    int accountId = Database::getAccountIdForPlayer(player->iID);
+    Database::updateAccountLevel(accountId, newAccess);
+
+    std::string msg = "Changed access level for " + playerName + " from " + std::to_string(currentAccess) + " to " + std::to_string(newAccess);
+    if (newAccess <= 50 && currentAccess > 50)
+        msg += " (they must log out and back in for some commands to be enabled)";
+    Chat::sendServerMessage(sock, msg);
 }
 
 static void populationCommand(std::string full, std::vector<std::string>& args, CNSocket* sock) {
@@ -359,23 +429,19 @@ static void npcRotateCommand(std::string full, std::vector<std::string>& args, C
     int angle = (plr->angle + 180) % 360;
     NPCManager::updateNPCPosition(npc->id, npc->x, npc->y, npc->z, npc->instanceID, angle);
 
-    // if it's a gruntwork NPC, rotate in-place
-    if (TableData::RunningMobs.find(npc->id) != TableData::RunningMobs.end()) {
-        NPCManager::updateNPCPosition(npc->id, npc->x, npc->y, npc->z, npc->instanceID, angle);
+    bool isGruntworkNpc = true;
 
-        Chat::sendServerMessage(sock, "[NPCR] Successfully set angle to " + std::to_string(angle) + " for gruntwork NPC "
-            + std::to_string(npc->id));
-    } else {
+    // add a rotation entry to the gruntwork file, unless it's already a gruntwork NPC
+    if (TableData::RunningMobs.find(npc->id) == TableData::RunningMobs.end()) {
         TableData::RunningNPCRotations[npc->id] = angle;
-
-        Chat::sendServerMessage(sock, "[NPCR] Successfully set angle to " + std::to_string(angle) + " for NPC "
-            + std::to_string(npc->id));
+        isGruntworkNpc = false;
     }
 
-    // update rotation clientside
-    INITSTRUCT(sP_FE2CL_NPC_ENTER, pkt);
-    pkt.NPCAppearanceData = npc->getAppearanceData();
-    sock->sendPacket(pkt, P_FE2CL_NPC_ENTER);
+    Chat::sendServerMessage(sock, "[NPCR] Successfully set angle to " + std::to_string(angle) +
+        " for " + (isGruntworkNpc ? "gruntwork " : "") + "NPC " + std::to_string(npc->id));
+
+    // update rotation clientside by refreshing the player's chunks (same as the /refresh command)
+    PlayerManager::updatePlayerPositionForWarp(sock, plr->x, plr->y, plr->z, plr->instanceID);
 }
 
 static void refreshCommand(std::string full, std::vector<std::string>& args, CNSocket* sock) {
@@ -678,7 +744,6 @@ static void whoisCommand(std::string full, std::vector<std::string>& args, CNSoc
     Chat::sendServerMessage(sock, "[WHOIS] ID: " + std::to_string(npc->id));
     Chat::sendServerMessage(sock, "[WHOIS] Type: " + std::to_string(npc->type));
     Chat::sendServerMessage(sock, "[WHOIS] HP: " + std::to_string(npc->hp));
-    Chat::sendServerMessage(sock, "[WHOIS] CBF: " + std::to_string(npc->cbf));
     Chat::sendServerMessage(sock, "[WHOIS] EntityType: " + std::to_string((int)npc->kind));
     Chat::sendServerMessage(sock, "[WHOIS] X: " + std::to_string(npc->x));
     Chat::sendServerMessage(sock, "[WHOIS] Y: " + std::to_string(npc->y));
@@ -1205,7 +1270,7 @@ static void registerCommand(std::string cmd, int requiredLevel, CommandHandler h
 
 void CustomCommands::init() {
     registerCommand("help", 100, helpCommand, "list all unlocked server-side commands");
-    registerCommand("access", 100, accessCommand, "print your access level");
+    registerCommand("access", 100, accessCommand, "check or change access levels");
     registerCommand("instance", 30, instanceCommand, "print or change your current instance");
     registerCommand("mss", 30, mssCommand, "edit Monkey Skyway routes");
     registerCommand("npcr", 30, npcRotateCommand, "rotate NPCs");

src/Eggs.cpp

@@ -26,10 +26,11 @@ void Eggs::eggBuffPlayer(CNSocket* sock, int skillId, int eggId, int duration) {
         return;
     }
 
+    SkillResult result = SkillResult();
     SkillData* skill = &Abilities::SkillTable[skillId];
     if(skill->drainType == SkillDrainType::PASSIVE) {
         // apply buff
-        if(skill->targetType != SkillTargetType::SELF) {
+        if(skill->targetType != SkillTargetType::PLAYERS) {
             std::cout << "[WARN] weird skill type for egg " << eggId << " with skill " << skillId << ", should be " << (int)skill->targetType << std::endl;
         }
 
@@ -50,12 +51,57 @@ void Eggs::eggBuffPlayer(CNSocket* sock, int skillId, int eggId, int duration) {
                 // no-op
             },
             &eggBuff);
+
+        sSkillResult_Buff resultBuff{};
+        resultBuff.eCT = plr->getCharType();
+        resultBuff.iID = plr->getID();
+        resultBuff.bProtected = false;
+        resultBuff.iConditionBitFlag = plr->getCompositeCondition();
+        result = SkillResult(sizeof(sSkillResult_Buff), &resultBuff);
+    } else {
+        int value = plr->getMaxHP() * skill->values[0][0] / 1000;
+        sSkillResult_Damage resultDamage{};
+        sSkillResult_Heal_HP resultHeal{};
+        switch(skill->skillType)
+        {
+            case SkillType::DAMAGE:
+                resultDamage.bProtected = false;
+                resultDamage.eCT = plr->getCharType();
+                resultDamage.iID = plr->getID();
+                resultDamage.iDamage = plr->takeDamage(src, value);
+                resultDamage.iHP = plr->getCurrentHP();
+                result = SkillResult(sizeof(sSkillResult_Damage), &resultDamage);
+                break;
+            case SkillType::HEAL_HP:
+                resultHeal.eCT = plr->getCharType();
+                resultHeal.iID = plr->getID();
+                resultHeal.iHealHP = plr->heal(src, value);
+                resultHeal.iHP = plr->getCurrentHP();
+                result = SkillResult(sizeof(sSkillResult_Heal_HP), &resultHeal);
+                break;
+            default:
+                std::cout << "[WARN] oops, egg with active skill type " << (int)skill->skillType << " unhandled";
+                return;
+        }
     }
 
-    // use skill
-    std::vector<ICombatant*> targets;
-    targets.push_back(dynamic_cast<ICombatant*>(plr));
-    Abilities::useNPCSkill(src, skillId, targets);
+    // initialize response struct
+    size_t resplen = sizeof(sP_FE2CL_NPC_SKILL_HIT) + result.size;
+    uint8_t respbuf[CN_PACKET_BODY_SIZE];
+    memset(respbuf, 0, CN_PACKET_BODY_SIZE);
+
+    sP_FE2CL_NPC_SKILL_HIT* pkt = (sP_FE2CL_NPC_SKILL_HIT*)respbuf;
+    pkt->iNPC_ID = eggId;
+    pkt->iSkillID = skillId;
+    pkt->eST = (int32_t)skill->skillType;
+    pkt->iTargetCnt = 1;
+
+    if(result.size > 0) {
+        void* attached = (void*)(pkt + 1);
+        memcpy(attached, result.payload, result.size);
+    }
+    
+    NPCManager::sendToViewable(src.getEntity(), pkt, P_FE2CL_NPC_SKILL_HIT, resplen);
 }
 
 static void eggStep(CNServer* serv, time_t currTime) {
@@ -80,15 +126,6 @@ static void eggStep(CNServer* serv, time_t currTime) {
 
 }
 
-void Eggs::npcDataToEggData(int x, int y, int z, sNPCAppearanceData* npc, sShinyAppearanceData* egg) {
-    egg->iX = x;
-    egg->iY = y;
-    egg->iZ = z;
-    // client doesn't care about egg->iMapNum
-    egg->iShinyType = npc->iNPCType;
-    egg->iShiny_ID = npc->iNPC_ID;
-}
-
 static void eggPickup(CNSocket* sock, CNPacketData* data) {
     auto pickup = (sP_CL2FE_REQ_SHINY_PICKUP*)data->buf;
     Player* plr = PlayerManager::getPlayer(sock);
@@ -146,7 +183,7 @@ static void eggPickup(CNSocket* sock, CNPacketData* data) {
     // drop
     if (type->dropCrateId != 0) {
         const size_t resplen = sizeof(sP_FE2CL_REP_REWARD_ITEM) + sizeof(sItemReward);
-        assert(resplen < CN_PACKET_BUFFER_SIZE - 8);
+        assert(resplen < CN_PACKET_BODY_SIZE);
         // we know it's only one trailing struct, so we can skip full validation
 
         uint8_t respbuf[resplen]; // not a variable length array, don't worry

src/Eggs.hpp

@@ -15,5 +15,4 @@ namespace Eggs {
     void init();
 
     void eggBuffPlayer(CNSocket* sock, int skillId, int eggId, int duration);
-    void npcDataToEggData(int x, int y, int z, sNPCAppearanceData* npc, sShinyAppearanceData* egg);
 }

src/Email.cpp

@@ -3,6 +3,7 @@
 #include "core/Core.hpp"
 #include "db/Database.hpp"
 #include "servers/CNShardServer.hpp"
+#include "servers/Monitor.hpp"
 
 #include "PlayerManager.hpp"
 #include "Items.hpp"
@@ -10,8 +11,6 @@
 
 using namespace Email;
 
-std::vector<std::string> Email::dump;
-
 // New email notification
 static void emailUpdateCheck(CNSocket* sock, CNPacketData* data) {
     INITSTRUCT(sP_FE2CL_REP_PC_NEW_EMAIL, resp);
@@ -93,7 +92,7 @@ static void emailReceiveItemSingle(CNSocket* sock, CNPacketData* data) {
     auto pkt = (sP_CL2FE_REQ_PC_RECV_EMAIL_ITEM*)data->buf;
     Player* plr = PlayerManager::getPlayer(sock);
 
-    if (pkt->iSlotNum < 0 || pkt->iSlotNum >= AINVEN_COUNT || pkt->iSlotNum < 1 || pkt->iSlotNum > 4)
+    if (pkt->iSlotNum < 0 || pkt->iSlotNum >= AINVEN_COUNT || pkt->iEmailItemSlot < 1 || pkt->iEmailItemSlot > 4)
         return; // sanity check
 
     // get email item from db and delete it
@@ -252,11 +251,26 @@ static void emailSend(CNSocket* sock, CNPacketData* data) {
         if (attachment.ItemInven.iID == 0)
             continue;
 
+        sItemBase* item = &pkt->aItem[i].ItemInven;
+        sItemBase* real = &plr->Inven[attachment.iSlotNum];
+
         resp.aItem[i] = attachment;
         attachments.push_back(attachment.ItemInven);
         attSlots.push_back(attachment.iSlotNum);
-        // delete item
-        plr->Inven[attachment.iSlotNum] = { 0, 0, 0, 0 };
+        if (real->iOpt <= item->iOpt) // delete item (if they attached the whole stack)
+            *real = { 0, 0, 0, 0 };
+        else // otherwise, decrement the item
+            real->iOpt -= item->iOpt;
+
+        // HACK: update the slot
+        INITSTRUCT(sP_FE2CL_PC_ITEM_MOVE_SUCC, itemResp);
+        itemResp.iFromSlotNum = attachment.iSlotNum;
+        itemResp.iToSlotNum = attachment.iSlotNum;
+        itemResp.FromSlotItem = *real;
+        itemResp.ToSlotItem = *real;
+        itemResp.eFrom = (int32_t)Items::SlotType::INVENTORY;
+        itemResp.eTo = (int32_t)Items::SlotType::INVENTORY;
+        sock->sendPacket(itemResp, P_FE2CL_PC_ITEM_MOVE_SUCC);
     }
 
     int cost = pkt->iCash + 50 + 20 * attachments.size(); // attached taros + postage
@@ -276,7 +290,7 @@ static void emailSend(CNSocket* sock, CNPacketData* data) {
         0 // DeleteTime (unimplemented)
     };
 
-    if (!Database::sendEmail(&email, attachments)) {
+    if (!Database::sendEmail(&email, attachments, plr)) {
         plr->money += cost; // give money back
         // give items back
         while (!attachments.empty()) {
@@ -309,7 +323,14 @@ static void emailSend(CNSocket* sock, CNPacketData* data) {
 
     std::string logEmail = "[Email] " + PlayerManager::getPlayerName(plr, true) + " (to " + PlayerManager::getPlayerName(&otherPlr, true) + "): <" + email.SubjectLine + ">\n" + email.MsgBody;
     std::cout << logEmail << std::endl;
-    dump.push_back(logEmail);
+    Monitor::emails.push_back(logEmail);
+
+    // notification to recipient if online
+    CNSocket* recipient = PlayerManager::getSockFromID(pkt->iTo_PCUID);
+    if (recipient != nullptr)
+    {
+        emailUpdateCheck(recipient, nullptr);
+    }
 }
 
 void Email::init() {

src/Email.hpp

@@ -4,7 +4,5 @@
 #include <string>
 
 namespace Email {
-    extern std::vector<std::string> dump;
-    
     void init();
 }

src/Entities.cpp

@@ -16,8 +16,9 @@ EntityRef::EntityRef(CNSocket *s) {
 EntityRef::EntityRef(int32_t i) {
     id = i;
 
-    assert(NPCManager::NPCs.find(id) != NPCManager::NPCs.end());
-    kind = NPCManager::NPCs[id]->kind;
+    kind = EntityKind::INVALID;
+    if (NPCManager::NPCs.find(id) != NPCManager::NPCs.end())
+        kind = NPCManager::NPCs[id]->kind;
 }
 
 bool EntityRef::isValid() const {
@@ -40,7 +41,7 @@ sNPCAppearanceData BaseNPC::getAppearanceData() {
     sNPCAppearanceData data = {};
     data.iAngle = angle;
     data.iBarkerType = 0; // unused?
-    data.iConditionBitFlag = cbf;
+    data.iConditionBitFlag = 0;
     data.iHP = hp;
     data.iNPCType = type;
     data.iNPC_ID = id;
@@ -50,6 +51,12 @@ sNPCAppearanceData BaseNPC::getAppearanceData() {
     return data;
 }
 
+sNPCAppearanceData CombatNPC::getAppearanceData() {
+    sNPCAppearanceData data = BaseNPC::getAppearanceData();
+    data.iConditionBitFlag = getCompositeCondition();
+    return data;
+}
+
 /*
  * Entity coming into view.
  */
@@ -63,11 +70,7 @@ void Bus::enterIntoViewOf(CNSocket *sock) {
     INITSTRUCT(sP_FE2CL_TRANSPORTATION_ENTER, pkt);
 
     // TODO: Potentially decouple this from BaseNPC?
-    pkt.AppearanceData = {
-        3, id, type,
-        x, y, z
-    };
-
+    pkt.AppearanceData = getTransportationAppearanceData();
     sock->sendPacket(pkt, P_FE2CL_TRANSPORTATION_ENTER);
 }
 
@@ -75,12 +78,22 @@ void Egg::enterIntoViewOf(CNSocket *sock) {
     INITSTRUCT(sP_FE2CL_SHINY_ENTER, pkt);
 
     // TODO: Potentially decouple this from BaseNPC?
-    pkt.ShinyAppearanceData = {
+    pkt.ShinyAppearanceData = getShinyAppearanceData();
+    sock->sendPacket(pkt, P_FE2CL_SHINY_ENTER);
+}
+
+sTransportationAppearanceData Bus::getTransportationAppearanceData() {
+    return sTransportationAppearanceData {
+        3, id, type,
+        x, y, z
+    };
+}
+
+sShinyAppearanceData Egg::getShinyAppearanceData() {
+    return sShinyAppearanceData {
         id, type, 0, // client doesn't care about map num
         x, y, z
     };
-
-    sock->sendPacket(pkt, P_FE2CL_SHINY_ENTER);
 }
 
 sNano* Player::getActiveNano() {

src/Entities.hpp

@@ -47,7 +47,8 @@ public:
     virtual bool addBuff(int, BuffCallback<int, BuffStack*>, BuffCallback<time_t>, BuffStack*) = 0;
     virtual Buff* getBuff(int) = 0;
     virtual void removeBuff(int) = 0;
-    virtual void removeBuff(int, int) = 0;
+    virtual void removeBuff(int, BuffClass) = 0;
+    virtual void clearBuffs(bool) = 0;
     virtual bool hasBuff(int) = 0;
     virtual int getCompositeCondition() = 0;
     virtual int takeDamage(EntityRef, int) = 0;
@@ -72,7 +73,6 @@ public:
     int type;
     int hp;
     int angle;
-    int cbf;
     bool loopingPath = false;
 
     BaseNPC(int _A, uint64_t iID, int t, int _id) {
@@ -80,7 +80,6 @@ public:
         type = t;
         hp = 400;
         angle = _A;
-        cbf = 0;
         id = _id;
         instanceID = iID;
     };
@@ -88,7 +87,7 @@ public:
     virtual void enterIntoViewOf(CNSocket *sock) override;
     virtual void disappearFromViewOf(CNSocket *sock) override;
 
-    sNPCAppearanceData getAppearanceData();
+    virtual sNPCAppearanceData getAppearanceData();
 };
 
 struct CombatNPC : public BaseNPC, public ICombatant {
@@ -105,11 +104,13 @@ struct CombatNPC : public BaseNPC, public ICombatant {
     std::map<AIState, void (*)(CombatNPC*, time_t)> stateHandlers;
     std::map<AIState, void (*)(CombatNPC*, EntityRef)> transitionHandlers;
 
-    CombatNPC(int x, int y, int z, int angle, uint64_t iID, int t, int id, int maxHP)
+    std::unordered_map<int, Buff*> buffs = {};
+
+    CombatNPC(int spawnX, int spawnY, int spawnZ, int angle, uint64_t iID, int t, int id, int maxHP)
         : BaseNPC(angle, iID, t, id), maxHealth(maxHP) {
-        spawnX = x;
-        spawnY = y;
-        spawnZ = z;
+        this->spawnX = spawnX;
+        this->spawnY = spawnY;
+        this->spawnZ = spawnZ;
 
         kind = EntityKind::COMBAT_NPC;
 
@@ -117,12 +118,15 @@ struct CombatNPC : public BaseNPC, public ICombatant {
         transitionHandlers[AIState::INACTIVE] = {};
     }
 
+    virtual sNPCAppearanceData getAppearanceData() override;
+
     virtual bool isExtant() override { return hp > 0; }
 
     virtual bool addBuff(int buffId, BuffCallback<int, BuffStack*> onUpdate, BuffCallback<time_t> onTick, BuffStack* stack) override;
     virtual Buff* getBuff(int buffId) override;
     virtual void removeBuff(int buffId) override;
-    virtual void removeBuff(int buffId, int buffClass) override;
+    virtual void removeBuff(int buffId, BuffClass buffClass) override;
+    virtual void clearBuffs(bool force) override;
     virtual bool hasBuff(int buffId) override;
     virtual int getCompositeCondition() override;
     virtual int takeDamage(EntityRef src, int amt) override;
@@ -157,6 +161,8 @@ struct Egg : public BaseNPC {
 
     virtual void enterIntoViewOf(CNSocket *sock) override;
     virtual void disappearFromViewOf(CNSocket *sock) override;
+
+    sShinyAppearanceData getShinyAppearanceData();
 };
 
 struct Bus : public BaseNPC {
@@ -168,4 +174,6 @@ struct Bus : public BaseNPC {
 
     virtual void enterIntoViewOf(CNSocket *sock) override;
     virtual void disappearFromViewOf(CNSocket *sock) override;
+
+    sTransportationAppearanceData getTransportationAppearanceData();
 };

src/Groups.cpp

@@ -64,6 +64,9 @@ static void attachGroupData(std::vector<EntityRef>& pcs, std::vector<EntityRef>&
 }
 
 void Groups::addToGroup(Group* group, EntityRef member) {
+    if (group == nullptr)
+        return;
+
     if (member.kind == EntityKind::PLAYER) {
         Player* plr = PlayerManager::getPlayer(member.sock);
         plr->group = group;
@@ -84,8 +87,8 @@ void Groups::addToGroup(Group* group, EntityRef member) {
         size_t pcCount = pcs.size();
         size_t npcCount = npcs.size();
 
-        uint8_t respbuf[CN_PACKET_BUFFER_SIZE];
-        memset(respbuf, 0, CN_PACKET_BUFFER_SIZE);
+        uint8_t respbuf[CN_PACKET_BODY_SIZE];
+        memset(respbuf, 0, CN_PACKET_BODY_SIZE);
         sP_FE2CL_PC_GROUP_JOIN* pkt = (sP_FE2CL_PC_GROUP_JOIN*)respbuf;
 
         pkt->iID_NewMember = PlayerManager::getPlayer(member.sock)->iID;
@@ -109,6 +112,9 @@ void Groups::addToGroup(Group* group, EntityRef member) {
 }
 
 bool Groups::removeFromGroup(Group* group, EntityRef member) {
+    if (group == nullptr)
+        return false;
+
     if (member.kind == EntityKind::PLAYER) {
         Player* plr = PlayerManager::getPlayer(member.sock);
         plr->group = nullptr; // no dangling pointers here muahaahahah
@@ -137,8 +143,8 @@ bool Groups::removeFromGroup(Group* group, EntityRef member) {
         size_t pcCount = pcs.size();
         size_t npcCount = npcs.size();
 
-        uint8_t respbuf[CN_PACKET_BUFFER_SIZE];
-        memset(respbuf, 0, CN_PACKET_BUFFER_SIZE);
+        uint8_t respbuf[CN_PACKET_BODY_SIZE];
+        memset(respbuf, 0, CN_PACKET_BODY_SIZE);
         sP_FE2CL_PC_GROUP_LEAVE* pkt = (sP_FE2CL_PC_GROUP_LEAVE*)respbuf;
 
         pkt->iID_LeaveMember = PlayerManager::getPlayer(member.sock)->iID;
@@ -168,6 +174,9 @@ bool Groups::removeFromGroup(Group* group, EntityRef member) {
 }
 
 void Groups::disbandGroup(Group* group) {
+    if (group == nullptr)
+        return;
+
     // remove everyone from the group!!
     bool done = false;
     while(!done) {
@@ -252,6 +261,9 @@ static void leaveGroup(CNSocket* sock, CNPacketData* data) {
 }
 
 void Groups::sendToGroup(Group* group, void* buf, uint32_t type, size_t size) {
+    if (group == nullptr)
+        return;
+
     auto players = group->filter(EntityKind::PLAYER);
     for (EntityRef ref : players) {
         ref.sock->sendPacket(buf, type, size);
@@ -259,6 +271,9 @@ void Groups::sendToGroup(Group* group, void* buf, uint32_t type, size_t size) {
 }
 
 void Groups::sendToGroup(Group* group, EntityRef excluded, void* buf, uint32_t type, size_t size) {
+    if (group == nullptr)
+        return;
+
     auto players = group->filter(EntityKind::PLAYER);
     for (EntityRef ref : players) {
         if(ref != excluded) ref.sock->sendPacket(buf, type, size);
@@ -273,8 +288,8 @@ void Groups::groupTickInfo(CNSocket* sock) {
     size_t pcCount = pcs.size();
     size_t npcCount = npcs.size();
 
-    uint8_t respbuf[CN_PACKET_BUFFER_SIZE];
-    memset(respbuf, 0, CN_PACKET_BUFFER_SIZE);
+    uint8_t respbuf[CN_PACKET_BODY_SIZE];
+    memset(respbuf, 0, CN_PACKET_BODY_SIZE);
     sP_FE2CL_PC_GROUP_MEMBER_INFO* pkt = (sP_FE2CL_PC_GROUP_MEMBER_INFO*)respbuf;
 
     pkt->iID = plr->iID;
@@ -294,6 +309,9 @@ void Groups::groupTickInfo(CNSocket* sock) {
 
 void Groups::groupKick(Group* group, EntityRef ref) {
 
+    if (group == nullptr)
+        return;
+
     // if you are the group leader, destroy your own group and kick everybody
     if (group->members[0] == ref) {
         disbandGroup(group);

src/Groups.hpp

@@ -3,6 +3,7 @@
 #include "EntityRef.hpp"
 
 #include <vector>
+#include <assert.h>
 
 struct Group {
     std::vector<EntityRef> members;
@@ -14,6 +15,10 @@ struct Group {
             });
         return filtered;
     }
+    EntityRef getLeader() {
+        assert(members.size() > 0);
+        return members[0];
+    }
 
     Group(EntityRef leader);
 };

src/Items.cpp

@@ -46,7 +46,7 @@ static void nanoCapsuleHandler(CNSocket* sock, int slot, sItemBase *chest) {
 
     // in order to remove capsule form inventory, we have to send item reward packet with empty item
     const size_t resplen = sizeof(sP_FE2CL_REP_REWARD_ITEM) + sizeof(sItemReward);
-    assert(resplen < CN_PACKET_BUFFER_SIZE - 8);
+    assert(resplen < CN_PACKET_BODY_SIZE);
 
     // we know it's only one trailing struct, so we can skip full validation
     uint8_t respbuf[resplen]; // not a variable length array, don't worry
@@ -416,6 +416,9 @@ static void itemDeleteHandler(CNSocket* sock, CNPacketData* data) {
 
     Player* plr = PlayerManager::getPlayer(sock);
 
+    if (itemdel->iSlotNum < 0 || itemdel->iSlotNum >= AINVEN_COUNT)
+        return; // sanity check
+
     resp.eIL = itemdel->eIL;
     resp.iSlotNum = itemdel->iSlotNum;
 
@@ -472,8 +475,8 @@ static void itemUseHandler(CNSocket* sock, CNPacketData* data) {
     if (gumball.iOpt == 0)
         gumball = {};
 
-    uint8_t respbuf[CN_PACKET_BUFFER_SIZE];
-    memset(respbuf, 0, resplen);
+    uint8_t respbuf[CN_PACKET_BODY_SIZE];
+    memset(respbuf, 0, CN_PACKET_BODY_SIZE);
 
     sP_FE2CL_REP_PC_ITEM_USE_SUCC *resp = (sP_FE2CL_REP_PC_ITEM_USE_SUCC*)respbuf;
     sSkillResult_Buff *respdata = (sSkillResult_Buff*)(respbuf+sizeof(sP_FE2CL_NANO_SKILL_USE_SUCC));
@@ -482,7 +485,7 @@ static void itemUseHandler(CNSocket* sock, CNPacketData* data) {
     resp->iSlotNum = request->iSlotNum;
     resp->RemainItem = gumball;
     resp->iTargetCnt = 1;
-    resp->eST = EST_NANOSTIMPAK;
+    resp->eST = (int32_t)SkillType::NANOSTIMPAK;
     resp->iSkillID = 144;
 
     int eCSB = ECSB_STIMPAKSLOT1 + request->iNanoSlot;
@@ -553,7 +556,7 @@ static void chestOpenHandler(CNSocket *sock, CNPacketData *data) {
 
     // item giving packet
     const size_t resplen = sizeof(sP_FE2CL_REP_REWARD_ITEM) + sizeof(sItemReward);
-    assert(resplen < CN_PACKET_BUFFER_SIZE - 8);
+    assert(resplen < CN_PACKET_BODY_SIZE);
     // we know it's only one trailing struct, so we can skip full validation
 
     uint8_t respbuf[resplen]; // not a variable length array, don't worry
@@ -642,7 +645,7 @@ void Items::checkItemExpire(CNSocket* sock, Player* player) {
     */
 
     const size_t resplen = sizeof(sP_FE2CL_PC_DELETE_TIME_LIMIT_ITEM) + sizeof(sTimeLimitItemDeleteInfo2CL);
-    assert(resplen < CN_PACKET_BUFFER_SIZE - 8);
+    assert(resplen < CN_PACKET_BODY_SIZE);
     // we know it's only one trailing struct, so we can skip full validation
     uint8_t respbuf[resplen]; // not a variable length array, don't worry
     auto packet = (sP_FE2CL_PC_DELETE_TIME_LIMIT_ITEM*)respbuf;
@@ -712,7 +715,7 @@ static void giveSingleDrop(CNSocket *sock, Mob* mob, int mobDropId, const DropRo
     Player *plr = PlayerManager::getPlayer(sock);
 
     const size_t resplen = sizeof(sP_FE2CL_REP_REWARD_ITEM) + sizeof(sItemReward);
-    assert(resplen < CN_PACKET_BUFFER_SIZE - 8);
+    assert(resplen < CN_PACKET_BODY_SIZE);
     // we know it's only one trailing struct, so we can skip full validation
 
     uint8_t respbuf[resplen]; // not a variable length array, don't worry

src/Missions.cpp

@@ -64,7 +64,7 @@ static bool isQuestItemFull(CNSocket* sock, int itemId, int itemCount) {
 static void dropQuestItem(CNSocket *sock, int task, int count, int id, int mobid) {
     std::cout << "Altered item id " << id << " by " << count << " for task id " << task << std::endl;
     const size_t resplen = sizeof(sP_FE2CL_REP_REWARD_ITEM) + sizeof(sItemReward);
-    assert(resplen < CN_PACKET_BUFFER_SIZE);
+    assert(resplen < CN_PACKET_BODY_SIZE);
     // we know it's only one trailing struct, so we can skip full validation
 
     Player *plr = PlayerManager::getPlayer(sock);
@@ -152,14 +152,14 @@ static int giveMissionReward(CNSocket *sock, int task, int choice=0) {
         plr->Inven[slots[i]] = { 999, 999, 999, 0 }; // temp item; overwritten later
     }
 
-    uint8_t respbuf[CN_PACKET_BUFFER_SIZE];
+    uint8_t respbuf[CN_PACKET_BODY_SIZE];
     size_t resplen = sizeof(sP_FE2CL_REP_REWARD_ITEM) + nrewards * sizeof(sItemReward);
-    assert(resplen < CN_PACKET_BUFFER_SIZE);
+    assert(resplen < CN_PACKET_BODY_SIZE);
     sP_FE2CL_REP_REWARD_ITEM *resp = (sP_FE2CL_REP_REWARD_ITEM *)respbuf;
     sItemReward *item = (sItemReward *)(respbuf + sizeof(sP_FE2CL_REP_REWARD_ITEM));
 
     // don't forget to zero the buffer!
-    memset(respbuf, 0, resplen);
+    memset(respbuf, 0, CN_PACKET_BODY_SIZE);
 
     // update player
     plr->money += reward->money;
@@ -386,6 +386,9 @@ static void taskStart(CNSocket* sock, CNPacketData* data) {
 static void taskEnd(CNSocket* sock, CNPacketData* data) {
     sP_CL2FE_REQ_PC_TASK_END* missionData = (sP_CL2FE_REQ_PC_TASK_END*)data->buf;
 
+    if (Missions::Tasks.find(missionData->iTaskNum) == Missions::Tasks.end())
+        return;
+
     TaskData* task = Missions::Tasks[missionData->iTaskNum];
 
     // handle timed mission failure

src/MobAI.cpp

@@ -51,13 +51,13 @@ int Mob::takeDamage(EntityRef src, int amt) {
     }
 
     // wake up sleeping monster
-    if (cbf & CSB_BIT_MEZ) {
-        cbf &= ~CSB_BIT_MEZ;
+    if (hasBuff(ECSB_MEZ)) {
+        removeBuff(ECSB_MEZ);
 
         INITSTRUCT(sP_FE2CL_CHAR_TIME_BUFF_TIME_OUT, pkt1);
         pkt1.eCT = 2;
         pkt1.iID = id;
-        pkt1.iConditionBitFlag = cbf;
+        pkt1.iConditionBitFlag = getCompositeCondition();
         NPCManager::sendToViewable(this, &pkt1, P_FE2CL_CHAR_TIME_BUFF_TIME_OUT, sizeof(sP_FE2CL_CHAR_TIME_BUFF_TIME_OUT));
     }
 
@@ -96,13 +96,12 @@ static std::pair<int,int> lerp(int x1, int y1, int x2, int y2, int speed) {
 
 void MobAI::clearDebuff(Mob *mob) {
     mob->skillStyle = -1;
-    mob->cbf = 0;
-    mob->unbuffTimes.clear();
+    mob->clearBuffs(false);
 
     INITSTRUCT(sP_FE2CL_CHAR_TIME_BUFF_TIME_OUT, pkt1);
     pkt1.eCT = 2;
     pkt1.iID = mob->id;
-    pkt1.iConditionBitFlag = mob->cbf;
+    pkt1.iConditionBitFlag = mob->getCompositeCondition();
     NPCManager::sendToViewable(mob, &pkt1, P_FE2CL_CHAR_TIME_BUFF_TIME_OUT, sizeof(sP_FE2CL_CHAR_TIME_BUFF_TIME_OUT));
 }
 
@@ -228,7 +227,7 @@ bool MobAI::aggroCheck(Mob *mob, time_t currTime) {
     return false;
 }
 
-static void dealCorruption(Mob *mob, std::vector<int> targetData, int skillID, int style) {
+static void dealCorruption(Mob *mob, std::vector<int> targetData, int skillID, int mobStyle) {
     Player *plr = PlayerManager::getPlayer(mob->target);
 
     size_t resplen = sizeof(sP_FE2CL_NPC_SKILL_CORRUPTION_HIT) + targetData[0] * sizeof(sCAttackResult);
@@ -239,15 +238,15 @@ static void dealCorruption(Mob *mob, std::vector<int> targetData, int skillID, i
         return;
     }
 
-    uint8_t respbuf[CN_PACKET_BUFFER_SIZE];
-    memset(respbuf, 0, resplen);
+    uint8_t respbuf[CN_PACKET_BODY_SIZE];
+    memset(respbuf, 0, CN_PACKET_BODY_SIZE);
 
     sP_FE2CL_NPC_SKILL_CORRUPTION_HIT *resp = (sP_FE2CL_NPC_SKILL_CORRUPTION_HIT*)respbuf;
     sCAttackResult *respdata = (sCAttackResult*)(respbuf+sizeof(sP_FE2CL_NPC_SKILL_CORRUPTION_HIT));
 
     resp->iNPC_ID = mob->id;
     resp->iSkillID = skillID;
-    resp->iStyle = style;
+    resp->iStyle = mobStyle;
     resp->iValue1 = plr->x;
     resp->iValue2 = plr->y;
     resp->iValue3 = plr->z;
@@ -281,26 +280,38 @@ static void dealCorruption(Mob *mob, std::vector<int> targetData, int skillID, i
                 respdata[i].iActiveNanoSlotNum = n;
         respdata[i].iNanoID = plr->activeNano;
 
-        int style2 = Nanos::nanoStyle(plr->activeNano);
-        if (style2 == -1) { // no nano
+        int nanoStyle = Nanos::nanoStyle(plr->activeNano);
+        if (nanoStyle == -1) { // no nano
             respdata[i].iHitFlag = HF_BIT_STYLE_TIE;
             respdata[i].iDamage = Abilities::SkillTable[skillID].values[0][0] * PC_MAXHEALTH((int)mob->data["m_iNpcLevel"]) / 1500;
-        } else if (style == style2) {
+        } else if (mobStyle == nanoStyle) {
             respdata[i].iHitFlag = HF_BIT_STYLE_TIE;
             respdata[i].iDamage = 0;
             respdata[i].iNanoStamina = plr->Nanos[plr->activeNano].iStamina;
-        } else if (style - style2 == 1 || style2 - style == 2) {
+        } else if (mobStyle - nanoStyle == 1 || nanoStyle - mobStyle == 2) {
             respdata[i].iHitFlag = HF_BIT_STYLE_WIN;
             respdata[i].iDamage = 0;
             respdata[i].iNanoStamina = plr->Nanos[plr->activeNano].iStamina += 45;
             if (plr->Nanos[plr->activeNano].iStamina > 150)
                 respdata[i].iNanoStamina = plr->Nanos[plr->activeNano].iStamina = 150;
             // fire damage power disguised as a corruption attack back at the enemy
-            // TODO ABILITIES
-            /*std::vector<int> targetData2 = {1, mob->id, 0, 0, 0};
-            for (auto& pwr : Abilities::Powers)
-                if (pwr.skillType == EST_DAMAGE)
-                    pwr.handle(sock, targetData2, plr->activeNano, skillID, 0, 200);*/
+            SkillData skill = {
+                SkillType::DAMAGE, // skillType
+                SkillEffectTarget::POINT, // effectTarget
+                1, // effectType
+                SkillTargetType::MOBS, // targetType
+                SkillDrainType::ACTIVE, // drainType
+                0, // effectArea
+                {0, 0, 0, 0}, // batteryUse
+                {0, 0, 0, 0}, // durationTime
+                {0, 0, 0}, // valueTypes (unused)
+                {
+                    {200, 200, 200, 200},
+                    {200, 200, 200, 200},
+                    {200, 200, 200, 200},
+                }
+            };
+            Abilities::useNanoSkill(sock, &skill, *plr->getActiveNano(), { mob });
         } else {
             respdata[i].iHitFlag = HF_BIT_STYLE_LOSE;
             respdata[i].iDamage = Abilities::SkillTable[skillID].values[0][0] * PC_MAXHEALTH((int)mob->data["m_iNpcLevel"]) / 1500;
@@ -327,12 +338,6 @@ static void dealCorruption(Mob *mob, std::vector<int> targetData, int skillID, i
 }
 
 static void useAbilities(Mob *mob, time_t currTime) {
-    /*
-     * targetData approach
-     * first integer is the count
-     * second to fifth integers are IDs, these can be either player iID or mob's iID
-     * whether the skill targets players or mobs is determined by the skill packet being fired
-     */
     Player *plr = PlayerManager::getPlayer(mob->target);
 
     if (mob->skillStyle >= 0) { // corruption hit
@@ -347,7 +352,7 @@ static void useAbilities(Mob *mob, time_t currTime) {
 
     if (mob->skillStyle == -2) { // eruption hit
         int skillID = (int)mob->data["m_iMegaType"];
-        std::vector<int> targetData = {0, 0, 0, 0, 0};
+        std::vector<ICombatant*> targets{};
 
         // find the players within range of eruption
         for (auto it = mob->viewableChunks.begin(); it != mob->viewableChunks.end(); it++) {
@@ -357,26 +362,22 @@ static void useAbilities(Mob *mob, time_t currTime) {
                 if (ref.kind != EntityKind::PLAYER)
                     continue;
 
-                CNSocket *s= ref.sock;
+                CNSocket *s = ref.sock;
                 Player *plr = PlayerManager::getPlayer(s);
 
-                if (plr->HP <= 0)
+                if (!plr->isAlive())
                     continue;
 
                 int distance = hypot(mob->hitX - plr->x, mob->hitY - plr->y);
                 if (distance < Abilities::SkillTable[skillID].effectArea) {
-                    targetData[0] += 1;
-                    targetData[targetData[0]] = plr->iID;
-                    if (targetData[0] > 3) // make sure not to have more than 4
+                    targets.push_back(plr);
+                    if (targets.size() > 3) // make sure not to have more than 4
                         break;
                 }
             }
         }
 
-        // TODO ABILITIES
-        /*for (auto& pwr : Abilities::Powers)
-            if (pwr.skillType == Abilities::SkillTable[skillID].skillType)
-                pwr.handle(mob->id, targetData, skillID, Abilities::SkillTable[skillID].durationTime[0], Abilities::SkillTable[skillID].powerIntensity[0]);*/
+        Abilities::useNPCSkill(mob->id, skillID, targets);
         mob->skillStyle = -3; // eruption cooldown
         mob->nextAttack = currTime + 1000;
         return;
@@ -394,14 +395,11 @@ static void useAbilities(Mob *mob, time_t currTime) {
 
     if (random < prob1) { // active skill hit
         int skillID = (int)mob->data["m_iActiveSkill1"];
-        // TODO ABILITIES
-        //std::vector<int> targetData = {1, plr->iID, 0, 0, 0};
-        //for (auto& pwr : Abilities::Powers)
-        //    if (pwr.skillType == Abilities::SkillTable[skillID].skillType) {
-        //        if (pwr.bitFlag != 0 && (plr->iConditionBitFlag & pwr.bitFlag))
-        //            return; // prevent debuffing a player twice
-        //        pwr.handle(mob->id, targetData, skillID, Abilities::SkillTable[skillID].durationTime[0], Abilities::SkillTable[skillID].powerIntensity[0]);
-        //    }
+        SkillData* skill = &Abilities::SkillTable[skillID];
+        int debuffID = Abilities::getCSTBFromST(skill->skillType);
+        if(plr->hasBuff(debuffID))
+            return; // prevent debuffing a player twice
+        Abilities::useNPCSkill(mob->getRef(), skillID, { plr });
         mob->nextAttack = currTime + (int)mob->data["m_iDelayTime"] * 100;
         return;
     }
@@ -442,31 +440,6 @@ static void useAbilities(Mob *mob, time_t currTime) {
     return;
 }
 
-static void drainMobHP(Mob *mob, int amount) {
-    size_t resplen = sizeof(sP_FE2CL_CHAR_TIME_BUFF_TIME_TICK) + sizeof(sSkillResult_Damage);
-    assert(resplen < CN_PACKET_BUFFER_SIZE - 8);
-    uint8_t respbuf[CN_PACKET_BUFFER_SIZE];
-
-    memset(respbuf, 0, resplen);
-
-    sP_FE2CL_CHAR_TIME_BUFF_TIME_TICK *pkt = (sP_FE2CL_CHAR_TIME_BUFF_TIME_TICK*)respbuf;
-    sSkillResult_Damage *drain = (sSkillResult_Damage*)(respbuf + sizeof(sP_FE2CL_CHAR_TIME_BUFF_TIME_TICK));
-
-    pkt->iID = mob->id;
-    pkt->eCT = 4; // mob
-    pkt->iTB_ID = ECSB_BOUNDINGBALL;
-
-    drain->eCT = 4;
-    drain->iID = mob->id;
-    drain->iDamage = amount;
-    drain->iHP = mob->hp -= amount;
-
-    NPCManager::sendToViewable(mob, (void*)&respbuf, P_FE2CL_CHAR_TIME_BUFF_TIME_TICK, resplen);
-
-    if (mob->hp <= 0)
-        mob->transition(AIState::DEAD, mob->target);
-}
-
 void MobAI::incNextMovement(Mob* mob, time_t currTime) {
     if (currTime == 0)
         currTime = getTime();
@@ -505,6 +478,14 @@ void MobAI::deadStep(CombatNPC* npc, time_t currTime) {
     if (self->groupLeader == self->id)
         roamingStep(self, currTime);
 
+    /*
+     * If the mob hasn't fully despanwed yet, don't try to respawn it. This protects
+     * against the edge case where mobs with a very short regenTime would try to respawn
+     * before they've faded away; and would respawn even if they were meant to be removed.
+     */
+    if (!self->despawned)
+        return;
+
     if (self->killedTime != 0 && currTime - self->killedTime < self->regenTime * 100)
         return;
 
@@ -553,38 +534,27 @@ void MobAI::combatStep(CombatNPC* npc, time_t currTime) {
         return;
     }
 
-    // drain
-    if (self->skillStyle < 0 && (self->lastDrainTime == 0 || currTime - self->lastDrainTime >= 1000)
-        && self->cbf & CSB_BIT_BOUNDINGBALL) {
-        drainMobHP(self, self->maxHealth / 20); // lose 5% every second
-        self->lastDrainTime = currTime;
-    }
+    // tick buffs
+    auto it = npc->buffs.begin();
+    while(it != npc->buffs.end()) {
+        Buff* buff = (*it).second;
+        buff->combatTick(currTime);
 
-    // if drain killed the mob, return early
-    if (self->hp <= 0)
-        return;
+        // if mob state changed, end the step
+        if(self->state != AIState::COMBAT)
+            return;
 
-    // unbuffing
-    std::unordered_map<int32_t, time_t>::iterator it = self->unbuffTimes.begin();
-    while (it != self->unbuffTimes.end()) {
-
-        if (currTime >= it->second) {
-            self->cbf &= ~it->first;
-
-            INITSTRUCT(sP_FE2CL_CHAR_TIME_BUFF_TIME_OUT, pkt1);
-            pkt1.eCT = 2;
-            pkt1.iID = self->id;
-            pkt1.iConditionBitFlag = self->cbf;
-            NPCManager::sendToViewable(self, &pkt1, P_FE2CL_CHAR_TIME_BUFF_TIME_OUT, sizeof(sP_FE2CL_CHAR_TIME_BUFF_TIME_OUT));
-
-            it = self->unbuffTimes.erase(it);
-        } else {
-            it++;
+        buff->tick(currTime);
+        if(buff->isStale()) {
+            // garbage collect
+            it = npc->buffs.erase(it);
+            delete buff;
         }
+        else it++;
     }
 
     // skip attack if stunned or asleep
-    if (self->cbf & (CSB_BIT_STUN|CSB_BIT_MEZ)) {
+    if (self->hasBuff(ECSB_STUN) || self->hasBuff(ECSB_MEZ)) {
         self->skillStyle = -1; // in this case we also reset the any outlying abilities the mob might be winding up.
         return;
     }
@@ -600,6 +570,7 @@ void MobAI::combatStep(CombatNPC* npc, time_t currTime) {
     }
 
     int distanceToTravel = INT_MAX;
+    int speed = self->speed;
     // movement logic: move when out of range but don't move while casting a skill
     if (distance > mobRange && self->skillStyle == -1) {
         if (self->nextMovement != 0 && currTime < self->nextMovement)
@@ -609,8 +580,8 @@ void MobAI::combatStep(CombatNPC* npc, time_t currTime) {
             self->nextAttack = 0;
 
         // halve movement speed if snared
-        if (self->cbf & CSB_BIT_DN_MOVE_SPEED)
-            self->speed /= 2;
+        if (self->hasBuff(ECSB_DN_MOVE_SPEED))
+            speed /= 2;
 
         int targetX = plr->x;
         int targetY = plr->y;
@@ -619,9 +590,9 @@ void MobAI::combatStep(CombatNPC* npc, time_t currTime) {
             targetY += self->offsetY*distance/(self->idleRange + 1);
         }
 
-        distanceToTravel = std::min(distance-mobRange+1, self->speed*2/5);
+        distanceToTravel = std::min(distance-mobRange+1, speed*2/5);
         auto targ = lerp(self->x, self->y, targetX, targetY, distanceToTravel);
-        if (distanceToTravel < self->speed*2/5 && currTime >= self->nextAttack)
+        if (distanceToTravel < speed*2/5 && currTime >= self->nextAttack)
             self->nextAttack = 0;
 
         NPCManager::updateNPCPosition(self->id, targ.first, targ.second, self->z, self->instanceID, self->angle);
@@ -629,7 +600,7 @@ void MobAI::combatStep(CombatNPC* npc, time_t currTime) {
         INITSTRUCT(sP_FE2CL_NPC_MOVE, pkt);
 
         pkt.iNPC_ID = self->id;
-        pkt.iSpeed = self->speed;
+        pkt.iSpeed = speed;
         pkt.iToX = self->x = targ.first;
         pkt.iToY = self->y = targ.second;
         pkt.iToZ = plr->z;
@@ -715,7 +686,7 @@ void MobAI::roamingStep(CombatNPC* npc, time_t currTime) {
     farY = std::clamp(farY, yStart, yStart + self->idleRange);
 
     // halve movement speed if snared
-    if (self->cbf & CSB_BIT_DN_MOVE_SPEED)
+    if (self->hasBuff(ECSB_DN_MOVE_SPEED))
         self->speed /= 2;
 
     std::queue<Vec3> queue;
@@ -788,14 +759,10 @@ void MobAI::onRoamStart(CombatNPC* npc, EntityRef src) {
     self->hp = self->maxHealth;
     self->killedTime = 0;
     self->nextAttack = 0;
-    self->cbf = 0;
 
     // cast a return home heal spell, this is the right way(tm)
-    // TODO ABILITIES
-    /*std::vector<int> targetData = { 1, 0, 0, 0, 0 };
-    for (auto& pwr : Abilities::Powers)
-        if (pwr.skillType == Abilities::SkillTable[110].skillType)
-            pwr.handle(self->id, targetData, 110, Abilities::SkillTable[110].durationTime[0], Abilities::SkillTable[110].powerIntensity[0]);*/
+    Abilities::useNPCSkill(npc->getRef(), 110, { npc });
+
     // clear outlying debuffs
     clearDebuff(self);
 }
@@ -812,12 +779,9 @@ void MobAI::onCombatStart(CombatNPC* npc, EntityRef src) {
     self->roamY = self->y;
     self->roamZ = self->z;
 
-    int skillID = (int)self->data["m_iPassiveBuff"]; // cast passive
-    // TODO ABILITIES
-    /*std::vector<int> targetData = { 1, self->id, 0, 0, 0 };
-    for (auto& pwr : Abilities::Powers)
-        if (pwr.skillType == Abilities::SkillTable[skillID].skillType)
-            pwr.handle(self->id, targetData, skillID, Abilities::SkillTable[skillID].durationTime[0], Abilities::SkillTable[skillID].powerIntensity[0]);*/
+    int skillID = (int)self->data["m_iPassiveBuff"];
+    if(skillID != 0) // cast passive
+        Abilities::useNPCSkill(npc->getRef(), skillID, { npc });
 }
 
 void MobAI::onRetreat(CombatNPC* npc, EntityRef src) {
@@ -833,9 +797,8 @@ void MobAI::onDeath(CombatNPC* npc, EntityRef src) {
     Mob* self = (Mob*)npc;
 
     self->target = nullptr;
-    self->cbf = 0;
     self->skillStyle = -1;
-    self->unbuffTimes.clear();
+    self->clearBuffs(true);
     self->killedTime = getTime(); // XXX: maybe introduce a shard-global time for each step?
 
     // check for the edge case where hitting the mob did not aggro it

src/MobAI.hpp

@@ -21,8 +21,6 @@ namespace MobAI {
 }
 
 struct Mob : public CombatNPC {
-    // general
-    std::unordered_map<int32_t,time_t> unbuffTimes = {};
 
     // dead
     time_t killedTime = 0;
@@ -52,8 +50,8 @@ struct Mob : public CombatNPC {
     // temporary; until we're sure what's what
     nlohmann::json data = {};
 
-    Mob(int x, int y, int z, int angle, uint64_t iID, int t, nlohmann::json d, int32_t id)
-        : CombatNPC(x, y, z, angle, iID, t, id, d["m_iHP"]),
+    Mob(int spawnX, int spawnY, int spawnZ, int angle, uint64_t iID, int t, nlohmann::json d, int32_t id)
+        : CombatNPC(spawnX, spawnY, spawnZ, angle, iID, t, id, d["m_iHP"]),
           sightRange(d["m_iSightRange"]) {
         state = AIState::ROAMING;
 
@@ -64,15 +62,13 @@ struct Mob : public CombatNPC {
         idleRange = (int)data["m_iIdleRange"];
         level = data["m_iNpcLevel"];
 
-        roamX = x;
-        roamY = y;
-        roamZ = z;
+        roamX = spawnX;
+        roamY = spawnY;
+        roamZ = spawnZ;
 
         offsetX = 0;
         offsetY = 0;
 
-        cbf = 0;
-
         // NOTE: there appear to be discrepancies in the dump
         hp = maxHealth;
 

src/NPCManager.cpp

@@ -94,20 +94,49 @@ void NPCManager::sendToViewable(Entity *npc, void *buf, uint32_t type, size_t si
 static void npcBarkHandler(CNSocket* sock, CNPacketData* data) {
     sP_CL2FE_REQ_BARKER* req = (sP_CL2FE_REQ_BARKER*)data->buf;
 
-    // get bark IDs from task data
-    TaskData* td = Missions::Tasks[req->iMissionTaskID];
-    std::vector<int> barks;
-    for (int i = 0; i < 4; i++) {
-        if (td->task["m_iHBarkerTextID"][i] != 0) // non-zeroes only
-            barks.push_back(td->task["m_iHBarkerTextID"][i]);
+    int taskID = req->iMissionTaskID;
+    // ignore req->iNPC_ID as it is often fixated on a single npc in the region
+
+    if (Missions::Tasks.find(taskID) == Missions::Tasks.end()) {
+        std::cout << "mission task not found: " << taskID << std::endl;
+        return;
     }
 
-    if (barks.empty())
-        return; // no barks
+    TaskData* td = Missions::Tasks[taskID];
+    auto& barks = td->task["m_iHBarkerTextID"];
+
+    Player* plr = PlayerManager::getPlayer(sock);
+    std::vector<std::pair<int32_t, int32_t>> npcLines;
+
+    for (Chunk* chunk : plr->viewableChunks) {
+        for (auto ent = chunk->entities.begin(); ent != chunk->entities.end(); ent++) {
+            if (ent->kind != EntityKind::SIMPLE_NPC)
+                continue;
+
+            BaseNPC* npc = (BaseNPC*)ent->getEntity();
+            if (npc->type < 0 || npc->type >= NPCData.size())
+                continue; // npc unknown ?!
+
+            int barkType = NPCData[npc->type]["m_iBarkerType"];
+            if (barkType < 1 || barkType > 4)
+                continue; // no barks
+
+            int barkID = barks[barkType - 1];
+            if (barkID == 0)
+                continue; // no barks
+
+            npcLines.push_back(std::make_pair(npc->id, barkID));
+        }
+    }
+
+    if (npcLines.size() == 0)
+        return; // totally no barks
+
+    auto& [npcID, missionStringID] = npcLines[Rand::rand(npcLines.size())];
 
     INITSTRUCT(sP_FE2CL_REP_BARKER, resp);
-    resp.iNPC_ID = req->iNPC_ID;
-    resp.iMissionStringID = barks[Rand::rand(barks.size())];
+    resp.iNPC_ID = npcID;
+    resp.iMissionStringID = missionStringID;
     sock->sendPacket(resp, P_FE2CL_REP_BARKER);
 }
 
@@ -122,16 +151,15 @@ static void npcUnsummonHandler(CNSocket* sock, CNPacketData* data) {
 }
 
 // type must already be checked and updateNPCPosition() must be called on the result
-BaseNPC *NPCManager::summonNPC(int x, int y, int z, uint64_t instance, int type, bool respawn, bool baseInstance) {
+BaseNPC *NPCManager::summonNPC(int spawnX, int spawnY, int spawnZ, uint64_t instance, int type, bool respawn, bool baseInstance) {
     uint64_t inst = baseInstance ? MAPNUM(instance) : instance;
 
-    //assert(nextId < INT32_MAX);
     int id = nextId--;
     int team = NPCData[type]["m_iTeam"];
     BaseNPC *npc = nullptr;
 
     if (team == 2) {
-        npc = new Mob(x, y, z, inst, type, NPCData[type], id);
+        npc = new Mob(spawnX, spawnY, spawnZ, inst, type, NPCData[type], id);
 
         // re-enable respawning, if desired
         ((Mob*)npc)->summoned = !respawn;
@@ -294,57 +322,55 @@ BaseNPC* NPCManager::getNearestNPC(std::set<Chunk*>* chunks, int X, int Y, int Z
     return npc;
 }
 
-// TODO: Move this to MobAI, possibly
+// TODO: Move this to separate file in ai/ subdir when implementing more events
 #pragma region NPCEvents
 
 // summon right arm and stage 2 body
-static void lordFuseStageTwo(CNSocket *sock, BaseNPC *npc) {
+static void lordFuseStageTwo(CombatNPC *npc) {
     Mob *oldbody = (Mob*)npc; // adaptium, stun
-    Player *plr = PlayerManager::getPlayer(sock);
 
     std::cout << "Lord Fuse stage two" << std::endl;
 
     // Fuse doesn't move
     // Blastons, Heal
-    Mob *newbody = (Mob*)NPCManager::summonNPC(oldbody->x, oldbody->y, oldbody->z, plr->instanceID, 2467);
+    Mob *newbody = (Mob*)NPCManager::summonNPC(oldbody->x, oldbody->y, oldbody->z, oldbody->instanceID, 2467);
 
     newbody->angle = oldbody->angle;
-    NPCManager::updateNPCPosition(newbody->id, newbody->x, newbody->y, newbody->z,
-        plr->instanceID, oldbody->angle);
+    NPCManager::updateNPCPosition(newbody->id, newbody->spawnX, newbody->spawnY, newbody->spawnZ,
+        oldbody->instanceID, oldbody->angle);
 
     // right arm, Adaptium, Stun
-    Mob *arm = (Mob*)NPCManager::summonNPC(oldbody->x - 600, oldbody->y, oldbody->z, plr->instanceID, 2469);
+    Mob *arm = (Mob*)NPCManager::summonNPC(oldbody->x - 600, oldbody->y, oldbody->z, oldbody->instanceID, 2469);
 
     arm->angle = oldbody->angle;
-    NPCManager::updateNPCPosition(arm->id, arm->x, arm->y, arm->z,
-        plr->instanceID, oldbody->angle);
+    NPCManager::updateNPCPosition(arm->id, arm->spawnX, arm->spawnY, arm->spawnZ,
+        oldbody->instanceID, oldbody->angle);
 }
 
 // summon left arm and stage 3 body
-static void lordFuseStageThree(CNSocket *sock, BaseNPC *npc) {
+static void lordFuseStageThree(CombatNPC *npc) {
     Mob *oldbody = (Mob*)npc;
-    Player *plr = PlayerManager::getPlayer(sock);
 
     std::cout << "Lord Fuse stage three" << std::endl;
 
     // Cosmix, Damage Point
-    Mob *newbody = (Mob*)NPCManager::summonNPC(oldbody->x, oldbody->y, oldbody->z, plr->instanceID, 2468);
+    Mob *newbody = (Mob*)NPCManager::summonNPC(oldbody->x, oldbody->y, oldbody->z, oldbody->instanceID, 2468);
 
     newbody->angle = oldbody->angle;
-    NPCManager::updateNPCPosition(newbody->id, newbody->x, newbody->y, newbody->z,
-        plr->instanceID, oldbody->angle);
+    NPCManager::updateNPCPosition(newbody->id, newbody->spawnX, newbody->spawnY, newbody->spawnZ,
+        newbody->instanceID, oldbody->angle);
 
     // Blastons, Heal
-    Mob *arm = (Mob*)NPCManager::summonNPC(oldbody->x + 600, oldbody->y, oldbody->z, plr->instanceID, 2470);
+    Mob *arm = (Mob*)NPCManager::summonNPC(oldbody->x + 600, oldbody->y, oldbody->z, oldbody->instanceID, 2470);
 
     arm->angle = oldbody->angle;
-    NPCManager::updateNPCPosition(arm->id, arm->x, arm->y, arm->z,
-        plr->instanceID, oldbody->angle);
+    NPCManager::updateNPCPosition(arm->id, arm->spawnX, arm->spawnY, arm->spawnZ,
+        arm->instanceID, oldbody->angle);
 }
 
 std::vector<NPCEvent> NPCManager::NPCEvents = {
-    NPCEvent(2466, ON_KILLED, lordFuseStageTwo),
-    NPCEvent(2467, ON_KILLED, lordFuseStageThree),
+    NPCEvent(2466, AIState::DEAD, lordFuseStageTwo),
+    NPCEvent(2467, AIState::DEAD, lordFuseStageThree),
 };
 
 #pragma endregion NPCEvents
@@ -376,5 +402,5 @@ void NPCManager::init() {
     REGISTER_SHARD_PACKET(P_CL2FE_REQ_NPC_UNSUMMON, npcUnsummonHandler);
     REGISTER_SHARD_PACKET(P_CL2FE_REQ_BARKER, npcBarkHandler);
 
-    REGISTER_SHARD_TIMER(step, 200);
+    REGISTER_SHARD_TIMER(step, MS_PER_COMBAT_TICK);
 }

src/NPCManager.hpp

@@ -14,20 +14,15 @@
 
 #define RESURRECT_HEIGHT 400
 
-enum Trigger {
-    ON_KILLED,
-    ON_COMBAT
-};
-
-typedef void (*NPCEventHandler)(CNSocket*, BaseNPC*);
+typedef void (*NPCEventHandler)(CombatNPC*);
 
 struct NPCEvent {
     int32_t npcType;
-    int trigger;
+    AIState triggerState;
     NPCEventHandler handler;
 
-    NPCEvent(int32_t t, int tr, NPCEventHandler hndlr)
-        : npcType(t), trigger(tr), handler(hndlr) {}
+    NPCEvent(int32_t t, AIState tr, NPCEventHandler hndlr)
+        : npcType(t), triggerState(tr), handler(hndlr) {}
 };
 
 namespace NPCManager {

src/Nanos.cpp

@@ -69,52 +69,6 @@ void Nanos::addNano(CNSocket* sock, int16_t nanoID, int16_t slot, bool spendfm)
     PlayerManager::sendToViewable(sock, resp2, P_FE2CL_REP_PC_CHANGE_LEVEL);
 }
 
-std::vector<ICombatant*> Nanos::applyNanoBuff(SkillData* skill, Player* plr) {
-    assert(skill->drainType == SkillDrainType::PASSIVE);
-
-    EntityRef self = PlayerManager::getSockFromID(plr->iID);
-    std::vector<ICombatant*> affected;
-    std::vector<EntityRef> targets;
-    if (skill->targetType == SkillTargetType::GROUP) {
-        targets = plr->getGroupMembers(); // group
-    }
-    else if(skill->targetType == SkillTargetType::SELF) {
-        targets.push_back(self); // self
-    } else {
-        std::cout << "[WARN] Passive skill with type " << skill->skillType << " has target type MOB" << std::endl;
-    }
-
-    int timeBuffId = Abilities::getCSTBFromST(skill->skillType);
-    int boost = Nanos::getNanoBoost(plr) ? 3 : 0;
-    int value = skill->values[0][boost];
-
-    BuffStack passiveBuff = {
-        1, // passive nano buffs refreshed every tick
-        value,
-        self,
-        BuffClass::NONE, // overwritten per target
-    };
-
-    for (EntityRef target : targets) {
-        Entity* entity = target.getEntity();
-        if (entity->kind != PLAYER && entity->kind != COMBAT_NPC && entity->kind != MOB)
-            continue; // not a combatant
-
-        passiveBuff.buffStackClass = target == self ? BuffClass::NANO : BuffClass::GROUP_NANO;
-        ICombatant* combatant = dynamic_cast<ICombatant*>(entity);
-        if(combatant->addBuff(timeBuffId,
-            [](EntityRef self, Buff* buff, int status, BuffStack* stack) {
-                Buffs::timeBuffUpdate(self, buff, status, stack);
-            },
-            [](EntityRef self, Buff* buff, time_t currTime) {
-                // no-op
-            },
-            &passiveBuff)) affected.push_back(combatant);
-    }
-
-    return affected;
-}
-
 void Nanos::summonNano(CNSocket *sock, int slot, bool silent) {
     INITSTRUCT(sP_FE2CL_REP_NANO_ACTIVE_SUCC, resp);
     resp.iActiveNanoSlotNum = slot;
@@ -139,8 +93,10 @@ void Nanos::summonNano(CNSocket *sock, int slot, bool silent) {
     if (slot != -1 && skill != nullptr && skill->drainType == SkillDrainType::PASSIVE) {
         // passive buff effect
         resp.eCSTB___Add = 1;
-        std::vector<ICombatant*> affectedCombatants = applyNanoBuff(skill, plr);
-        if(!affectedCombatants.empty()) Abilities::useNanoSkill(sock, skill, nano, affectedCombatants);
+        ICombatant* src = dynamic_cast<ICombatant*>(plr);
+        int32_t targets[] = { plr->iID };
+        std::vector<ICombatant*> affectedCombatants = Abilities::matchTargets(src, skill, 1, targets);
+        Abilities::useNanoSkill(sock, skill, nano, affectedCombatants);
     }
 
     if (!silent) // silent nano death but only for the summoning player
@@ -154,7 +110,7 @@ void Nanos::summonNano(CNSocket *sock, int slot, bool silent) {
 }
 
 static void setNanoSkill(CNSocket* sock, sP_CL2FE_REQ_NANO_TUNE* skill) {
-    if (skill->iNanoID >= NANO_COUNT)
+    if (skill == nullptr || skill->iNanoID >= NANO_COUNT || skill->iNanoID < 0)
         return;
 
     Player *plr = PlayerManager::getPlayer(sock);
@@ -317,11 +273,11 @@ static void nanoSkillUseHandler(CNSocket* sock, CNPacketData* data) {
         std::cout << PlayerManager::getPlayerName(plr) << " requested to summon nano skill " << std::endl;
     )
 
-    // TODO ABILITIES
-    std::vector<ICombatant*> targetData = Abilities::matchTargets(skillData, pkt->iTargetCnt, (int32_t*)(pkt + 1));
+    ICombatant* plrCombatant = dynamic_cast<ICombatant*>(plr);
+    std::vector<ICombatant*> targetData = Abilities::matchTargets(plrCombatant, skillData, pkt->iTargetCnt, (int32_t*)(pkt + 1));
     Abilities::useNanoSkill(sock, skillData, nano, targetData);
 
-    if (plr->Nanos[plr->activeNano].iStamina < 0)
+    if (plr->Nanos[plr->activeNano].iStamina <= 0)
         summonNano(sock, -1);
 }
 

src/Nanos.hpp

@@ -26,5 +26,4 @@ namespace Nanos {
     void summonNano(CNSocket* sock, int slot, bool silent = false);
     int nanoStyle(int nanoID);
     bool getNanoBoost(Player* plr);
-    std::vector<ICombatant*> applyNanoBuff(SkillData* skill, Player* plr);
 }

src/Player.hpp

@@ -72,14 +72,16 @@ struct Player : public Entity, public ICombatant {
     bool notify = false;
     bool hidden = false;
     bool unwarpable = false;
+    bool initialLoadDone = false;
 
-    bool buddiesSynced = false;
     int64_t buddyIDs[50] = {};
     bool isBuddyBlocked[50] = {};
 
     uint64_t iFirstUseFlag[2] = {};
     time_t lastHeartbeat = 0;
 
+    int suspicionRating = 0;
+    time_t lastShot = 0;
     std::vector<sItemBase> buyback = {};
 
     Player() { kind = EntityKind::PLAYER; }
@@ -90,7 +92,8 @@ struct Player : public Entity, public ICombatant {
     virtual bool addBuff(int buffId, BuffCallback<int, BuffStack*> onUpdate, BuffCallback<time_t> onTick, BuffStack* stack) override;
     virtual Buff* getBuff(int buffId) override;
     virtual void removeBuff(int buffId) override;
-    virtual void removeBuff(int buffId, int buffClass) override;
+    virtual void removeBuff(int buffId, BuffClass buffClass) override;
+    virtual void clearBuffs(bool force) override;
     virtual bool hasBuff(int buffId) override;
     virtual int getCompositeCondition() override;
     virtual int takeDamage(EntityRef src, int amt) override;

src/PlayerManager.cpp

@@ -23,17 +23,12 @@ using namespace PlayerManager;
 
 std::map<CNSocket*, Player*> PlayerManager::players;
 
-static void addPlayer(CNSocket* key, Player& plr) {
-    Player *p = new Player();
+static void addPlayer(CNSocket* key, Player *plr) {
+    players[key] = plr;
+    plr->chunkPos = Chunking::INVALID_CHUNK;
+    plr->lastHeartbeat = 0;
 
-    // copy object into heap memory
-    *p = plr;
-
-    players[key] = p;
-    p->chunkPos = Chunking::INVALID_CHUNK;
-    p->lastHeartbeat = 0;
-
-    std::cout << getPlayerName(p) << " has joined!" << std::endl;
+    std::cout << getPlayerName(plr) << " has joined!" << std::endl;
     std::cout << players.size() << " players" << std::endl;
 }
 
@@ -82,7 +77,10 @@ void PlayerManager::updatePlayerPosition(CNSocket* sock, int X, int Y, int Z, ui
     plr->x = X;
     plr->y = Y;
     plr->z = Z;
-    plr->instanceID = I;
+    if (plr->instanceID != I) {
+        plr->instanceID = I;
+        plr->recallInstance = INSTANCE_OVERWORLD;
+    }
     if (oldChunk == newChunk)
         return; // didn't change chunks
     Chunking::updateEntityChunk({sock}, oldChunk, newChunk);
@@ -128,24 +126,6 @@ void PlayerManager::sendPlayerTo(CNSocket* sock, int X, int Y, int Z, uint64_t I
         sock->sendPacket(resp, P_FE2CL_REP_PC_WARP_USE_NPC_SUCC);
     }
 
-    if (I != INSTANCE_OVERWORLD) {
-        INITSTRUCT(sP_FE2CL_INSTANCE_MAP_INFO, pkt);
-        pkt.iInstanceMapNum = (int32_t)MAPNUM(I); // lower 32 bits are mapnum
-        if (I != fromInstance // do not retransmit MAP_INFO on recall
-        && Racing::EPData.find(pkt.iInstanceMapNum) != Racing::EPData.end()) {
-            EPInfo* ep = &Racing::EPData[pkt.iInstanceMapNum];
-            pkt.iEP_ID = ep->EPID;
-            pkt.iMapCoordX_Min = ep->zoneX * 51200;
-            pkt.iMapCoordX_Max = (ep->zoneX + 1) * 51200;
-            pkt.iMapCoordY_Min = ep->zoneY * 51200;
-            pkt.iMapCoordY_Max = (ep->zoneY + 1) * 51200;
-            pkt.iMapCoordZ_Min = INT32_MIN;
-            pkt.iMapCoordZ_Max = INT32_MAX;
-        }
-
-        sock->sendPacket(pkt, P_FE2CL_INSTANCE_MAP_INFO);
-    }
-
     INITSTRUCT(sP_FE2CL_REP_PC_GOTO_SUCC, pkt2);
     pkt2.iX = X;
     pkt2.iY = Y;
@@ -175,16 +155,21 @@ void PlayerManager::sendPlayerTo(CNSocket* sock, int X, int Y, int Z) {
  * Nanos the player hasn't unlocked will (and should) be greyed out. Thus, all nanos should be accounted
  * for in these packets, even if the player hasn't unlocked them.
  */
-static void sendNanoBookSubset(CNSocket *sock) {
+static void sendNanoBook(CNSocket *sock, Player *plr, bool resizeOnly) {
 #ifdef ACADEMY
-    Player *plr = getPlayer(sock);
-
     int16_t id = 0;
     INITSTRUCT(sP_FE2CL_REP_NANO_BOOK_SUBSET, pkt);
 
     pkt.PCUID = plr->iID;
     pkt.bookSize = NANO_COUNT;
 
+    if (resizeOnly) {
+        // triggers nano array resizing without
+        // actually sending nanos
+        sock->sendPacket(pkt, P_FE2CL_REP_NANO_BOOK_SUBSET);
+        return;
+    }
+
     while (id < NANO_COUNT) {
         pkt.elementOffset = id;
 
@@ -215,66 +200,73 @@ static void enterPlayer(CNSocket* sock, CNPacketData* data) {
         return;
     }
 
-    // for convenience
-    Player& plr = lm->plr;
+    Player *plr = new Player();
+    Database::getPlayer(plr, lm->playerId);
 
     // check if account is already in use
-    if (isAccountInUse(plr.accountId)) {
+    if (isAccountInUse(plr->accountId)) {
         // kick the other player
-        exitDuplicate(plr.accountId);
+        exitDuplicate(plr->accountId);
+
+        // re-read the player from disk, in case it was just flushed
+        *plr = {};
+        Database::getPlayer(plr, lm->playerId);
     }
 
-    response.iID = plr.iID;
+    plr->group = nullptr;
+
+    response.iID = plr->iID;
     response.uiSvrTime = getTime();
-    response.PCLoadData2CL.iUserLevel = plr.accountLevel;
-    response.PCLoadData2CL.iHP = plr.HP;
-    response.PCLoadData2CL.iLevel = plr.level;
-    response.PCLoadData2CL.iCandy = plr.money;
-    response.PCLoadData2CL.iFusionMatter = plr.fusionmatter;
-    response.PCLoadData2CL.iMentor = plr.mentor;
+
+    response.PCLoadData2CL.iUserLevel = plr->accountLevel;
+    response.PCLoadData2CL.iHP = plr->HP;
+    response.PCLoadData2CL.iLevel = plr->level;
+    response.PCLoadData2CL.iCandy = plr->money;
+    response.PCLoadData2CL.iFusionMatter = plr->fusionmatter;
+    response.PCLoadData2CL.iMentor = plr->mentor;
     response.PCLoadData2CL.iMentorCount = 1; // how many guides the player has had
-    response.PCLoadData2CL.iX = plr.x;
-    response.PCLoadData2CL.iY = plr.y;
-    response.PCLoadData2CL.iZ = plr.z;
-    response.PCLoadData2CL.iAngle = plr.angle;
-    response.PCLoadData2CL.iBatteryN = plr.batteryN;
-    response.PCLoadData2CL.iBatteryW = plr.batteryW;
+    response.PCLoadData2CL.iX = plr->x;
+    response.PCLoadData2CL.iY = plr->y;
+    response.PCLoadData2CL.iZ = plr->z;
+    response.PCLoadData2CL.iAngle = plr->angle;
+    response.PCLoadData2CL.iBatteryN = plr->batteryN;
+    response.PCLoadData2CL.iBatteryW = plr->batteryW;
     response.PCLoadData2CL.iBuddyWarpTime = 60; // sets 60s warp cooldown on login
 
-    response.PCLoadData2CL.iWarpLocationFlag = plr.iWarpLocationFlag;
-    response.PCLoadData2CL.aWyvernLocationFlag[0] = plr.aSkywayLocationFlag[0];
-    response.PCLoadData2CL.aWyvernLocationFlag[1] = plr.aSkywayLocationFlag[1];
+    response.PCLoadData2CL.iWarpLocationFlag = plr->iWarpLocationFlag;
+    response.PCLoadData2CL.aWyvernLocationFlag[0] = plr->aSkywayLocationFlag[0];
+    response.PCLoadData2CL.aWyvernLocationFlag[1] = plr->aSkywayLocationFlag[1];
 
     response.PCLoadData2CL.iActiveNanoSlotNum = -1;
     response.PCLoadData2CL.iFatigue = 50;
-    response.PCLoadData2CL.PCStyle = plr.PCStyle;
+    response.PCLoadData2CL.PCStyle = plr->PCStyle;
 
     // client doesnt read this, it gets it from charinfo
-    // response.PCLoadData2CL.PCStyle2 = plr.PCStyle2;
+    // response.PCLoadData2CL.PCStyle2 = plr->PCStyle2;
     // inventory
     for (int i = 0; i < AEQUIP_COUNT; i++)
-        response.PCLoadData2CL.aEquip[i] = plr.Equip[i];
+        response.PCLoadData2CL.aEquip[i] = plr->Equip[i];
     for (int i = 0; i < AINVEN_COUNT; i++)
-        response.PCLoadData2CL.aInven[i] = plr.Inven[i];
+        response.PCLoadData2CL.aInven[i] = plr->Inven[i];
     // quest inventory
     for (int i = 0; i < AQINVEN_COUNT; i++)
-        response.PCLoadData2CL.aQInven[i] = plr.QInven[i];
+        response.PCLoadData2CL.aQInven[i] = plr->QInven[i];
     // nanos
     for (int i = 1; i < SIZEOF_NANO_BANK_SLOT; i++) {
-        response.PCLoadData2CL.aNanoBank[i] = plr.Nanos[i];
+        response.PCLoadData2CL.aNanoBank[i] = plr->Nanos[i];
     }
     for (int i = 0; i < 3; i++) {
-        response.PCLoadData2CL.aNanoSlots[i] = plr.equippedNanos[i];
+        response.PCLoadData2CL.aNanoSlots[i] = plr->equippedNanos[i];
     }
     // missions in progress
     for (int i = 0; i < ACTIVE_MISSION_COUNT; i++) {
-        if (plr.tasks[i] == 0)
+        if (plr->tasks[i] == 0)
             break;
-        response.PCLoadData2CL.aRunningQuest[i].m_aCurrTaskID = plr.tasks[i];
-        TaskData &task = *Missions::Tasks[plr.tasks[i]];
+        response.PCLoadData2CL.aRunningQuest[i].m_aCurrTaskID = plr->tasks[i];
+        TaskData &task = *Missions::Tasks[plr->tasks[i]];
         for (int j = 0; j < 3; j++) {
             response.PCLoadData2CL.aRunningQuest[i].m_aKillNPCID[j] = (int)task["m_iCSUEnemyID"][j];
-            response.PCLoadData2CL.aRunningQuest[i].m_aKillNPCCount[j] = plr.RemainingNPCCount[i][j];
+            response.PCLoadData2CL.aRunningQuest[i].m_aKillNPCCount[j] = plr->RemainingNPCCount[i][j];
             /*
              * client doesn't care about NeededItem ID and Count,
              * it gets Count from Quest Inventory
@@ -284,12 +276,12 @@ static void enterPlayer(CNSocket* sock, CNPacketData* data) {
             */
         }
     }
-    response.PCLoadData2CL.iCurrentMissionID = plr.CurrentMissionID;
+    response.PCLoadData2CL.iCurrentMissionID = plr->CurrentMissionID;
 
     // completed missions
     // the packet requires 32 items, but the client only checks the first 16 (shrug)
     for (int i = 0; i < 16; i++) {
-        response.PCLoadData2CL.aQuestFlag[i] = plr.aQuestFlag[i];
+        response.PCLoadData2CL.aQuestFlag[i] = plr->aQuestFlag[i];
     }
 
     // Computress tips
@@ -298,45 +290,47 @@ static void enterPlayer(CNSocket* sock, CNPacketData* data) {
         response.PCLoadData2CL.iFirstUseFlag2 = UINT64_MAX;
     }
     else {
-        response.PCLoadData2CL.iFirstUseFlag1 = plr.iFirstUseFlag[0];
-        response.PCLoadData2CL.iFirstUseFlag2 = plr.iFirstUseFlag[1];
+        response.PCLoadData2CL.iFirstUseFlag1 = plr->iFirstUseFlag[0];
+        response.PCLoadData2CL.iFirstUseFlag2 = plr->iFirstUseFlag[1];
     }
 
-    plr.instanceID = INSTANCE_OVERWORLD; // the player should never be in an instance on enter
+    plr->instanceID = INSTANCE_OVERWORLD; // the player should never be in an instance on enter
 
     sock->setEKey(CNSocketEncryption::createNewKey(response.uiSvrTime, response.iID + 1, response.PCLoadData2CL.iFusionMatter + 1));
     sock->setFEKey(lm->FEKey);
     sock->setActiveKey(SOCKETKEY_FE); // send all packets using the FE key from now on
 
+    // Academy builds receive nanos in a separate packet. An initial one with the size of the
+    // nano book needs to be sent before PC_ENTER_SUCC so the client can resize its nano arrays,
+    // and then proper packets with the nanos included must be sent after, while the game is loading.
+    sendNanoBook(sock, plr, true);
+
     sock->sendPacket(response, P_FE2CL_REP_PC_ENTER_SUCC);
 
-    // transmit MOTD after entering the game, so the client hopefully changes modes on time
-    Chat::sendServerMessage(sock, settings::MOTDSTRING);
+    sendNanoBook(sock, plr, false);
 
-    // copy Player object into the shard
+    // transfer ownership of Player object into the shard (still valid in this function though)
     addPlayer(sock, plr);
 
-    // check if there is an expiring vehicle
-    Items::checkItemExpire(sock, getPlayer(sock));
-
     // set player equip stats
-    Items::setItemStats(getPlayer(sock));
-
-    Missions::failInstancedMissions(sock);
-
-    sendNanoBookSubset(sock);
-
-    // initial buddy sync
-    Buddies::refreshBuddyList(sock);
+    Items::setItemStats(plr);
 
     for (auto& pair : players)
         if (pair.second->notify)
-            Chat::sendServerMessage(pair.first, "[ADMIN]" + getPlayerName(&plr) + " has joined.");
+            Chat::sendServerMessage(pair.first, "[ADMIN]" + getPlayerName(plr) + " has joined.");
 
-    // deallocate lm (and therefore the plr object)
+    // deallocate lm
     delete lm;
 }
 
+void PlayerManager::sendToGroup(CNSocket* sock, void* buf, uint32_t type, size_t size) {
+    Player* plr = getPlayer(sock);
+    if (plr->group == nullptr)
+        return;
+    for(const EntityRef& ref : plr->group->filter(EntityKind::PLAYER))
+        ref.sock->sendPacket(buf, type, size);
+}
+
 void PlayerManager::sendToViewable(CNSocket* sock, void* buf, uint32_t type, size_t size) {
     Player* plr = getPlayer(sock);
     for (auto it = plr->viewableChunks.begin(); it != plr->viewableChunks.end(); it++) {
@@ -365,6 +359,35 @@ static void loadPlayer(CNSocket* sock, CNPacketData* data) {
     updatePlayerPosition(sock, plr->x, plr->y, plr->z, plr->instanceID, plr->angle);
 
     sock->sendPacket(response, P_FE2CL_REP_PC_LOADING_COMPLETE_SUCC);
+
+    if (plr->instanceID != INSTANCE_OVERWORLD) {
+        INITSTRUCT(sP_FE2CL_INSTANCE_MAP_INFO, pkt);
+        pkt.iInstanceMapNum = (int32_t)MAPNUM(plr->instanceID); // lower 32 bits are mapnum
+        if (pkt.iInstanceMapNum != plr->recallInstance // do not retransmit MAP_INFO on recall
+        && Racing::EPData.find(pkt.iInstanceMapNum) != Racing::EPData.end()) {
+            EPInfo* ep = &Racing::EPData[pkt.iInstanceMapNum];
+            pkt.iEP_ID = ep->EPID;
+            pkt.iMapCoordX_Min = ep->zoneX * 51200;
+            pkt.iMapCoordX_Max = (ep->zoneX + 1) * 51200;
+            pkt.iMapCoordY_Min = ep->zoneY * 51200;
+            pkt.iMapCoordY_Max = (ep->zoneY + 1) * 51200;
+            pkt.iMapCoordZ_Min = INT32_MIN;
+            pkt.iMapCoordZ_Max = INT32_MAX;
+        }
+
+        sock->sendPacket(pkt, P_FE2CL_INSTANCE_MAP_INFO);
+    }
+
+    if (!plr->initialLoadDone) {
+        // these should be called only once, but not until after
+        // first load-in or else the client may ignore the packets
+        Chat::sendServerMessage(sock, settings::MOTDSTRING); // MOTD
+        Missions::failInstancedMissions(sock); // auto-fail missions
+        Buddies::sendBuddyList(sock); // buddy list
+        Items::checkItemExpire(sock, plr); // vehicle expiration
+
+        plr->initialLoadDone = true;
+    }
 }
 
 static void heartbeatPlayer(CNSocket* sock, CNPacketData* data) {
@@ -373,6 +396,14 @@ static void heartbeatPlayer(CNSocket* sock, CNPacketData* data) {
 
 static void exitGame(CNSocket* sock, CNPacketData* data) {
     auto exitData = (sP_CL2FE_REQ_PC_EXIT*)data->buf;
+
+    // Refresh any auth cookie, in case "change character" was used
+    Player* plr = getPlayer(sock);
+    if (plr != nullptr) {
+        // 5 seconds should be enough to log in again
+        Database::refreshCookie(plr->accountId, 5);
+    }
+
     INITSTRUCT(sP_FE2CL_REP_PC_EXIT_SUCC, response);
 
     response.iID = exitData->iID;
@@ -400,14 +431,14 @@ static void revivePlayer(CNSocket* sock, CNPacketData* data) {
         if (!(plr->hasBuff(ECSB_PHOENIX)))
             return; // sanity check
         plr->Nanos[plr->activeNano].iStamina = 0;
-        // TODO ABILITIES
-        //Abilities::applyBuff(sock, plr->Nanos[plr->activeNano].iSkillID, 2, 1, 0);
         // fallthrough
     case ePCRegenType::HereByPhoenixGroup: // revived by group member's nano
         plr->HP = PC_MAXHEALTH(plr->level) / 2;
         break;
+
     default: // plain respawn
         plr->HP = PC_MAXHEALTH(plr->level) / 2;
+        plr->clearBuffs(false);
         // fallthrough
     case ePCRegenType::Unstick: // warp away
         move = true;
@@ -568,7 +599,7 @@ static void setFirstUseFlag(CNSocket* sock, CNPacketData* data) {
         std::cout << "[WARN] Client submitted invalid first use flag number?!" << std::endl;
         return;
     }
-    
+
     if (flag->iFlagCode <= 64)
         plr->iFirstUseFlag[0] |= (1ULL << (flag->iFlagCode - 1));
     else
@@ -589,6 +620,10 @@ std::string PlayerManager::getPlayerName(Player *plr, bool id) {
     if (plr == nullptr)
         return "NOT IN GAME";
 
+    if (plr->PCStyle.iNameCheck != 1) {
+        return "Player " + std::to_string(plr->iID);
+    }
+
     std::string ret = "";
     if (id && plr->accountLevel <= 30)
         ret += "(GM) ";

src/PlayerManager.hpp

@@ -33,6 +33,7 @@ namespace PlayerManager {
     CNSocket *getSockFromAny(int by, int id, int uid, std::string firstname, std::string lastname);
     WarpLocation *getRespawnPoint(Player *plr);
 
+    void sendToGroup(CNSocket *sock, void* buf, uint32_t type, size_t size);
     void sendToViewable(CNSocket *sock, void* buf, uint32_t type, size_t size);
 
     // TODO: unify this under the new Entity system

src/Racing.cpp

@@ -66,7 +66,7 @@ static void racingCancel(CNSocket* sock, CNPacketData* data) {
     INITSTRUCT(sP_FE2CL_REP_EP_RACE_CANCEL_SUCC, resp);
     sock->sendPacket(resp, P_FE2CL_REP_EP_RACE_CANCEL_SUCC);
 
-    /* 
+    /*
      * This request packet is used for both cancelling the race via the
      * NPC at the start, *and* failing the race by running out of time.
      * If the latter is to happen, the client disables movement until it
@@ -99,35 +99,43 @@ static void racingEnd(CNSocket* sock, CNPacketData* data) {
     if (EPData.find(mapNum) == EPData.end() || EPData[mapNum].EPID == 0)
         return; // IZ not found
 
-    uint64_t now = getTime() / 1000;
+    EPInfo& epInfo = EPData[mapNum];
+    EPRace& epRace = EPRaces[sock];
 
-    int timeDiff = now - EPRaces[sock].startTime;
-    int score = 500 * EPRaces[sock].collectedRings.size() - 10 * timeDiff;
-    if (score < 0) score = 0; // lol
-    int fm = score * plr->level * (1.0f / 36) * 0.3f;
+    uint64_t now = getTime() / 1000;
+    int timeDiff = now - epRace.startTime;
+    int podsCollected = epRace.collectedRings.size();
+
+    int score = std::exp(
+        (epInfo.podFactor * podsCollected) / epInfo.maxPods
+        - (epInfo.timeFactor * timeDiff) / epInfo.maxTime
+        + epInfo.scaleFactor);
+    score = (settings::IZRACESCORECAPPED && score > epInfo.maxScore) ? epInfo.maxScore : score;
+    int fm = (1.0 + std::exp(epInfo.scaleFactor - 1.0) * epInfo.podFactor * podsCollected) / epInfo.maxPods;
 
     // we submit the ranking first...
     Database::RaceRanking postRanking = {};
-    postRanking.EPID = EPData[mapNum].EPID;
+    postRanking.EPID = epInfo.EPID;
     postRanking.PlayerID = plr->iID;
-    postRanking.RingCount = EPRaces[sock].collectedRings.size();
+    postRanking.RingCount = podsCollected;
     postRanking.Score = score;
     postRanking.Time = timeDiff;
     postRanking.Timestamp = getTimestamp();
     Database::postRaceRanking(postRanking);
 
     // ...then we get the top ranking, which may or may not be what we just submitted
-    Database::RaceRanking topRankingPlayer = Database::getTopRaceRanking(EPData[mapNum].EPID, plr->iID);
+    Database::RaceRanking topRankingPlayer = Database::getTopRaceRanking(epInfo.EPID, plr->iID);
 
     INITSTRUCT(sP_FE2CL_REP_EP_RACE_END_SUCC, resp);
 
     // get rank scores and rewards
-    std::vector<int>* rankScores = &EPRewards[EPData[mapNum].EPID].first;
-    std::vector<int>* rankRewards = &EPRewards[EPData[mapNum].EPID].second;
+    std::vector<int>* rankScores = &EPRewards[epInfo.EPID].first;
+    std::vector<int>* rankRewards = &EPRewards[epInfo.EPID].second;
 
     // top ranking
+    int maxRank = rankScores->size() - 1;
     int topRank = 0;
-    while (rankScores->at(topRank) > topRankingPlayer.Score)
+    while (topRank < maxRank && rankScores->at(topRank) > topRankingPlayer.Score)
         topRank++;
 
     resp.iEPTopRank = topRank + 1;
@@ -137,7 +145,7 @@ static void racingEnd(CNSocket* sock, CNPacketData* data) {
 
     // this ranking
     int rank = 0;
-    while (rankScores->at(rank) > postRanking.Score)
+    while (rank < maxRank && rankScores->at(rank) > postRanking.Score)
         rank++;
 
     resp.iEPRank = rank + 1;

src/Racing.hpp

@@ -7,7 +7,11 @@
 #include <set>
 
 struct EPInfo {
-    int zoneX, zoneY, EPID, maxScore, maxTime;
+    // available through XDT (maxScore may be updated by drops)
+    int zoneX, zoneY, EPID, maxScore;
+    // available through drops
+    int maxTime, maxPods;
+    double scaleFactor, podFactor, timeFactor;
 };
 
 struct EPRace {

src/TableData.cpp

@@ -1,5 +1,7 @@
 #include "TableData.hpp"
 
+#include "servers/CNLoginServer.hpp"
+
 #include "NPCManager.hpp"
 #include "Missions.hpp"
 #include "Items.hpp"
@@ -33,6 +35,22 @@ public:
     const char *what() const throw() { return msg.c_str(); }
 };
 
+/*
+ * We must refuse to run if an invalid NPC type is found in the JSONs, especially
+ * the gruntwork file. If we were to just skip loading invalid NPCs, they would get
+ * silently dropped from the gruntwork file, which would be confusing in situations
+ * where a gruntwork file for the wrong game build was accidentally loaded.
+ */
+static void ensureValidNPCType(int type, std::string filename) {
+    // last known NPC type
+    int npcLimit = NPCManager::NPCData.back()["m_iNpcNumber"];
+
+    if (type > npcLimit) {
+        std::cout << "[FATAL] " << filename << " contains an invalid NPC type: " << type << std::endl;
+        exit(1);
+    }
+}
+
 /*
  * Create a full and properly-paced path by interpolating between keyframes.
  */
@@ -63,6 +81,25 @@ static void loadXDT(json& xdtData) {
     NPCManager::NPCData = xdtData["m_pNpcTable"]["m_pNpcData"];
 
     try {
+        // load name wheel names
+        json firstNameData = xdtData["m_pNameTable"]["m_pFirstName"];
+        for (json::iterator _name = firstNameData.begin(); _name != firstNameData.end(); _name++) {
+            auto name = _name.value();
+            LoginServer::WheelFirstNames.push_back(name["m_pstrNameString"]);
+        }
+
+        json middleNameData = xdtData["m_pNameTable"]["m_pMiddleName"];
+        for (json::iterator _name = middleNameData.begin(); _name != middleNameData.end(); _name++) {
+            auto name = _name.value();
+            LoginServer::WheelMiddleNames.push_back(name["m_pstrNameString"]);
+        }
+
+        json lastNameData = xdtData["m_pNameTable"]["m_pLastName"];
+        for (json::iterator _name = lastNameData.begin(); _name != lastNameData.end(); _name++) {
+            auto name = _name.value();
+            LoginServer::WheelLastNames.push_back(name["m_pstrNameString"]);
+        }
+
         // load warps
         json warpData = xdtData["m_pInstanceTable"]["m_pWarpData"];
 
@@ -359,7 +396,7 @@ static void loadPaths(json& pathData, int32_t* nextId) {
             Transport::NPCPaths.push_back(pathTemplate);
         }
         std::cout << "[INFO] Loaded " << Transport::NPCPaths.size() << " NPC paths" << std::endl;
-        
+
     }
     catch (const std::exception& err) {
         std::cerr << "[FATAL] Malformed paths.json file! Reason:" << err.what() << std::endl;
@@ -568,8 +605,17 @@ static void loadDrops(json& dropData) {
                 continue;
             }
 
-            // time limit isn't stored in the XDT, so we include it in the reward table instead
-            Racing::EPData[EPMap].maxTime = race["TimeLimit"];
+            EPInfo& epInfo = Racing::EPData[EPMap];
+
+            // max score is specified in the XDT, but can be updated if specified in the drops JSON
+            epInfo.maxScore = (int)race["ScoreCap"];
+            // time limit and total pods are not stored in the XDT, so we include it in the drops JSON
+            epInfo.maxTime = (int)race["TimeLimit"];
+            epInfo.maxPods = (int)race["TotalPods"];
+            // IZ-specific calculated constants included in the drops JSON
+            epInfo.scaleFactor = (double)race["ScaleFactor"];
+            epInfo.podFactor = (double)race["PodFactor"];
+            epInfo.timeFactor = (double)race["TimeFactor"];
 
             // score cutoffs
             std::vector<int> rankScores;
@@ -585,7 +631,7 @@ static void loadDrops(json& dropData) {
 
             if (rankScores.size() != 5 || rankScores.size() != rankRewards.size()) {
                 char buff[255];
-                sprintf(buff, "Race in EP %d doesn't have exactly 5 score/reward pairs", raceEPID);
+                snprintf(buff, 255, "Race in EP %d doesn't have exactly 5 score/reward pairs", raceEPID);
                 throw TableException(std::string(buff));
             }
 
@@ -670,10 +716,12 @@ static void loadEggs(json& eggData, int32_t* nextId) {
     }
 }
 
-/* 
+/*
  * Load gruntwork output, if it exists
  */
 static void loadGruntworkPre(json& gruntwork, int32_t* nextId) {
+    if (gruntwork.is_null())
+        return;
 
     try {
         auto paths = gruntwork["paths"];
@@ -723,8 +771,8 @@ static void loadGruntworkPre(json& gruntwork, int32_t* nextId) {
 }
 
 static void loadGruntworkPost(json& gruntwork, int32_t* nextId) {
-
-    if (gruntwork.is_null()) return;
+    if (gruntwork.is_null())
+        return;
 
     try {
         // skyway paths
@@ -776,6 +824,8 @@ static void loadGruntworkPost(json& gruntwork, int32_t* nextId) {
             int id = (*nextId)--;
             uint64_t instanceID = mob.find("iMapNum") == mob.end() ? INSTANCE_OVERWORLD : (int)mob["iMapNum"];
 
+            ensureValidNPCType((int)mob["iNPCType"], settings::GRUNTWORKJSON);
+
             if (NPCManager::NPCData[(int)mob["iNPCType"]]["m_iTeam"] == 2) {
                 npc = new Mob(mob["iX"], mob["iY"], mob["iZ"], instanceID, mob["iNPCType"],
                     NPCManager::NPCData[(int)mob["iNPCType"]], id);
@@ -795,6 +845,9 @@ static void loadGruntworkPost(json& gruntwork, int32_t* nextId) {
         auto groups = gruntwork["groups"];
         for (auto _group = groups.begin(); _group != groups.end(); _group++) {
             auto leader = _group.value();
+
+            ensureValidNPCType((int)leader["iNPCType"], settings::GRUNTWORKJSON);
+
             auto td = NPCManager::NPCData[(int)leader["iNPCType"]];
             uint64_t instanceID = leader.find("iMapNum") == leader.end() ? INSTANCE_OVERWORLD : (int)leader["iMapNum"];
 
@@ -815,6 +868,9 @@ static void loadGruntworkPost(json& gruntwork, int32_t* nextId) {
                 int followerCount = 0;
                 for (json::iterator _fol = followers.begin(); _fol != followers.end(); _fol++) {
                     auto follower = _fol.value();
+
+                    ensureValidNPCType((int)follower["iNPCType"], settings::GRUNTWORKJSON);
+
                     auto tdFol = NPCManager::NPCData[(int)follower["iNPCType"]];
                     Mob* tmpFol = new Mob((int)leader["iX"] + (int)follower["iOffsetX"], (int)leader["iY"] + (int)follower["iOffsetY"], leader["iZ"], leader["iAngle"], instanceID, follower["iNPCType"], tdFol, *nextId);
 
@@ -871,10 +927,9 @@ static void loadNPCs(json& npcData) {
             npcID += NPC_ID_OFFSET;
             int instanceID = npc.find("iMapNum") == npc.end() ? INSTANCE_OVERWORLD : (int)npc["iMapNum"];
             int type = (int)npc["iNPCType"];
-            if (NPCManager::NPCData[type].is_null()) {
-                std::cout << "[WARN] NPC type " << type << " not found; skipping (json#" << _npc.key() << ")" << std::endl;
-                continue;
-            }
+
+            ensureValidNPCType(type, settings::NPCJSON);
+
 #ifdef ACADEMY
             // do not spawn NPCs in the future
             if (npc["iX"] > 512000 && npc["iY"] < 256000)
@@ -916,10 +971,9 @@ static void loadMobs(json& npcData, int32_t* nextId) {
             int npcID = std::strtol(_npc.key().c_str(), nullptr, 10); // parse ID string to integer
             npcID += MOB_ID_OFFSET;
             int type = (int)npc["iNPCType"];
-            if (NPCManager::NPCData[type].is_null()) {
-                std::cout << "[WARN] NPC type " << type << " not found; skipping (json#" << _npc.key() << ")" << std::endl;
-                continue;
-            }
+
+            ensureValidNPCType(type, settings::MOBJSON);
+
             auto td = NPCManager::NPCData[type];
             uint64_t instanceID = npc.find("iMapNum") == npc.end() ? INSTANCE_OVERWORLD : (int)npc["iMapNum"];
 
@@ -947,7 +1001,10 @@ static void loadMobs(json& npcData, int32_t* nextId) {
         for (json::iterator _group = groupData.begin(); _group != groupData.end(); _group++) {
             auto leader = _group.value();
             int leadID = std::strtol(_group.key().c_str(), nullptr, 10); // parse ID string to integer
+
             leadID += MOB_GROUP_ID_OFFSET;
+            ensureValidNPCType(leader["iNPCType"], settings::MOBJSON);
+
             auto td = NPCManager::NPCData[(int)leader["iNPCType"]];
             uint64_t instanceID = leader.find("iMapNum") == leader.end() ? INSTANCE_OVERWORLD : (int)leader["iMapNum"];
             auto followers = leader["aFollowers"];
@@ -977,6 +1034,9 @@ static void loadMobs(json& npcData, int32_t* nextId) {
                 int followerCount = 0;
                 for (json::iterator _fol = followers.begin(); _fol != followers.end(); _fol++) {
                     auto follower = _fol.value();
+
+                    ensureValidNPCType(follower["iNPCType"], settings::MOBJSON);
+
                     auto tdFol = NPCManager::NPCData[(int)follower["iNPCType"]];
                     Mob* tmpFol = new Mob((int)leader["iX"] + (int)follower["iOffsetX"], (int)leader["iY"] + (int)follower["iOffsetY"], leader["iZ"], leader["iAngle"], instanceID, follower["iNPCType"], tdFol, *nextId);
 
@@ -1082,19 +1142,39 @@ void TableData::init() {
     };
 
     // load JSON data into tables
-    std::ifstream fstream;
     for (int i = 0; i < 7; i++) {
         std::pair<json*, std::string>& table = tables[i];
-        fstream.open(settings::TDATADIR + "/" + table.second); // open file
-        if (!fstream.fail()) {
-            fstream >> *table.first; // load file contents into table
-        } else {
-            if (table.first != &gruntwork) { // gruntwork isn't critical
+
+        // scope for fstream
+        {
+            std::ifstream fstream;
+            fstream.open(settings::TDATADIR + "/" + table.second); // open file
+
+            // did we fail to open the file?
+            if (fstream.fail()) {
+                // gruntwork isn't critical
+                if (table.first == &gruntwork)
+                    continue;
+
                 std::cerr << "[FATAL] Critical tdata file missing: " << table.second << std::endl;
                 exit(1);
             }
+
+            // is the file empty?
+            if (fstream.peek() == std::ifstream::traits_type::eof()) {
+                // tolerate empty gruntwork file
+                if (table.first == &gruntwork) {
+                    std::cout << "[WARN] The gruntwork file is empty" << std::endl;
+                    continue;
+                }
+
+                std::cerr << "[FATAL] Critical tdata file is empty: " << table.second << std::endl;
+                exit(1);
+            }
+
+            // load file contents into table
+            fstream >> *table.first;
         }
-        fstream.close();
 
         // patching: load each patch directory specified in the config file
 
@@ -1109,11 +1189,11 @@ void TableData::init() {
             std::string patchModuleName = *it;
             std::string patchFile = settings::PATCHDIR + patchModuleName + "/" + table.second;
             try {
+                std::ifstream fstream;
                 fstream.open(patchFile);
                 fstream >> patch; // load into temporary json object
                 std::cout << "[INFO] Patching " << patchFile << std::endl;
                 patchJSON(table.first, &patch); // patch
-                fstream.close();
             } catch (const std::exception& err) {
                 // no-op
             }
@@ -1311,7 +1391,7 @@ void TableData::flush() {
             targetIDs.push_back(tID);
         for (int32_t tType : path.targetTypes)
             targetTypes.push_back(tType);
-        
+
         pathObj["iBaseSpeed"] = path.speed;
         pathObj["iTaskID"] = path.escortTaskID;
         pathObj["bRelative"] = path.isRelative;

src/Trading.cpp

@@ -3,6 +3,7 @@
 #include "servers/CNShardServer.hpp"
 
 #include "PlayerManager.hpp"
+#include "db/Database.hpp"
 
 using namespace Trading;
 
@@ -185,6 +186,36 @@ static void tradeOfferRefusal(CNSocket* sock, CNPacketData* data) {
     otherSock->sendPacket((void*)&resp, P_FE2CL_REP_PC_TRADE_OFFER_REFUSAL, sizeof(sP_FE2CL_REP_PC_TRADE_OFFER_REFUSAL));
 }
 
+static void tradeOfferCancel(CNSocket* sock, CNPacketData* data) {
+    sP_CL2FE_REQ_PC_TRADE_OFFER_CANCEL* pacdat = (sP_CL2FE_REQ_PC_TRADE_OFFER_CANCEL*)data->buf;
+
+    CNSocket* otherSock = PlayerManager::getSockFromID(pacdat->iID_From);
+
+    if (otherSock == nullptr)
+        return;
+
+    INITSTRUCT(sP_FE2CL_REP_PC_TRADE_OFFER_CANCEL, resp);
+    resp.iID_Request = pacdat->iID_Request;
+    resp.iID_From = pacdat->iID_From;
+    resp.iID_To = pacdat->iID_To;
+    otherSock->sendPacket((void*)&resp, P_FE2CL_REP_PC_TRADE_OFFER_CANCEL, sizeof(sP_FE2CL_REP_PC_TRADE_OFFER_CANCEL));
+}
+
+static void tradeOfferAbort(CNSocket* sock, CNPacketData* data) {
+    sP_CL2FE_REQ_PC_TRADE_OFFER_ABORT* pacdat = (sP_CL2FE_REQ_PC_TRADE_OFFER_ABORT*)data->buf;
+
+    CNSocket* otherSock = PlayerManager::getSockFromID(pacdat->iID_From);
+
+    if (otherSock == nullptr)
+        return;
+
+    INITSTRUCT(sP_FE2CL_REP_PC_TRADE_OFFER_ABORT, resp);
+    resp.iID_Request = pacdat->iID_Request;
+    resp.iID_From = pacdat->iID_From;
+    resp.iID_To = pacdat->iID_To;
+    otherSock->sendPacket((void*)&resp, P_FE2CL_REP_PC_TRADE_OFFER_ABORT, sizeof(sP_FE2CL_REP_PC_TRADE_OFFER_ABORT));
+}
+
 static void tradeConfirm(CNSocket* sock, CNPacketData* data) {
     sP_CL2FE_REQ_PC_TRADE_CONFIRM* pacdat = (sP_CL2FE_REQ_PC_TRADE_CONFIRM*)data->buf;
 
@@ -272,6 +303,8 @@ static void tradeConfirm(CNSocket* sock, CNPacketData* data) {
         otherSock->sendPacket(msg, P_FE2CL_GM_REP_PC_ANNOUNCE);
         return;
     }
+
+    Database::commitTrade(plr, plr2);
 }
 
 static void tradeConfirmCancel(CNSocket* sock, CNPacketData* data) {
@@ -427,6 +460,8 @@ void Trading::init() {
     REGISTER_SHARD_PACKET(P_CL2FE_REQ_PC_TRADE_OFFER, tradeOffer);
     REGISTER_SHARD_PACKET(P_CL2FE_REQ_PC_TRADE_OFFER_ACCEPT, tradeOfferAccept);
     REGISTER_SHARD_PACKET(P_CL2FE_REQ_PC_TRADE_OFFER_REFUSAL, tradeOfferRefusal);
+    REGISTER_SHARD_PACKET(P_CL2FE_REQ_PC_TRADE_OFFER_CANCEL, tradeOfferCancel);
+    REGISTER_SHARD_PACKET(P_CL2FE_REQ_PC_TRADE_OFFER_ABORT, tradeOfferAbort);
     REGISTER_SHARD_PACKET(P_CL2FE_REQ_PC_TRADE_CONFIRM, tradeConfirm);
     REGISTER_SHARD_PACKET(P_CL2FE_REQ_PC_TRADE_CONFIRM_CANCEL, tradeConfirmCancel);
     REGISTER_SHARD_PACKET(P_CL2FE_REQ_PC_TRADE_ITEM_REGISTER, tradeRegisterItem);

src/Transport.cpp

@@ -388,8 +388,21 @@ NPCPath* Transport::findApplicablePath(int32_t id, int32_t type, int taskID) {
 
 void Transport::constructPathNPC(int32_t id, NPCPath* path) {
     BaseNPC* npc = NPCManager::NPCs[id];
-    if (npc->kind == EntityKind::MOB)
-        ((Mob*)(npc))->staticPath = true;
+
+    if (npc->kind == EntityKind::MOB) {
+        auto mob = (Mob*)npc;
+        mob->staticPath = true;
+
+        Vec3 firstPoint = path->points.front();
+
+        // Ensure that the first point coincides with the mob's spawn point.
+        if (mob->spawnX != firstPoint.x || mob->spawnY != firstPoint.y) {
+            std::cout << "[FATAL] The first point of the route for mob " << mob->id << " (type " << mob->type
+                << ") does not correspond with its spawn point." << std::endl;
+            exit(1);
+        }
+    }
+
     npc->loopingPath = path->isLoop;
 
     // Interpolate

src/Vendors.cpp

@@ -6,6 +6,9 @@
 #include "Items.hpp"
 #include "Rand.hpp"
 
+// 7 days
+#define VEHICLE_EXPIRY_DURATION 604800
+
 using namespace Vendors;
 
 std::map<int32_t, std::vector<VendorListing>> Vendors::VendorTables;
@@ -58,8 +61,8 @@ static void vendorBuy(CNSocket* sock, CNPacketData* data) {
 
     // if vehicle
     if (req->Item.iType == 10) {
-        // set time limit: current time + 7days
-        req->Item.iTimeLimit = getTimestamp() + 604800;
+        // set time limit: current time + expiry duration
+        req->Item.iTimeLimit = getTimestamp() + VEHICLE_EXPIRY_DURATION;
     }
 
     if (slot != req->iInvenSlotNum) {
@@ -229,12 +232,20 @@ static void vendorTable(CNSocket* sock, CNPacketData* data) {
     INITSTRUCT(sP_FE2CL_REP_PC_VENDOR_TABLE_UPDATE_SUCC, resp);
 
     for (int i = 0; i < (int)listings.size() && i < 20; i++) { // 20 is the max
-        sItemBase base;
+        sItemBase base = {};
         base.iID = listings[i].id;
-        base.iOpt = 0;
-        base.iTimeLimit = 0;
         base.iType = listings[i].type;
 
+        /*
+         * Set vehicle expiry value.
+         *
+         * Note: sItemBase.iTimeLimit in the context of vendor listings contains
+         * a duration, unlike in most other contexts where it contains the
+         * expiration timestamp.
+         */
+        if (listings[i].type == 10)
+            base.iTimeLimit = VEHICLE_EXPIRY_DURATION;
+
         sItemVendor vItem;
         vItem.item = base;
         vItem.iSortNum = listings[i].sort;

src/core/CNProtocol.cpp

@@ -41,7 +41,8 @@ int CNSocketEncryption::xorData(uint8_t* buffer, uint8_t* key, int size) {
 uint64_t CNSocketEncryption::createNewKey(uint64_t uTime, int32_t iv1, int32_t iv2) {
     uint64_t num = (uint64_t)(iv1 + 1);
     uint64_t num2 = (uint64_t)(iv2 + 1);
-    uint64_t dEKey = (uint64_t)(*(uint64_t*)&defaultKey[0]);
+    uint64_t dEKey;
+    memcpy(&dEKey, defaultKey, sizeof(dEKey));
     return dEKey * (uTime * num * num2);
 }
 
@@ -65,7 +66,7 @@ CNPacketData::CNPacketData(void *b, uint32_t t, int l, int trnum, void *trs):
 // ========================================================[[ CNSocket ]]========================================================
 
 CNSocket::CNSocket(SOCKET s, struct sockaddr_in &addr, PacketHandler ph): sock(s), sockaddr(addr), pHandler(ph) {
-    EKey = (uint64_t)(*(uint64_t*)&CNSocketEncryption::defaultKey[0]);
+    memcpy(&EKey, CNSocketEncryption::defaultKey, sizeof(EKey));
 }
 
 bool CNSocket::sendData(uint8_t* data, int size) {
@@ -109,7 +110,11 @@ bool CNSocket::isAlive() {
 }
 
 void CNSocket::kill() {
+    if (!alive)
+        return;
+
     alive = false;
+
 #ifdef _WIN32
     shutdown(sock, SD_BOTH);
     closesocket(sock);
@@ -241,9 +246,10 @@ void CNSocket::step() {
     if (readSize <= 0) {
         // we aren't reading a packet yet, try to start looking for one
         int recved = recv(sock, (buffer_t*)readBuffer, sizeof(int32_t), 0);
-        if (recved == 0) {
-            // the socket was closed normally
+        if (recved >= 0 && recved < sizeof(int32_t)) {
+            // too little data for readSize or the socket was closed normally (when 0 bytes were read)
             kill();
+            return;
         } else if (!SOCKETERROR(recved)) {
             // we got our packet size!!!!
             readSize = *((int32_t*)readBuffer);
@@ -264,11 +270,12 @@ void CNSocket::step() {
     }
 
     if (readSize > 0 && readBufferIndex < readSize) {
-        // read until the end of the packet! (or at least try too)
+        // read until the end of the packet (or at least try to)
         int recved = recv(sock, (buffer_t*)(readBuffer + readBufferIndex), readSize - readBufferIndex, 0);
         if (recved == 0) {
             // the socket was closed normally
             kill();
+            return;
         } else if (!SOCKETERROR(recved))
             readBufferIndex += recved;
         else if (OF_ERRNO != OF_EWOULD) {
@@ -411,9 +418,9 @@ void CNServer::addPollFD(SOCKET s) {
     fds.push_back({s, POLLIN});
 }
 
-void CNServer::removePollFD(int i) {
+void CNServer::removePollFD(int fd) {
     auto it = fds.begin();
-    while (it != fds.end() && it->fd != fds[i].fd)
+    while (it != fds.end() && it->fd != fd)
         it++;
     assert(it != fds.end());
 
@@ -421,7 +428,7 @@ void CNServer::removePollFD(int i) {
 }
 
 void CNServer::start() {
-    std::cout << "Starting server at *:" << port << std::endl;
+    std::cout << "Starting " << serverType << " server at *:" << port << std::endl;
     while (active) {
         // the timeout is to ensure shard timers are ticking
         int n = poll(fds.data(), fds.size(), 50);
@@ -458,7 +465,7 @@ void CNServer::start() {
                 if (!setSockNonblocking(sock, newConnectionSocket))
                     continue;
 
-                std::cout << "New connection! " << inet_ntoa(address.sin_addr) << std::endl;
+                std::cout << "New " << serverType << " connection! " << inet_ntoa(address.sin_addr) << std::endl;
 
                 addPollFD(newConnectionSocket);
 
@@ -473,10 +480,15 @@ void CNServer::start() {
             } else {
                 std::lock_guard<std::mutex> lock(activeCrit); // protect operations on connections
 
+                // halt packet handling if server is shutting down
+                if (!active)
+                    return;
+
                 // player sockets
                 if (connections.find(fds[i].fd) == connections.end()) {
-                    std::cout << "[WARN] Event on non-existant socket?" << std::endl;
-                    continue; // just to be safe
+                    std::cout << "[FATAL] Event on non-existent socket: " << fds[i].fd << std::endl;
+                    assert(0);
+                    /* not reached */
                 }
 
                 CNSocket* cSock = connections[fds[i].fd];
@@ -485,22 +497,29 @@ void CNServer::start() {
                 if (fds[i].revents & ~POLLIN)
                     cSock->kill();
 
-                if (cSock->isAlive()) {
+                if (cSock->isAlive())
                     cSock->step();
-                } else {
-                    killConnection(cSock);
-                    connections.erase(fds[i].fd);
-                    delete cSock;
-
-                    removePollFD(i);
-
-                    // a new entry was moved to this position, so we check it again
-                    i--;
-                }
             }
         }
 
         onStep();
+
+        // clean up dead connection sockets
+        auto it = connections.begin();
+        while (it != connections.end()) {
+            CNSocket *cSock = it->second;
+
+            if (!cSock->isAlive()) {
+                killConnection(cSock);
+                it = connections.erase(it);
+
+                removePollFD(cSock->sock);
+
+                delete cSock;
+            } else {
+                it++;
+            }
+        }
     }
 }
 

src/core/CNProtocol.hpp

@@ -95,14 +95,14 @@ inline constexpr bool isOutboundPacketID(uint32_t id) {
 // for outbound packets
 inline constexpr bool validOutVarPacket(size_t base, size_t npayloads, size_t plsize) {
     // check for multiplication overflow
-    if (npayloads > 0 && (CN_PACKET_BUFFER_SIZE - 8) / (size_t)npayloads < plsize)
+    if (npayloads > 0 && (CN_PACKET_BODY_SIZE) / (size_t)npayloads < plsize)
         return false;
 
     // it's safe to multiply
     size_t trailing = npayloads * plsize;
 
     // does it fit in a packet?
-    if (base + trailing > CN_PACKET_BUFFER_SIZE - 8)
+    if (base + trailing > CN_PACKET_BODY_SIZE)
         return false;
 
     // everything is a-ok!
@@ -112,14 +112,14 @@ inline constexpr bool validOutVarPacket(size_t base, size_t npayloads, size_t pl
 // for inbound packets
 inline constexpr bool validInVarPacket(size_t base, size_t npayloads, size_t plsize, size_t datasize) {
     // check for multiplication overflow
-    if (npayloads > 0 && (CN_PACKET_BUFFER_SIZE - 8) / (size_t)npayloads < plsize)
+    if (npayloads > 0 && CN_PACKET_BODY_SIZE / (size_t)npayloads < plsize)
         return false;
 
     // it's safe to multiply
     size_t trailing = npayloads * plsize;
 
     // make sure size is exact
-    // datasize has already been validated against CN_PACKET_BUFFER_SIZE
+    // datasize has already been validated against CN_PACKET_BODY_SIZE
     if (datasize != base + trailing)
         return false;
 
@@ -230,6 +230,7 @@ protected:
     const size_t STARTFDSCOUNT = 8; // number of initial PollFD slots
     std::vector<PollFD> fds;
 
+    std::string serverType = "invalid";
     SOCKET sock;
     uint16_t port;
     socklen_t addressSize;

src/core/CNShared.cpp

@@ -32,7 +32,7 @@ void CNShared::pruneLoginMetadata(CNServer *serv, time_t currTime) {
         auto& sk = it->first;
         auto& lm = it->second;
 
-        if (lm->timestamp + CNSHARED_TIMEOUT > currTime) {
+        if (currTime > lm->timestamp + CNSHARED_TIMEOUT) {
             std::cout << "[WARN] Pruning hung connection attempt" << std::endl;
 
             // deallocate object and remove map entry

src/core/CNShared.hpp

@@ -11,14 +11,14 @@
 #include "Player.hpp"
 
 /*
- * Connecions time out after 15 minutes, checked every 30 seconds.
+ * Connecions time out after 5 minutes, checked every 30 seconds.
  */
-#define CNSHARED_TIMEOUT 900000
+#define CNSHARED_TIMEOUT 300000
 #define CNSHARED_PERIOD 30000
 
 struct LoginMetadata {
     uint64_t FEKey;
-    Player plr;
+    int32_t playerId;
     time_t timestamp;
 };
 

src/core/CNStructs.hpp

@@ -29,8 +29,8 @@
 #define INITSTRUCT(T, x) T x; \
     memset(&x, 0, sizeof(T));
 
-#define INITVARPACKET(_buf, _Pkt, _pkt, _Trailer, _trailer) uint8_t _buf[CN_PACKET_BUFFER_SIZE]; \
-    memset(&_buf, 0, CN_PACKET_BUFFER_SIZE); \
+#define INITVARPACKET(_buf, _Pkt, _pkt, _Trailer, _trailer) uint8_t _buf[CN_PACKET_BODY_SIZE]; \
+    memset(&_buf, 0, CN_PACKET_BODY_SIZE); \
     auto _pkt = (_Pkt*)_buf; \
     auto _trailer = (_Trailer*)(_pkt + 1);
 
@@ -40,6 +40,7 @@
 
 // wrapper for U16toU8
 #define ARRLEN(x) (sizeof(x)/sizeof(*x))
+#define AUTOU8(x) std::string((char*)x, ARRLEN(x))
 #define AUTOU16TOU8(x) U16toU8(x, ARRLEN(x)) 
 
 // TODO: rewrite U16toU8 & U8toU16 to not use codecvt
@@ -48,15 +49,18 @@ std::string U16toU8(char16_t* src, size_t max);
 size_t U8toU16(std::string src, char16_t* des, size_t max); // returns number of char16_t that was written at des
 time_t getTime();
 time_t getTimestamp();
+int timingSafeStrcmp(const char* a, const char* b);
 void terminate(int);
 
-// The PROTOCOL_VERSION definition is defined by the build system.
+// The PROTOCOL_VERSION definition can be defined by the build system.
 #if !defined(PROTOCOL_VERSION)
+    #define PROTOCOL_VERSION 104
+#endif
+
+#if PROTOCOL_VERSION == 104
     #include "structs/0104.hpp"
 #elif PROTOCOL_VERSION == 728
     #include "structs/0728.hpp"
-#elif PROTOCOL_VERSION == 104
-    #include "structs/0104.hpp"
 #elif PROTOCOL_VERSION == 1013
     #include "structs/1013.hpp"
 #else

src/core/Defines.hpp

@@ -1,6 +1,8 @@
 /* enum definitions from the client */
 #pragma once
 
+#include "core/CNStructs.hpp"
+
 // floats
 const float VALUE_BATTERY_EMPTY_PENALTY = 0.5f;
 const float CN_EP_RANK_1 = 0.8f;
@@ -46,49 +48,8 @@ enum class ePCRegenType {
     End
 };
 
-// nano powers
+// nano power flags
 enum {
-    EST_NONE = 0,
-    EST_DAMAGE = 1,
-    EST_HEAL_HP = 2,
-    EST_KNOCKDOWN = 3,
-    EST_SLEEP = 4,
-    EST_SNARE = 5,
-    EST_HEAL_STAMINA = 6,
-    EST_STAMINA_SELF = 7,
-    EST_STUN = 8,
-    EST_WEAPONSLOW = 9,
-    EST_JUMP = 10,
-    EST_RUN = 11,
-    EST_STEALTH = 12,
-    EST_SWIM = 13,
-    EST_MINIMAPENEMY = 14,
-    EST_MINIMAPTRESURE = 15,
-    EST_PHOENIX = 16,
-    EST_PROTECTBATTERY = 17,
-    EST_PROTECTINFECTION = 18,
-    EST_REWARDBLOB = 19,
-    EST_REWARDCASH = 20,
-    EST_BATTERYDRAIN = 21,
-    EST_CORRUPTIONATTACK = 22,
-    EST_INFECTIONDAMAGE = 23,
-    EST_KNOCKBACK = 24,
-    EST_FREEDOM = 25,
-    EST_PHOENIX_GROUP = 26,
-    EST_RECALL = 27,
-    EST_RECALL_GROUP = 28,
-    EST_RETROROCKET_SELF = 29,
-    EST_BLOODSUCKING = 30,
-    EST_BOUNDINGBALL = 31,
-    EST_INVULNERABLE = 32,
-    EST_NANOSTIMPAK = 33,
-    EST_RETURNHOMEHEAL = 34,
-    EST_BUFFHEAL = 35,
-    EST_EXTRABANK = 36,
-    EST__END = 37,
-    EST_CORRUPTIONATTACKWIN = 38,
-    EST_CORRUPTIONATTACKLOSE = 39,
-
     ECSB_NONE = 0,
     ECSB_UP_MOVE_SPEED = 1,
     ECSB_UP_SWIM_SPEED = 2,
@@ -451,7 +412,13 @@ enum {
     SEND_ANYCAST_NEW = 3,
     SEND_BROADCAST = 4,
 
+#if PROTOCOL_VERSION == 728
+    CN_PACKET_BUFFER_SIZE = 8192,
+#elif PROTOCOL_VERSION == 1013
+    CN_PACKET_BUFFER_SIZE = 8192,
+#else
     CN_PACKET_BUFFER_SIZE = 4096,
+#endif
 
     P_CL2LS_REQ_LOGIN = 0x12000001,		// 301989889
     P_CL2LS_REQ_CHECK_CHAR_NAME = 0x12000002,		// 301989890
@@ -975,3 +942,8 @@ enum {
 
     N_PACKETS = N_CL2LS + N_CL2FE + N_FE2CL + N_LS2CL
 };
+
+/*
+ * Usable space in the packet buffer = CN_PACKET_BUFFER_SIZE - type - size
+ */
+constexpr size_t CN_PACKET_BODY_SIZE = CN_PACKET_BUFFER_SIZE - 2 * sizeof(int32_t);

src/core/Packets.cpp

@@ -235,7 +235,7 @@ std::map<uint32_t, PacketDesc> Packets::packets = {
     PACKET(P_FE2CL_REP_PC_EXIT_FAIL),
     PACKET(P_FE2CL_REP_PC_EXIT_SUCC),
     PACKET(P_FE2CL_PC_EXIT),
-    PACKET(P_FE2CL_PC_AROUND),
+    VAR_PACKET(P_FE2CL_PC_AROUND, iPCCnt, sPCAppearanceData),
     PACKET(P_FE2CL_PC_MOVE),
     PACKET(P_FE2CL_PC_STOP),
     PACKET(P_FE2CL_PC_JUMP),
@@ -243,9 +243,9 @@ std::map<uint32_t, PacketDesc> Packets::packets = {
     PACKET(P_FE2CL_NPC_EXIT),
     PACKET(P_FE2CL_NPC_MOVE),
     PACKET(P_FE2CL_NPC_NEW),
-    PACKET(P_FE2CL_NPC_AROUND),
-    PACKET(P_FE2CL_AROUND_DEL_PC),
-    PACKET(P_FE2CL_AROUND_DEL_NPC),
+    VAR_PACKET(P_FE2CL_NPC_AROUND, iNPCCnt, sNPCAppearanceData),
+    VAR_PACKET(P_FE2CL_AROUND_DEL_PC, iPCCnt, int32_t),
+    VAR_PACKET(P_FE2CL_AROUND_DEL_NPC, iNPCCnt, int32_t),
     PACKET(P_FE2CL_REP_SEND_FREECHAT_MESSAGE_SUCC),
     PACKET(P_FE2CL_REP_SEND_FREECHAT_MESSAGE_FAIL),
     VAR_PACKET(P_FE2CL_PC_ATTACK_NPCs_SUCC, iNPCCnt, sAttackResult),
@@ -387,8 +387,8 @@ std::map<uint32_t, PacketDesc> Packets::packets = {
     PACKET(P_FE2CL_TRANSPORTATION_EXIT),
     PACKET(P_FE2CL_TRANSPORTATION_MOVE),
     PACKET(P_FE2CL_TRANSPORTATION_NEW),
-    PACKET(P_FE2CL_TRANSPORTATION_AROUND),
-    PACKET(P_FE2CL_AROUND_DEL_TRANSPORTATION),
+    VAR_PACKET(P_FE2CL_TRANSPORTATION_AROUND, iCnt, sTransportationAppearanceData),
+    VAR_PACKET(P_FE2CL_AROUND_DEL_TRANSPORTATION, iCnt, int32_t),
     PACKET(P_FE2CL_REP_EP_RANK_LIST),
     PACKET(P_FE2CL_REP_EP_RANK_DETAIL),
     PACKET(P_FE2CL_REP_EP_RANK_PC_INFO),
@@ -404,8 +404,8 @@ std::map<uint32_t, PacketDesc> Packets::packets = {
     PACKET(P_FE2CL_SHINY_ENTER),
     PACKET(P_FE2CL_SHINY_EXIT),
     PACKET(P_FE2CL_SHINY_NEW),
-    PACKET(P_FE2CL_SHINY_AROUND),
-    PACKET(P_FE2CL_AROUND_DEL_SHINY),
+    VAR_PACKET(P_FE2CL_SHINY_AROUND, iShinyCnt, sShinyAppearanceData),
+    VAR_PACKET(P_FE2CL_AROUND_DEL_SHINY, iShinyCnt, int32_t),
     PACKET(P_FE2CL_REP_SHINY_PICKUP_FAIL),
     PACKET(P_FE2CL_REP_SHINY_PICKUP_SUCC),
     PACKET(P_FE2CL_PC_MOVETRANSPORTATION),

src/db/Database.hpp

@@ -5,7 +5,7 @@
 #include <string>
 #include <vector>
 
-#define DATABASE_VERSION 4
+#define DATABASE_VERSION 6
 
 namespace Database {
 
@@ -41,24 +41,35 @@ namespace Database {
         uint64_t Timestamp;
     };
     
+    void init();
     void open();
     void close();
 
     void findAccount(Account* account, std::string login);
-    // returns ID, 0 if something failed
+
+    // return ID, 0 if something failed
+    int getAccountIdForPlayer(int playerId);
     int addAccount(std::string login, std::string password);
 
+    void updateAccountLevel(int accountId, int accountLevel);
+
+    // return true if cookie is valid for the account.
+    // invalidates the stored cookie afterwards
+    bool checkCookie(int accountId, const char *cookie);
+    void refreshCookie(int accountId, int durationSec);
+
     // interface for the /ban command
     bool banPlayer(int playerId, std::string& reason);
     bool unbanPlayer(int playerId);
 
-    void updateSelected(int accountId, int playerId);
+    void updateSelected(int accountId, int slot);
+    void updateSelectedByPlayerId(int accountId, int playerId);
     
     bool validateCharacter(int characterID, int userID);
     bool isNameFree(std::string firstName, std::string lastName);
     bool isSlotFree(int accountId, int slotNum);
     /// returns ID, 0 if something failed
-    int createCharacter(sP_CL2LS_REQ_SAVE_CHAR_NAME* save, int AccountID);
+    int createCharacter(int slot, int accountId, const char* firstName, const char* lastName, int nameCheck);
     /// returns true if query succeeded
     bool finishCharacter(sP_CL2LS_REQ_CHAR_CREATE* character, int accountId);
     /// returns true if query succeeded
@@ -74,11 +85,13 @@ namespace Database {
     };
     void evaluateCustomName(int characterID, CustomName decision);
     /// returns true if query succeeded
-    bool changeName(sP_CL2LS_REQ_CHANGE_CHAR_NAME* save, int accountId);
+    bool changeName(int playerId, int accountId, const char* firstName, const char* lastName, int nameCheck);
 
     // getting players
     void getPlayer(Player* plr, int id);
+    bool _updatePlayer(Player *player);
     void updatePlayer(Player *player);
+    void commitTrade(Player *plr1, Player *plr2);
     
     // buddies
     int getNumBuddies(Player* player);
@@ -98,7 +111,7 @@ namespace Database {
     void deleteEmailAttachments(int playerID, int index, int slot);
     void deleteEmails(int playerID, int64_t* indices);
     int getNextEmailIndex(int playerID);
-    bool sendEmail(EmailData* data, std::vector<sItemBase> attachments);
+    bool sendEmail(EmailData* data, std::vector<sItemBase> attachments, Player *sender);
 
     // racing
     RaceRanking getTopRaceRanking(int epID, int playerID);

src/db/email.cpp

@@ -152,7 +152,8 @@ void Database::updateEmailContent(EmailData* data) {
     sqlite3_step(stmt);
     int attachmentsCount = sqlite3_column_int(stmt, 0);
 
-    data->ItemFlag = (data->Taros > 0 || attachmentsCount > 0) ? 1 : 0; // set attachment flag dynamically
+    // set attachment flag dynamically
+    data->ItemFlag = (data->Taros > 0 || attachmentsCount > 0) ? 1 : 0;
 
     sqlite3_finalize(stmt);
 
@@ -265,7 +266,7 @@ int Database::getNextEmailIndex(int playerID) {
     return (index > 0 ? index + 1 : 1);
 }
 
-bool Database::sendEmail(EmailData* data, std::vector<sItemBase> attachments) {
+bool Database::sendEmail(EmailData* data, std::vector<sItemBase> attachments, Player *sender) {
     std::lock_guard<std::mutex> lock(dbCrit);
 
     sqlite3_exec(db, "BEGIN TRANSACTION;", NULL, NULL, NULL);
@@ -330,6 +331,13 @@ bool Database::sendEmail(EmailData* data, std::vector<sItemBase> attachments) {
         sqlite3_reset(stmt);
     }
     sqlite3_finalize(stmt);
+
+    if (!_updatePlayer(sender)) {
+        std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
+        sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
+        return false;
+    }
+
     sqlite3_exec(db, "COMMIT;", NULL, NULL, NULL);
     return true;
 }

src/db/init.cpp

@@ -226,17 +226,31 @@ static void createTables() {
 static int getTableSize(std::string tableName) {
     std::lock_guard<std::mutex> lock(dbCrit); // XXX
 
-    const char* sql = "SELECT COUNT(*) FROM ?";
+    // you aren't allowed to bind the table name
+    const char* sql = "SELECT COUNT(*) FROM ";
+    tableName.insert(0, sql);
     sqlite3_stmt* stmt;
-    sqlite3_prepare_v2(db, sql, -1, &stmt, NULL);
-    sqlite3_bind_text(stmt, 1, tableName.c_str(), -1, NULL);
+    sqlite3_prepare_v2(db, tableName.c_str(), -1, &stmt, NULL);
     sqlite3_step(stmt);
     int result = sqlite3_column_int(stmt, 0);
     sqlite3_finalize(stmt);
     return result;
 }
 
+void Database::init() {
+    std::cout << "[INFO] Built with libsqlite " SQLITE_VERSION << std::endl;
+
+    if (sqlite3_libversion_number() != SQLITE_VERSION_NUMBER)
+        std::cout << "[INFO] Using libsqlite " << std::string(sqlite3_libversion()) << std::endl;
+
+    if (sqlite3_libversion_number() < MIN_SUPPORTED_SQLITE_NUMBER) {
+        std::cerr << "[FATAL] Runtime sqlite version too old. Minimum compatible version: " MIN_SUPPORTED_SQLITE << std::endl;
+        exit(1);
+    }
+}
+
 void Database::open() {
+
     // XXX: move locks here
     int rc = sqlite3_open(settings::DBPATH.c_str(), &db);
     if (rc != SQLITE_OK) {
@@ -253,17 +267,17 @@ void Database::open() {
     checkMetaTable();
     createTables();
 
-    std::cout << "[INFO] Database in operation ";
+    std::cout << "[INFO] Database in operation";
     int accounts = getTableSize("Accounts");
     int players = getTableSize("Players");
     std::string message = "";
     if (accounts > 0) {
-        message += ": Found " + std::to_string(accounts) + " Account";
+        message += ": Found " + std::to_string(accounts) + " account";
         if (accounts > 1)
             message += "s";
     }
     if (players > 0) {
-        message += " and " + std::to_string(players) + " Player Character";
+        message += " and " + std::to_string(players) + " player";
         if (players > 1)
             message += "s";
     }

src/db/internal.hpp

@@ -3,6 +3,15 @@
 #include "db/Database.hpp"
 #include <sqlite3.h>
 
+#define MIN_SUPPORTED_SQLITE_NUMBER 3033000
+#define MIN_SUPPORTED_SQLITE "3.33.0"
+// we can't use this in #error, since it doesn't expand macros
+
+// Compile-time libsqlite version check
+#if SQLITE_VERSION_NUMBER < MIN_SUPPORTED_SQLITE_NUMBER
+#error libsqlite version too old. Minimum compatible version: 3.33.0
+#endif
+
 extern std::mutex dbCrit;
 extern sqlite3 *db;
 

src/db/login.cpp

@@ -1,5 +1,9 @@
+#include "core/CNStructs.hpp"
+
 #include "db/internal.hpp"
 
+#include "servers/CNLoginServer.hpp"
+
 #include "bcrypt/BCrypt.hpp"
 
 void Database::findAccount(Account* account, std::string login) {
@@ -27,6 +31,32 @@ void Database::findAccount(Account* account, std::string login) {
     sqlite3_finalize(stmt);
 }
 
+int Database::getAccountIdForPlayer(int playerId) {
+    std::lock_guard<std::mutex> lock(dbCrit);
+
+    const char* sql = R"(
+        SELECT AccountID
+        FROM Players
+        WHERE PlayerID = ?
+        LIMIT 1;
+        )";
+    sqlite3_stmt* stmt;
+
+    sqlite3_prepare_v2(db, sql, -1, &stmt, NULL);
+    sqlite3_bind_int(stmt, 1, playerId);
+
+    int rc = sqlite3_step(stmt);
+    if (rc != SQLITE_ROW) {
+        std::cout << "[WARN] Database: couldn't get account id for player " << playerId << std::endl;
+        sqlite3_finalize(stmt);
+        return 0;
+    }
+
+    int accountId = sqlite3_column_int(stmt, 0);
+    sqlite3_finalize(stmt);
+    return accountId;
+}
+
 int Database::addAccount(std::string login, std::string password) {
     std::lock_guard<std::mutex> lock(dbCrit);
 
@@ -52,6 +82,98 @@ int Database::addAccount(std::string login, std::string password) {
     return sqlite3_last_insert_rowid(db);
 }
 
+void Database::updateAccountLevel(int accountId, int accountLevel) {
+    std::lock_guard<std::mutex> lock(dbCrit);
+
+    const char* sql = R"(
+        UPDATE Accounts SET
+            AccountLevel = ?
+        WHERE AccountID = ?;
+        )";
+    sqlite3_stmt* stmt;
+
+    sqlite3_prepare_v2(db, sql, -1, &stmt, NULL);
+    sqlite3_bind_int(stmt, 1, accountLevel);
+    sqlite3_bind_int(stmt, 2, accountId);
+
+    int rc = sqlite3_step(stmt);
+    if (rc != SQLITE_DONE)
+        std::cout << "[WARN] Database fail on updateAccountLevel(): " << sqlite3_errmsg(db) << std::endl;
+    sqlite3_finalize(stmt);
+}
+
+bool Database::checkCookie(int accountId, const char *tryCookie) {
+    std::lock_guard<std::mutex> lock(dbCrit);
+
+    const char* sql_get = R"(
+        SELECT Cookie
+        FROM Auth
+        WHERE AccountID = ? AND Expires > ?;
+        )";
+
+    const char* sql_invalidate = R"(
+        UPDATE Auth
+        SET Expires = 0
+        WHERE AccountID = ?;
+        )";
+
+    sqlite3_stmt* stmt;
+
+    sqlite3_prepare_v2(db, sql_get, -1, &stmt, NULL);
+    sqlite3_bind_int(stmt, 1, accountId);
+    sqlite3_bind_int(stmt, 2, getTimestamp());
+    int rc = sqlite3_step(stmt);
+    if (rc != SQLITE_ROW) {
+        sqlite3_finalize(stmt);
+        return false;
+    }
+
+    const char *cookie = reinterpret_cast<const char*>(sqlite3_column_text(stmt, 0));
+    if (strlen(cookie) != strlen(tryCookie)) {
+        sqlite3_finalize(stmt);
+        return false;
+    }
+
+    bool match = (timingSafeStrcmp(cookie, tryCookie) == 0);
+    sqlite3_finalize(stmt);
+
+    /*
+     * Only invalidate the cookie if it was correct. This prevents
+     * replay attacks without enabling DOS attacks on accounts.
+     */
+    if (match) {
+        sqlite3_prepare_v2(db, sql_invalidate, -1, &stmt, NULL);
+        sqlite3_bind_int(stmt, 1, accountId);
+        rc = sqlite3_step(stmt);
+        sqlite3_finalize(stmt);
+        if (rc != SQLITE_DONE)
+            std::cout << "[WARN] Database fail on checkCookie(): " << sqlite3_errmsg(db) << std::endl;
+    }
+
+    return match;
+}
+
+void Database::refreshCookie(int accountId, int durationSec) {
+    std::lock_guard<std::mutex> lock(dbCrit);
+
+    const char* sql = R"(
+        UPDATE Auth
+        SET Expires = ?
+        WHERE AccountID = ?;
+        )";
+    
+    int expires = getTimestamp() + durationSec;
+
+    sqlite3_stmt* stmt;
+    sqlite3_prepare_v2(db, sql, -1, &stmt, NULL);
+    sqlite3_bind_int(stmt, 1, expires);
+    sqlite3_bind_int(stmt, 2, accountId);
+    int rc = sqlite3_step(stmt);
+    sqlite3_finalize(stmt);
+    if (rc != SQLITE_DONE)
+        std::cout << "[WARN] Database fail on refreshCookie(): " << sqlite3_errmsg(db) << std::endl;
+}
+
 void Database::updateSelected(int accountId, int slot) {
     std::lock_guard<std::mutex> lock(dbCrit);
 
@@ -79,6 +201,29 @@ void Database::updateSelected(int accountId, int slot) {
         std::cout << "[WARN] Database fail on updateSelected(): " << sqlite3_errmsg(db) << std::endl;
 }
 
+void Database::updateSelectedByPlayerId(int accountId, int32_t playerId) {
+    std::lock_guard<std::mutex> lock(dbCrit);
+
+    const char* sql = R"(
+        UPDATE Accounts SET
+            Selected = p.Slot,
+            LastLogin = (strftime('%s', 'now'))
+        FROM (SELECT Slot From Players WHERE PlayerId = ?) AS p
+        WHERE AccountID = ?;
+        )";
+
+    sqlite3_stmt* stmt;
+
+    sqlite3_prepare_v2(db, sql, -1, &stmt, NULL);
+    sqlite3_bind_int(stmt, 1, playerId);
+    sqlite3_bind_int(stmt, 2, accountId);
+    int rc = sqlite3_step(stmt);
+    sqlite3_finalize(stmt);
+
+    if (rc != SQLITE_DONE)
+        std::cout << "[WARN] Database fail on updateSelectedByPlayerId(): " << sqlite3_errmsg(db) << std::endl;
+}
+
 bool Database::validateCharacter(int characterID, int userID) {
     std::lock_guard<std::mutex> lock(dbCrit);
 
@@ -148,7 +293,7 @@ bool Database::isSlotFree(int accountId, int slotNum) {
     return result;
 }
 
-int Database::createCharacter(sP_CL2LS_REQ_SAVE_CHAR_NAME* save, int AccountID) {
+int Database::createCharacter(int slot, int accountId, const char* firstName, const char* lastName, int nameCheck) {
     std::lock_guard<std::mutex> lock(dbCrit);
 
     sqlite3_exec(db, "BEGIN TRANSACTION;", NULL, NULL, NULL);
@@ -161,22 +306,17 @@ int Database::createCharacter(sP_CL2LS_REQ_SAVE_CHAR_NAME* save, int AccountID)
         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?);
         )";
     sqlite3_stmt* stmt;
-    std::string firstName = AUTOU16TOU8(save->szFirstName);
-    std::string lastName =  AUTOU16TOU8(save->szLastName);
 
     sqlite3_prepare_v2(db, sql, -1, &stmt, NULL);
-    sqlite3_bind_int(stmt, 1, AccountID);
-    sqlite3_bind_int(stmt, 2, save->iSlotNum);
-    sqlite3_bind_text(stmt, 3, firstName.c_str(), -1, NULL);
-    sqlite3_bind_text(stmt, 4, lastName.c_str(), -1, NULL);
+    sqlite3_bind_int(stmt, 1, accountId);
+    sqlite3_bind_int(stmt, 2, slot);
+    sqlite3_bind_text(stmt, 3, firstName, -1, NULL);
+    sqlite3_bind_text(stmt, 4, lastName, -1, NULL);
     sqlite3_bind_int(stmt, 5, settings::SPAWN_X);
     sqlite3_bind_int(stmt, 6, settings::SPAWN_Y);
     sqlite3_bind_int(stmt, 7, settings::SPAWN_Z);
     sqlite3_bind_int(stmt, 8, settings::SPAWN_ANGLE);
     sqlite3_bind_int(stmt, 9, PC_MAXHEALTH(1));
-
-    // if FNCode isn't 0, it's a wheel name
-    int nameCheck = (settings::APPROVEALLNAMES || save->iFNCode) ? 1 : 0;
     sqlite3_bind_int(stmt, 10, nameCheck);
 
     // blobs
@@ -505,7 +645,7 @@ void Database::evaluateCustomName(int characterID, CustomName decision) {
     sqlite3_finalize(stmt);
 }
 
-bool Database::changeName(sP_CL2LS_REQ_CHANGE_CHAR_NAME* save, int accountId) {
+bool Database::changeName(int playerId, int accountId, const char* firstName, const char* lastName, int nameCheck) {
     std::lock_guard<std::mutex> lock(dbCrit);
 
     const char* sql = R"(
@@ -519,15 +659,10 @@ bool Database::changeName(sP_CL2LS_REQ_CHANGE_CHAR_NAME* save, int accountId) {
     sqlite3_stmt* stmt;
     sqlite3_prepare_v2(db, sql, -1, &stmt, NULL);
 
-    std::string firstName = AUTOU16TOU8(save->szFirstName);
-    std::string lastName = AUTOU16TOU8(save->szLastName);
-
-    sqlite3_bind_text(stmt, 1, firstName.c_str(), -1, NULL);
-    sqlite3_bind_text(stmt, 2, lastName.c_str(), -1, NULL);
-    // if FNCode isn't 0, it's a wheel name
-    int nameCheck = (settings::APPROVEALLNAMES || save->iFNCode) ? 1 : 0;
+    sqlite3_bind_text(stmt, 1, firstName, -1, NULL);
+    sqlite3_bind_text(stmt, 2, lastName, -1, NULL);
     sqlite3_bind_int(stmt, 3, nameCheck);
-    sqlite3_bind_int(stmt, 4, save->iPCUID);
+    sqlite3_bind_int(stmt, 4, playerId);
     sqlite3_bind_int(stmt, 5, accountId);
 
     int rc = sqlite3_step(stmt);

src/db/player.cpp

@@ -285,11 +285,13 @@ void Database::getPlayer(Player* plr, int id) {
     sqlite3_finalize(stmt);
 }
 
-void Database::updatePlayer(Player *player) {
-    std::lock_guard<std::mutex> lock(dbCrit);
-
-    sqlite3_exec(db, "BEGIN TRANSACTION;", NULL, NULL, NULL);
-
+/*
+ * Low-level function to save a player to DB.
+ * Must be run in a SQL transaction and with dbCrit locked.
+ * The caller manages the transacstion, so if this function returns false,
+ * the caller must roll it back.
+ */
+bool Database::_updatePlayer(Player *player) {
     const char* sql = R"(
         UPDATE Players
         SET
@@ -336,10 +338,8 @@ void Database::updatePlayer(Player *player) {
     sqlite3_bind_int(stmt, 21, player->iID);
 
     if (sqlite3_step(stmt) != SQLITE_DONE) {
-        std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
         sqlite3_finalize(stmt);
-        sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
-        return;
+        return false;
     }
 
     sqlite3_finalize(stmt);
@@ -375,10 +375,8 @@ void Database::updatePlayer(Player *player) {
         rc = sqlite3_step(stmt);
 
         if (rc != SQLITE_DONE) {
-            std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
-            sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
             sqlite3_finalize(stmt);
-            return;
+            return false;
         }
         sqlite3_reset(stmt);
     }
@@ -395,10 +393,8 @@ void Database::updatePlayer(Player *player) {
         sqlite3_bind_int(stmt, 6, player->Inven[i].iTimeLimit);
 
         if (sqlite3_step(stmt) != SQLITE_DONE) {
-            std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
-            sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
             sqlite3_finalize(stmt);
-            return;
+            return false;
         }
         sqlite3_reset(stmt);
     }
@@ -415,10 +411,8 @@ void Database::updatePlayer(Player *player) {
         sqlite3_bind_int(stmt, 6, player->Bank[i].iTimeLimit);
 
         if (sqlite3_step(stmt) != SQLITE_DONE) {
-            std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
-            sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
             sqlite3_finalize(stmt);
-            return;
+            return false;
         }
         sqlite3_reset(stmt);
     }
@@ -451,10 +445,8 @@ void Database::updatePlayer(Player *player) {
         sqlite3_bind_int(stmt, 4, player->QInven[i].iID);
 
         if (sqlite3_step(stmt) != SQLITE_DONE) {
-            std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
-            sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
             sqlite3_finalize(stmt);
-            return;
+            return false;
         }
         sqlite3_reset(stmt);
     }
@@ -487,10 +479,8 @@ void Database::updatePlayer(Player *player) {
         sqlite3_bind_int(stmt, 4, player->Nanos[i].iStamina);
 
         if (sqlite3_step(stmt) != SQLITE_DONE) {
-            std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
-            sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
             sqlite3_finalize(stmt);
-            return;
+            return false;
         }
         sqlite3_reset(stmt);
     }
@@ -524,14 +514,47 @@ void Database::updatePlayer(Player *player) {
         sqlite3_bind_int(stmt, 5, player->RemainingNPCCount[i][2]);
 
         if (sqlite3_step(stmt) != SQLITE_DONE) {
-            std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
-            sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
             sqlite3_finalize(stmt);
-            return;
+            return false;
         }
         sqlite3_reset(stmt);
     }
 
-    sqlite3_exec(db, "COMMIT;", NULL, NULL, NULL);
     sqlite3_finalize(stmt);
+
+    return true;
+}
+
+void Database::updatePlayer(Player *player) {
+    std::lock_guard<std::mutex> lock(dbCrit);
+
+    sqlite3_exec(db, "BEGIN TRANSACTION;", NULL, NULL, NULL);
+
+    if (!_updatePlayer(player)) {
+        std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
+        sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
+        return;
+    }
+
+    sqlite3_exec(db, "COMMIT;", NULL, NULL, NULL);
+}
+
+void Database::commitTrade(Player *plr1, Player *plr2) {
+    std::lock_guard<std::mutex> lock(dbCrit);
+
+    sqlite3_exec(db, "BEGIN TRANSACTION;", NULL, NULL, NULL);
+
+    if (!_updatePlayer(plr1)) {
+        std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
+        sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
+        return;
+    }
+
+    if (!_updatePlayer(plr2)) {
+        std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
+        sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
+        return;
+    }
+
+    sqlite3_exec(db, "COMMIT;", NULL, NULL, NULL);
 }

src/db/shard.cpp

@@ -208,6 +208,8 @@ void Database::addBlock(int playerId, int blockedPlayerId) {
 }
 
 void Database::removeBlock(int playerId, int blockedPlayerId) {
+    std::lock_guard<std::mutex> lock(dbCrit);
+
     const char* sql = R"(
         DELETE FROM Blocks
         WHERE PlayerID = ? AND BlockedPlayerID = ?;

src/main.cpp

@@ -49,6 +49,7 @@ CNShardServer *shardServer = nullptr;
 std::thread *shardThread = nullptr;
 
 void startShard(CNShardServer* server) {
+    sandbox_thread_start();
     server->start();
 }
 
@@ -64,7 +65,7 @@ void terminate(int arg) {
 }
 
 #ifdef _WIN32
-static BOOL winTerminate(DWORD arg) {
+static BOOL WINAPI winTerminate(DWORD arg) {
     terminate(0);
     return FALSE;
 }
@@ -98,6 +99,9 @@ void initsignals() {
 }
 
 int main() {
+    std::cout << "[INFO] OpenFusion v" GIT_VERSION << std::endl;
+    std::cout << "[INFO] Protocol version: " << PROTOCOL_VERSION << std::endl;
+
 #ifdef _WIN32
     WSADATA wsaData;
     if (WSAStartup(MAKEWORD(1, 1), &wsaData) != 0) {
@@ -105,15 +109,15 @@ int main() {
         exit(EXIT_FAILURE);
     }
 #endif
+
     initsignals();
     settings::init();
-
-    std::cout << "[INFO] OpenFusion v" GIT_VERSION << std::endl;
-    std::cout << "[INFO] Protocol version: " << PROTOCOL_VERSION << std::endl;
-    std::cout << "[INFO] Intializing Packet Managers..." << std::endl;
-
+    Database::init();
     Rand::init(getTime());
     TableData::init();
+
+    std::cout << "[INFO] Intializing Packet Managers..." << std::endl;
+
     PlayerManager::init();
     PlayerMovement::init();
     BuiltinCommands::init();
@@ -132,9 +136,10 @@ int main() {
     Email::init();
     Groups::init();
     Racing::init();
-    Database::open();
     Trading::init();
 
+    Database::open();
+
     switch (settings::EVENTMODE) {
     case 0: break; // no event
     case 1: std::cout << "[INFO] Event active. Hey, Hey It's Knishmas!" << std::endl; break;
@@ -146,6 +151,8 @@ int main() {
         /* not reached */
     }
 
+    sandbox_init();
+
     std::cout << "[INFO] Starting Server Threads..." << std::endl;
     CNLoginServer loginServer(settings::LOGINPORT);
     shardServer = new CNShardServer(settings::SHARDPORT);
@@ -153,6 +160,7 @@ int main() {
     shardThread = new std::thread(startShard, (CNShardServer*)shardServer);
 
     sandbox_start();
+    sandbox_thread_start();
 
     loginServer.start();
 
@@ -214,6 +222,17 @@ time_t getTimestamp() {
     return (time_t)value.count();
 }
 
+// timing safe strcmp implementation for e.g. cookie validation
+int timingSafeStrcmp(const char* a, const char* b) {
+    int diff = 0;
+    while (*a && *b) {
+        diff |= *a++ ^ *b++;
+    }
+    diff |= *a;
+    diff |= *b;
+    return diff;
+}
+
 // convert integer timestamp (in s) to FF systime struct
 sSYSTEMTIME timeStampToStruct(uint64_t time) {
 

src/sandbox/Sandbox.hpp

@@ -4,11 +4,16 @@
 #if defined(__linux__) || defined(__OpenBSD__)
 
 # if !defined(CONFIG_NOSANDBOX)
+void sandbox_init();
 void sandbox_start();
+void sandbox_thread_start();
 # else
 
 #include <iostream>
 
+inline void sandbox_init() {}
+inline void sandbox_thread_start() {}
+
 inline void sandbox_start() {
     std::cout << "[WARN] Built without a sandbox" << std::endl;
 }
@@ -17,5 +22,7 @@ inline void sandbox_start() {
 
 #else
 // stub for unsupported platforms
+inline void sandbox_init() {}
 inline void sandbox_start() {}
+inline void sandbox_thread_start() {}
 #endif

src/sandbox/openbsd.cpp

@@ -13,6 +13,9 @@ static void eunveil(const char *path, const char *permissions) {
         err(1, "unveil");
 }
 
+void sandbox_init() {}
+void sandbox_thread_start() {}
+
 void sandbox_start() {
     /*
      * There shouldn't ever be a reason to disable this one, but might as well

src/sandbox/seccomp.cpp

@@ -4,6 +4,9 @@
 #include "settings.hpp"
 
 #include <stdlib.h>
+#include <fcntl.h>
+
+#include <filesystem>
 
 #include <sys/prctl.h>
 #include <sys/ptrace.h>
@@ -17,6 +20,10 @@
 #include <linux/audit.h>
 #include <linux/net.h> // for socketcall() args
 
+#ifndef CONFIG_NOLANDLOCK
+#include <linux/landlock.h>
+#endif
+
 /*
  * Macros adapted from https://outflux.net/teach-seccomp/
  * Relevant license:
@@ -54,7 +61,7 @@
     BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO|(_errno))
 
 #define KILL_PROCESS \
-    BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL_PROCESS)
+    BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_TRAP)
 
 /*
  * Macros adapted from openssh's sandbox-seccomp-filter.c
@@ -153,15 +160,18 @@ static sock_filter filter[] = {
     ALLOW_SYSCALL(read),
     ALLOW_SYSCALL(write),
     ALLOW_SYSCALL(close),
-#if __NR_stat
+#ifdef __NR_stat
     ALLOW_SYSCALL(stat),
 #endif
     ALLOW_SYSCALL(fstat),
+#ifdef __NR_newfstatat
+    ALLOW_SYSCALL(newfstatat),
+#endif
     ALLOW_SYSCALL(fsync), // maybe
-#if __NR_creat
+#ifdef __NR_creat
     ALLOW_SYSCALL(creat), // maybe; for DB journal
 #endif
-#if __NR_unlink
+#ifdef __NR_unlink
     ALLOW_SYSCALL(unlink), // for DB journal
 #endif
     ALLOW_SYSCALL(lseek), // musl-libc; alt DB
@@ -192,6 +202,9 @@ static sock_filter filter[] = {
     ALLOW_SYSCALL(exit_group),
     ALLOW_SYSCALL(rt_sigprocmask), // musl-libc
     ALLOW_SYSCALL(clock_nanosleep), // gets called very rarely
+#ifdef __NR_rseq
+    ALLOW_SYSCALL(rseq),
+#endif
 
     // to crash properly on SIGSEGV
     DENY_SYSCALL_ERRNO(tgkill, EPERM),
@@ -274,7 +287,7 @@ static sock_filter filter[] = {
 #endif
 
     // AArch64 (ARM64)
-#if __NR_unlinkat
+#ifdef __NR_unlinkat
     ALLOW_SYSCALL(unlinkat),
 #endif
 #ifdef __NR_fstatat64
@@ -291,25 +304,201 @@ static sock_fprog prog = {
     ARRLEN(filter), filter
 };
 
-// our own wrapper for the seccomp() syscall
+// Our own wrapper for the seccomp() syscall.
 int seccomp(unsigned int operation, unsigned int flags, void *args) {
     return syscall(__NR_seccomp, operation, flags, args);
 }
 
-void sandbox_start() {
+#ifndef CONFIG_NOLANDLOCK
+
+// Support compilation on systems that only have older Landlock headers.
+#ifndef LANDLOCK_ACCESS_FS_REFER
+#define LANDLOCK_ACCESS_FS_REFER 0
+#endif
+#ifndef LANDLOCK_ACCESS_FS_TRUNCATE
+#define LANDLOCK_ACCESS_FS_TRUNCATE 0
+#endif
+
+struct landlock_ruleset_attr ruleset_attr = {
+    .handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE
+        | LANDLOCK_ACCESS_FS_WRITE_FILE
+        | LANDLOCK_ACCESS_FS_READ_DIR
+        | LANDLOCK_ACCESS_FS_MAKE_REG
+        | LANDLOCK_ACCESS_FS_MAKE_DIR
+        | LANDLOCK_ACCESS_FS_MAKE_SYM
+        | LANDLOCK_ACCESS_FS_MAKE_SOCK
+        | LANDLOCK_ACCESS_FS_MAKE_FIFO
+        | LANDLOCK_ACCESS_FS_MAKE_BLOCK
+        | LANDLOCK_ACCESS_FS_REMOVE_FILE
+        | LANDLOCK_ACCESS_FS_REMOVE_DIR
+        | LANDLOCK_ACCESS_FS_TRUNCATE
+        | LANDLOCK_ACCESS_FS_REFER
+};
+
+uint64_t landlock_perms = LANDLOCK_ACCESS_FS_READ_FILE
+    | LANDLOCK_ACCESS_FS_WRITE_FILE
+    | LANDLOCK_ACCESS_FS_TRUNCATE
+    | LANDLOCK_ACCESS_FS_MAKE_REG
+    | LANDLOCK_ACCESS_FS_REMOVE_FILE;
+
+int landlock_fd;
+bool landlock_supported;
+
+/*
+ * Our own wrappers for Landlock syscalls.
+ */
+
+int landlock_create_ruleset(const struct landlock_ruleset_attr *attr, size_t size, uint32_t flags) {
+    return syscall(__NR_landlock_create_ruleset, attr, size, flags);
+}
+
+int landlock_add_rule(int ruleset_fd, enum landlock_rule_type rule_type, const void *rule_attr, uint32_t flags) {
+    return syscall(__NR_landlock_add_rule, ruleset_fd, rule_type, rule_attr, flags);
+}
+
+int landlock_restrict_self(int ruleset_fd, uint32_t flags) {
+    return syscall(__NR_landlock_restrict_self, ruleset_fd, flags);
+}
+
+static void landlock_path(std::string path, uint32_t perms) {
+    struct landlock_path_beneath_attr path_beneath = {
+        .allowed_access = perms
+    };
+
+    path_beneath.parent_fd = open(path.c_str(), O_PATH|O_CLOEXEC);
+    if (path_beneath.parent_fd < 0) {
+        perror(path.c_str());
+        exit(1);
+    }
+
+    if (landlock_add_rule(landlock_fd, LANDLOCK_RULE_PATH_BENEATH, &path_beneath, 0)) {
+        perror("landlock_add_rule");
+        exit(1);
+    }
+
+    close(path_beneath.parent_fd);
+}
+
+static bool landlock_detect() {
+    int abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION);
+
+    if (abi < 0) {
+        if (errno == ENOSYS || errno == EOPNOTSUPP) {
+            std::cout << "[WARN] No Landlock support on this system" << std::endl;
+            return false;
+        }
+        perror("landlock_create_ruleset");
+        exit(1);
+    }
+
+    std::cout << "[INFO] Detected Landlock ABI version: " << abi << std::endl;
+
+    switch (abi) {
+    case 1:
+        ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_REFER;
+        landlock_perms &= ~LANDLOCK_ACCESS_FS_REFER;
+        // fallthrough
+    case 2:
+        ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE;
+        landlock_perms &= ~LANDLOCK_ACCESS_FS_TRUNCATE;
+    }
+
+    return true;
+}
+
+static void landlock_init() {
+    std::cout << "[INFO] Setting up Landlock sandbox..." << std::endl;
+
+    landlock_supported = landlock_detect();
+
+    if (!landlock_supported)
+        return;
+
+    landlock_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
+    if (landlock_fd < 0) {
+        perror("landlock_create_ruleset");
+        exit(1);
+    }
+
+    std::string dbdir = std::filesystem::path(settings::DBPATH).parent_path();
+
+    // for the DB files (we can't rely on them being in the working directory)
+    landlock_path(dbdir == "" ? "." : dbdir, landlock_perms);
+    // for writing the gruntwork file
+    landlock_path(settings::TDATADIR, landlock_perms);
+    // for passowrd salting during account creation
+    landlock_path("/dev/urandom", LANDLOCK_ACCESS_FS_READ_FILE);
+    // for core dumps, optionally
+    if (settings::SANDBOXEXTRAPATH != "")
+        landlock_path(settings::SANDBOXEXTRAPATH, landlock_perms);
+}
+
+#endif // !CONFIG_NOLANDLOCK
+
+static void sigsys_handler(int signo, siginfo_t *info, void *context) {
+    // report the unhandled syscall
+    std::cout << "[FATAL] Unhandled syscall " << info->si_syscall
+       << " at " << std::hex << info->si_call_addr << " on arch " << info->si_arch << std::endl;
+
+    std::cout << "If you're unsure why this is happening, please read https://openfusion.dev/docs/development/the-sandbox/" << std::endl
+              << "for more information and possibly open an issue at https://github.com/OpenFusionProject/OpenFusion/issues to report"
+              << " needed changes in our seccomp filter." << std::endl;
+
+    exit(1);
+}
+
+void sandbox_init() {
     if (!settings::SANDBOX) {
         std::cout << "[WARN] Running without a sandbox" << std::endl;
         return;
     }
 
+    // listen to SIGSYS to report unhandled syscalls
+    struct sigaction sa = {};
+
+    sa.sa_flags = SA_SIGINFO;
+    sa.sa_sigaction = sigsys_handler;
+
+    if (sigaction(SIGSYS, &sa, NULL) < 0) {
+        perror("sigaction");
+        exit(1);
+    }
+
+#ifndef CONFIG_NOLANDLOCK
+    landlock_init();
+#else
+    std::cout << "[WARN] Built without Landlock" << std::endl;
+#endif
+}
+
+void sandbox_start() {
+    if (!settings::SANDBOX)
+        return;
+
     std::cout << "[INFO] Starting seccomp-bpf sandbox..." << std::endl;
 
+    // Sandboxing starts in sandbox_thread_start().
+}
+
+void sandbox_thread_start() {
+    if (!settings::SANDBOX)
+        return;
+
     if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
         perror("prctl");
         exit(1);
     }
 
-    if (seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, &prog) < 0) {
+#ifndef CONFIG_NOLANDLOCK
+    if (landlock_supported) {
+        if (landlock_restrict_self(landlock_fd, 0)) {
+            perror("landlock_restrict_self");
+            exit(1);
+        }
+    }
+#endif
+
+    if (seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog) < 0) {
         perror("seccomp");
         exit(1);
     }

src/servers/CNLoginServer.cpp

@@ -1,4 +1,5 @@
 #include "servers/CNLoginServer.hpp"
+#include "servers/Monitor.hpp"
 
 #include "core/CNShared.hpp"
 #include "db/Database.hpp"
@@ -12,7 +13,14 @@
 
 std::map<CNSocket*, CNLoginData> CNLoginServer::loginSessions;
 
+namespace LoginServer {
+    std::vector<std::string> WheelFirstNames;
+    std::vector<std::string> WheelMiddleNames;
+    std::vector<std::string> WheelLastNames;
+}
+
 CNLoginServer::CNLoginServer(uint16_t p) {
+    serverType = "login";
     port = p;
     pHandler = &CNLoginServer::handlePacket;
     init();
@@ -104,77 +112,63 @@ void loginFail(LoginError errorCode, std::string userLogin, CNSocket* sock) {
 
 void CNLoginServer::login(CNSocket* sock, CNPacketData* data) {
     auto login = (sP_CL2LS_REQ_LOGIN*)data->buf;
-    // TODO: implement better way of sending credentials
-    std::string userLogin((char*)login->szCookie_TEGid);
-    std::string userPassword((char*)login->szCookie_authid);
+
+    std::string userLogin;
+    std::string userToken; // could be password or auth cookie
 
     /*
-     * Sometimes the client sends garbage cookie data.
-     * Validate it as normal credentials instead of using a length check before falling back.
+     * In this context, "cookie auth" just means the credentials were sent
+     * in the szCookie fields instead of szID and szPassword.
      */
-    if (!CNLoginServer::isLoginDataGood(userLogin, userPassword)) {
-        /*
-         * The std::string -> char* -> std::string maneuver should remove any
-         * trailing garbage after the null terminator.
-         */
+    bool isCookieAuth = login->iLoginType == USE_COOKIE_FIELDS;
+
+    /*
+     * The std::string -> char* -> std::string maneuver should remove any
+     * trailing garbage after the null terminator.
+     */
+    if (isCookieAuth) {
+        userLogin = std::string(AUTOU8(login->szCookie_TEGid).c_str());
+        userToken = std::string(AUTOU8(login->szCookie_authid).c_str());
+    } else {
         userLogin = std::string(AUTOU16TOU8(login->szID).c_str());
-        userPassword = std::string(AUTOU16TOU8(login->szPassword).c_str());
+        userToken = std::string(AUTOU16TOU8(login->szPassword).c_str());
     }
 
-    // the client inserts a "\n" in the password if you press enter key in the middle of the password
-    // (not at the start or the end of the password field)
-    if (int(userPassword.find("\n")) > 0)
-        userPassword.erase(userPassword.find("\n"), 1);
-
-    // check regex
-    if (!CNLoginServer::isLoginDataGood(userLogin, userPassword)) {
-        // send a custom error message
-        INITSTRUCT(sP_FE2CL_GM_REP_PC_ANNOUNCE, msg);
-        std::string text = "Invalid login or password\n";
-        text += "Login has to be 4 - 32 characters long and can't contain special characters other than dash and underscore\n";
-        text += "Password has to be 8 - 32 characters long";          
-        U8toU16(text, msg.szAnnounceMsg, sizeof(msg.szAnnounceMsg));
-        msg.iDuringTime = 15;
-        sock->sendPacket(msg, P_FE2CL_GM_REP_PC_ANNOUNCE);
-
-        // we still have to send login fail to prevent softlock
+    if (!CNLoginServer::checkUsername(sock, userLogin)) {
         return loginFail(LoginError::LOGIN_ERROR, userLogin, sock);
     }
-        
+
+    if (!isCookieAuth) {
+        // password was sent in plaintext
+        if (!CNLoginServer::checkPassword(sock, userToken)) {
+            return loginFail(LoginError::LOGIN_ERROR, userLogin, sock);
+        }
+    }
 
     Database::Account findUser = {};
     Database::findAccount(&findUser, userLogin);
-    
+
     // account was not found
     if (findUser.AccountID == 0) {
-        if (settings::AUTOCREATEACCOUNTS)
-            return newAccount(sock, userLogin, userPassword, login->iClientVerC);
+        /*
+         * Don't auto-create accounts if it's a cookie login.
+         * It'll either be a bad cookie or a plaintext password sent by auto-login;
+         * either way, we only want to allow auto-creation if the user explicitly entered their credentials.
+         */
+        if (settings::AUTOCREATEACCOUNTS && !isCookieAuth) {
+            return newAccount(sock, userLogin, userToken, login->iClientVerC);
+        }
 
         return loginFail(LoginError::ID_DOESNT_EXIST, userLogin, sock);
     }
 
-    if (!CNLoginServer::isPasswordCorrect(findUser.Password, userPassword))
+    // make sure either a valid cookie or password was sent
+    if (!CNLoginServer::checkToken(sock, findUser, userToken, isCookieAuth)) {
         return loginFail(LoginError::ID_AND_PASSWORD_DO_NOT_MATCH, userLogin, sock);
+    }
 
-    // is the account banned
-    if (findUser.BannedUntil > getTimestamp()) {
-        // send a custom error message
-        INITSTRUCT(sP_FE2CL_GM_REP_PC_ANNOUNCE, msg);
-
-        // ceiling devision
-        int64_t remainingDays = (findUser.BannedUntil-getTimestamp()) / 86400 + ((findUser.BannedUntil - getTimestamp()) % 86400 != 0);
-
-        std::string text = "Your account has been banned. \nReason: ";
-        text += findUser.BanReason;
-        text += "\nBan expires in " + std::to_string(remainingDays) + " day";
-        if (remainingDays > 1)
-            text += "s";
-
-        U8toU16(text, msg.szAnnounceMsg, sizeof(msg.szAnnounceMsg));
-        msg.iDuringTime = 99999999;
-        sock->sendPacket(msg, P_FE2CL_GM_REP_PC_ANNOUNCE);
-        // don't send fail packet
-        return;
+    if (CNLoginServer::checkBan(sock, findUser)) {
+        return; // don't send fail packet
     }
 
     /* 
@@ -210,9 +204,12 @@ void CNLoginServer::login(CNSocket* sock, CNPacketData* data) {
     // send the resp in with original key
     sock->sendPacket(resp, P_LS2CL_REP_LOGIN_SUCC);
 
+    uint64_t defaultKey;
+    memcpy(&defaultKey, CNSocketEncryption::defaultKey, sizeof(defaultKey));
+
     // update keys
     sock->setEKey(CNSocketEncryption::createNewKey(resp.uiSvrTime, resp.iCharCount + 1, resp.iSlotNum + 1));
-    sock->setFEKey(CNSocketEncryption::createNewKey((uint64_t)(*(uint64_t*)&CNSocketEncryption::defaultKey[0]), login->iClientVerC, 1));
+    sock->setFEKey(CNSocketEncryption::createNewKey(defaultKey, login->iClientVerC, 1));
 
     DEBUGLOG(
         std::cout << "Login Server: Login success. Welcome " << userLogin << " [" << loginSessions[sock].userID << "]" << std::endl;
@@ -295,10 +292,29 @@ void CNLoginServer::nameSave(CNSocket* sock, CNPacketData* data) {
     INITSTRUCT(sP_LS2CL_REP_SAVE_CHAR_NAME_SUCC, resp);
 
     int errorCode = 0;
-    if (!CNLoginServer::isCharacterNameGood(AUTOU16TOU8(save->szFirstName), AUTOU16TOU8(save->szLastName))) {
-        errorCode = 4;
-    } else if (!Database::isNameFree(AUTOU16TOU8(save->szFirstName), AUTOU16TOU8(save->szLastName))) {
-        errorCode = 1;
+
+    std::string firstName = AUTOU16TOU8(save->szFirstName);
+    std::string lastName = AUTOU16TOU8(save->szLastName);
+    int nameCheck = 0;
+
+    // if FNCode isn't 0, it's a wheel name
+    if (save->iFNCode != 0) {
+        if (!CNLoginServer::isNameWheelNameGood(save->iFNCode, save->iMNCode, save->iLNCode, firstName, lastName)) {
+            errorCode = 4;
+        } else {
+            nameCheck = settings:: APPROVEWHEELNAMES ? 1 : 0;
+        }
+    } else {
+        // custom name
+        nameCheck = settings::APPROVECUSTOMNAMES ? 1 : 0;
+    }
+
+    if (errorCode == 0) {
+        if (!CNLoginServer::isCharacterNameGood(firstName, lastName)) {
+            errorCode = 4;
+        } else if (!Database::isNameFree(firstName, lastName)) {
+            errorCode = 1;
+        }
     }
 
     if (errorCode != 0) {
@@ -316,12 +332,19 @@ void CNLoginServer::nameSave(CNSocket* sock, CNPacketData* data) {
     if (!Database::isSlotFree(loginSessions[sock].userID, save->iSlotNum))
         return invalidCharacter(sock);
 
-    resp.iPC_UID = Database::createCharacter(save, loginSessions[sock].userID);
+    resp.iPC_UID = Database::createCharacter(save->iSlotNum, loginSessions[sock].userID, firstName.c_str(), lastName.c_str(), nameCheck);
     // if query somehow failed
     if (resp.iPC_UID == 0) {
         std::cout << "[WARN] Login Server: Database failed to create new character!" << std::endl;
         return invalidCharacter(sock);
     }
+
+    // fire name check event if needed
+    if (nameCheck != 1) {
+        std::string namereq = std::to_string(resp.iPC_UID) + " " + firstName + " " + lastName;
+        Monitor::namereqs.push_back(namereq);
+    }
+
     resp.iSlotNum = save->iSlotNum;
     resp.iGender = save->iGender;
     
@@ -337,7 +360,9 @@ void CNLoginServer::nameSave(CNSocket* sock, CNPacketData* data) {
     DEBUGLOG(
         std::cout << "Login Server: new character created" << std::endl;
         std::cout << "\tSlot: " << (int)save->iSlotNum << std::endl;
-        std::cout << "\tName: " << AUTOU16TOU8(save->szFirstName) << " " << AUTOU16TOU8(save->szLastName) << std::endl;
+        std::cout << "\tName: " << firstName << " " << lastName;
+        if (nameCheck != 1) std::cout << " (pending approval)";
+        std::cout << std::endl;
     )
 }
 
@@ -473,11 +498,7 @@ void CNLoginServer::characterSelect(CNSocket* sock, CNPacketData* data) {
     LoginMetadata *lm = new LoginMetadata();
     lm->FEKey = sock->getFEKey();
     lm->timestamp = getTime();
-
-    Database::getPlayer(&lm->plr, selection->iPC_UID);
-    // this should never happen but for extra safety
-    if (lm->plr.iID == 0)
-        return invalidCharacter(sock);
+    lm->playerId = selection->iPC_UID;
 
     resp.iEnterSerialKey = Rand::cryptoRand();
 
@@ -487,7 +508,7 @@ void CNLoginServer::characterSelect(CNSocket* sock, CNPacketData* data) {
     sock->sendPacket(resp, P_LS2CL_REP_SHARD_SELECT_SUCC);
 
     // update current slot in DB
-    Database::updateSelected(loginSessions[sock].userID, lm->plr.slot);
+    Database::updateSelectedByPlayerId(loginSessions[sock].userID, selection->iPC_UID);
 }
 
 void CNLoginServer::finishTutorial(CNSocket* sock, CNPacketData* data) {
@@ -508,11 +529,30 @@ void CNLoginServer::changeName(CNSocket* sock, CNPacketData* data) {
     auto save = (sP_CL2LS_REQ_CHANGE_CHAR_NAME*)data->buf;
 
     int errorCode = 0;
-    if (!CNLoginServer::isCharacterNameGood(AUTOU16TOU8(save->szFirstName), AUTOU16TOU8(save->szLastName))) {
-        errorCode = 4;
+
+    std::string firstName = AUTOU16TOU8(save->szFirstName);
+    std::string lastName = AUTOU16TOU8(save->szLastName);
+    int nameCheck = 0;
+
+    // if FNCode isn't 0, it's a wheel name
+    if (save->iFNCode != 0) {
+        if (!CNLoginServer::isNameWheelNameGood(save->iFNCode, save->iMNCode, save->iLNCode, firstName, lastName)) {
+            errorCode = 4;
+        } else {
+            nameCheck = settings::APPROVEWHEELNAMES ? 1 : 0;
+        }
+    } else {
+        // custom name
+        nameCheck = settings::APPROVECUSTOMNAMES ? 1 : 0;
     }
-    else if (!Database::isNameFree(AUTOU16TOU8(save->szFirstName), AUTOU16TOU8(save->szLastName))) {
-        errorCode = 1;
+
+    if (errorCode == 0) {
+        if (!CNLoginServer::isCharacterNameGood(firstName, lastName)) {
+            errorCode = 4;
+        }
+        else if (!Database::isNameFree(firstName, lastName)) {
+            errorCode = 1;
+        }
     }
 
     if (errorCode != 0) {
@@ -527,9 +567,15 @@ void CNLoginServer::changeName(CNSocket* sock, CNPacketData* data) {
         return;
     }
 
-    if (!Database::changeName(save, loginSessions[sock].userID))
+    if (!Database::changeName(save->iPCUID, loginSessions[sock].userID, firstName.c_str(), lastName.c_str(), nameCheck))
         return invalidCharacter(sock);
 
+    // fire name check event if needed
+    if (nameCheck != 1) {
+        std::string namereq = std::to_string(save->iPCUID) + " " + firstName + " " + lastName;
+        Monitor::namereqs.push_back(namereq);
+    }
+
     INITSTRUCT(sP_LS2CL_REP_CHANGE_CHAR_NAME_SUCC, resp);
     resp.iPC_UID = save->iPCUID;
     memcpy(resp.szFirstName, save->szFirstName, sizeof(resp.szFirstName));
@@ -541,8 +587,10 @@ void CNLoginServer::changeName(CNSocket* sock, CNPacketData* data) {
     sock->sendPacket(resp, P_LS2CL_REP_CHANGE_CHAR_NAME_SUCC);
 
     DEBUGLOG(
-        std::cout << "Login Server: Name check success for character [" << save->iPCUID << "]" << std::endl;
-        std::cout << "\tNew name: " << AUTOU16TOU8(save->szFirstName) << " " << AUTOU16TOU8(save->szLastName) << std::endl;     
+        std::cout << "Login Server: Name change request for character [" << save->iPCUID << "]" << std::endl;
+        std::cout << "\tNew name: " << firstName << " " << lastName;
+        if (nameCheck != 1) std::cout << " (pending approval)";
+        std::cout << std::endl;
     )
 }
 
@@ -621,21 +669,164 @@ bool CNLoginServer::exitDuplicate(int accountId) {
     return false;
 }
 
-bool CNLoginServer::isLoginDataGood(std::string login, std::string password) {
-    std::regex loginRegex("[a-zA-Z0-9_-]{4,32}");
-    std::regex passwordRegex("[a-zA-Z0-9!@#$%^&*()_+]{8,32}");
+bool CNLoginServer::isUsernameGood(std::string& login) {
+    const std::regex loginRegex("[a-zA-Z0-9_-]{4,32}");
+    return (std::regex_match(login, loginRegex));
+}
 
-    return (std::regex_match(login, loginRegex) && std::regex_match(password, passwordRegex));
+bool CNLoginServer::isPasswordGood(std::string& password) {
+    const std::regex passwordRegex("[a-zA-Z0-9!@#$%^&*()_+]{8,32}");
+    return (std::regex_match(password, passwordRegex));
 }
 
 bool CNLoginServer::isPasswordCorrect(std::string actualPassword, std::string tryPassword) {
     return BCrypt::validatePassword(tryPassword, actualPassword);
 }
 
+bool CNLoginServer::isNameWheelNameGood(int fnCode, int mnCode, int lnCode, std::string& firstName, std::string& lastName) {
+    if (fnCode >= LoginServer::WheelFirstNames.size()
+        || mnCode >= LoginServer::WheelMiddleNames.size()
+        || lnCode >= LoginServer::WheelLastNames.size()) {
+        std::cout << "[WARN] Login Server: Invalid name codes received: " << fnCode << " " << mnCode << " " << lnCode << std::endl;
+        return false;
+    }
+
+    // client sends 1 if not selected for these. they point to a single blank space. why.
+    // just change them to 0, which points to an empty string; keeps the code much cleaner
+    if (mnCode == 1) mnCode = 0;
+    if (lnCode == 1) lnCode = 0;
+
+    std::string firstNameFromWheel = LoginServer::WheelFirstNames[fnCode];
+
+    std::string middleNamePart = LoginServer::WheelMiddleNames[mnCode];
+    std::string lastNamePart = LoginServer::WheelLastNames[lnCode];
+    if (mnCode != 0 && middleNamePart[middleNamePart.size() - 1] != ' ') {
+        // If there's a middle name, we need to lowercase the last name
+        std::transform(lastNamePart.begin(), lastNamePart.end(), lastNamePart.begin(), ::tolower);
+    }
+    std::string lastNameFromWheel = middleNamePart + lastNamePart;
+
+    if (firstNameFromWheel.empty() || lastNameFromWheel.empty()) {
+        std::cout << "[WARN] Login Server: Invalid wheel name combo: " << fnCode << " " << mnCode << " " << lnCode << std::endl;
+        return false;
+    }
+
+    if (firstName != firstNameFromWheel || lastName != lastNameFromWheel) {
+        std::cout << "[WARN] Login Server: Name wheel mismatch. Expected " << firstNameFromWheel << " " << lastNameFromWheel << ", got " << firstName << " " << lastName << std::endl;
+        return false;
+    }
+
+    return true;
+}
+
 bool CNLoginServer::isCharacterNameGood(std::string Firstname, std::string Lastname) {
     //Allow alphanumeric and dot characters in names(disallows dot and space characters at the beginning of a name)
     std::regex firstnamecheck(R"(((?! )(?!\.)[a-zA-Z0-9]*\.{0,1}(?!\.+ +)[a-zA-Z0-9]* {0,1}(?! +))*$)");
     std::regex lastnamecheck(R"(((?! )(?!\.)[a-zA-Z0-9]*\.{0,1}(?!\.+ +)[a-zA-Z0-9]* {0,1}(?! +))*$)");
     return (std::regex_match(Firstname, firstnamecheck) && std::regex_match(Lastname, lastnamecheck));
 }
+
+bool CNLoginServer::isAuthMethodAllowed(AuthMethod authMethod) {
+    // the config file specifies "comma-separated" but tbh we don't care
+    switch (authMethod) {
+    case AuthMethod::PASSWORD:
+        return settings::AUTHMETHODS.find("password") != std::string::npos;
+    case AuthMethod::COOKIE:
+        return settings::AUTHMETHODS.find("cookie") != std::string::npos;
+    default:
+        break;
+    }
+    return false;
+}
+
+bool CNLoginServer::checkPassword(CNSocket* sock, std::string& password) {
+    // check password auth allowed
+    if (!CNLoginServer::isAuthMethodAllowed(AuthMethod::PASSWORD)) {
+        // send a custom error message
+        INITSTRUCT(sP_FE2CL_GM_REP_PC_ANNOUNCE, msg);
+        std::string text = "Password login disabled\n";
+        text += "This server has disabled logging in with plaintext passwords.\n";
+        text += "Please contact an admin for assistance.";
+        U8toU16(text, msg.szAnnounceMsg, sizeof(msg.szAnnounceMsg));
+        msg.iDuringTime = 12;
+        sock->sendPacket(msg, P_FE2CL_GM_REP_PC_ANNOUNCE);
+
+        return false;
+    }
+
+    // check regex
+    if (!CNLoginServer::isPasswordGood(password)) {
+        // send a custom error message
+        INITSTRUCT(sP_FE2CL_GM_REP_PC_ANNOUNCE, msg);
+        std::string text = "Invalid password\n";
+        text += "Password has to be 8 - 32 characters long";
+        U8toU16(text, msg.szAnnounceMsg, sizeof(msg.szAnnounceMsg));
+        msg.iDuringTime = 10;
+        sock->sendPacket(msg, P_FE2CL_GM_REP_PC_ANNOUNCE);
+
+        return false;
+    }
+
+    return true;
+}
+
+bool CNLoginServer::checkUsername(CNSocket* sock, std::string& username) {
+    // check username regex
+    if (!CNLoginServer::isUsernameGood(username)) {
+        // send a custom error message
+        INITSTRUCT(sP_FE2CL_GM_REP_PC_ANNOUNCE, msg);
+        std::string text = "Invalid login\n";
+        text += "Login has to be 4 - 32 characters long and can't contain special characters other than dash and underscore";
+        U8toU16(text, msg.szAnnounceMsg, sizeof(msg.szAnnounceMsg));
+        msg.iDuringTime = 10;
+        sock->sendPacket(msg, P_FE2CL_GM_REP_PC_ANNOUNCE);
+
+        return false;
+    }
+
+    return true;
+}
+
+bool CNLoginServer::checkToken(CNSocket* sock, Database::Account& account, std::string& token, bool isCookieAuth) {
+    // check for valid cookie first
+    if (isCookieAuth && CNLoginServer::isAuthMethodAllowed(AuthMethod::COOKIE)) {
+        const char *cookie = token.c_str();
+        if (Database::checkCookie(account.AccountID, cookie)) {
+            return true;
+        }
+    }
+
+    // cookie check disabled or failed; check to see if it's a plaintext password
+    if (CNLoginServer::isAuthMethodAllowed(AuthMethod::PASSWORD)
+        && CNLoginServer::isPasswordCorrect(account.Password, token)) {
+        return true;
+    }
+
+    return false;
+}
+
+bool CNLoginServer::checkBan(CNSocket* sock, Database::Account& account) {
+    // check if the account is banned
+    if (account.BannedUntil > getTimestamp()) {
+        // send a custom error message
+        INITSTRUCT(sP_FE2CL_GM_REP_PC_ANNOUNCE, msg);
+
+        // ceiling devision
+        int64_t remainingDays = (account.BannedUntil-getTimestamp()) / 86400 + ((account.BannedUntil - getTimestamp()) % 86400 != 0);
+
+        std::string text = "Your account has been banned. \nReason: ";
+        text += account.BanReason;
+        text += "\nBan expires in " + std::to_string(remainingDays) + " day";
+        if (remainingDays > 1)
+            text += "s";
+
+        U8toU16(text, msg.szAnnounceMsg, sizeof(msg.szAnnounceMsg));
+        msg.iDuringTime = 99999999;
+        sock->sendPacket(msg, P_FE2CL_GM_REP_PC_ANNOUNCE);
+
+        return true;
+    }
+
+    return false;
+}
 #pragma endregion

src/servers/CNLoginServer.hpp

@@ -1,11 +1,18 @@
 #pragma once
 
 #include "core/Core.hpp"
+#include "db/Database.hpp"
 
 #include "Player.hpp"
 
 #include <map>
 
+namespace LoginServer {
+    extern std::vector<std::string> WheelFirstNames;
+    extern std::vector<std::string> WheelMiddleNames;
+    extern std::vector<std::string> WheelLastNames;
+}
+
 struct CNLoginData {
     int userID;
     time_t lastHeartbeat;
@@ -23,6 +30,13 @@ enum class LoginError {
     UPDATED_EUALA_REQUIRED = 9
 };
 
+#define USE_COOKIE_FIELDS 2
+
+enum class AuthMethod {
+    PASSWORD = 1,
+    COOKIE = 2
+};
+
 // WARNING: THERE CAN ONLY BE ONE OF THESE SERVERS AT A TIME!!!!!! TODO: change loginSessions & packet handlers to be non-static
 class CNLoginServer : public CNServer {
 private:
@@ -39,10 +53,18 @@ private:
     static void changeName(CNSocket* sock, CNPacketData* data);
     static void duplicateExit(CNSocket* sock, CNPacketData* data);
 
-    static bool isLoginDataGood(std::string login, std::string password);
+    static bool isUsernameGood(std::string& login);
+    static bool isPasswordGood(std::string& password);
     static bool isPasswordCorrect(std::string actualPassword, std::string tryPassword);
     static bool isAccountInUse(int accountId);
+    static bool isNameWheelNameGood(int fnCode, int mnCode, int lnCode, std::string& firstName, std::string& lastName);
     static bool isCharacterNameGood(std::string Firstname, std::string Lastname);
+    static bool isAuthMethodAllowed(AuthMethod authMethod);
+    static bool checkUsername(CNSocket* sock, std::string& username);
+    static bool checkPassword(CNSocket* sock, std::string& password);
+    static bool checkToken(CNSocket* sock, Database::Account& account, std::string& token, bool isCookieAuth);
+    static bool checkBan(CNSocket* sock, Database::Account& account);
+
     static void newAccount(CNSocket* sock, std::string userLogin, std::string userPassword, int32_t clientVerC);
     // returns true if success
     static bool exitDuplicate(int accountId);

src/servers/CNShardServer.cpp

@@ -18,6 +18,7 @@ std::map<uint32_t, PacketHandler> CNShardServer::ShardPackets;
 std::list<TimerEvent> CNShardServer::Timers;
 
 CNShardServer::CNShardServer(uint16_t p) {
+    serverType = "shard";
     port = p;
     pHandler = &CNShardServer::handlePacket;
     REGISTER_SHARD_TIMER(keepAliveTimer, 4000);
@@ -117,6 +118,10 @@ void CNShardServer::kill() {
 void CNShardServer::onStep() {
     time_t currTime = getTime();
 
+    // do not evaluate timers if the server is shutting down
+    if (!active)
+        return;
+
     for (TimerEvent& event : Timers) {
         if (event.scheduledEvent == 0) {
             // event hasn't been queued yet, go ahead and do that

src/servers/CNShardServer.hpp

@@ -8,6 +8,7 @@
 #define REGISTER_SHARD_PACKET(pactype, handlr) CNShardServer::ShardPackets[pactype] = handlr;
 #define REGISTER_SHARD_TIMER(handlr, delta) CNShardServer::Timers.push_back(TimerEvent(handlr, delta));
 #define MS_PER_PLAYER_TICK 500
+#define MS_PER_COMBAT_TICK 200
 
 class CNShardServer : public CNServer {
 private:

src/servers/Monitor.cpp

@@ -14,6 +14,13 @@ static std::mutex sockLock; // guards socket list
 static std::list<SOCKET> sockets;
 static sockaddr_in address;
 
+std::vector<std::string> Monitor::chats;
+std::vector<std::string> Monitor::bcasts;
+std::vector<std::string> Monitor::emails;
+std::vector<std::string> Monitor::namereqs;
+
+using namespace Monitor;
+
 static bool transmit(std::list<SOCKET>::iterator& it, char *buff, int len) {
     int n = 0;
     int sock = *it;
@@ -99,15 +106,23 @@ outer:
         }
 
         // chat
-        for (auto& str : Chat::dump) {
+        for (auto& str : chats) {
             n = std::snprintf(buff, sizeof(buff), "chat %s\n", str.c_str());
 
             if (!transmit(it, buff, n))
                 goto outer;
         }
 
+        // announcements
+        for (auto& str : bcasts) {
+            n = std::snprintf(buff, sizeof(buff), "bcast %s\n", str.c_str());
+
+            if (!transmit(it, buff, n))
+                goto outer;
+        }
+
         // emails
-        for (auto& str : Email::dump) {
+        for (auto& str : emails) {
             n = process_email(buff, str);
 
             if (!transmit(it, buff, n))
@@ -117,14 +132,24 @@ outer:
                 goto outer;
         }
 
+        // name requests
+        for (auto& str : namereqs) {
+            n = std::snprintf(buff, sizeof(buff), "namereq %s\n", str.c_str());
+
+            if (!transmit(it, buff, n))
+                goto outer;
+        }
+
         if (!transmit(it, (char*)"end\n", 4))
             continue;
 
         it++;
     }
 
-    Chat::dump.clear();
-    Email::dump.clear();
+    chats.clear();
+    bcasts.clear();
+    emails.clear();
+    namereqs.clear();
 }
 
 bool Monitor::acceptConnection(SOCKET fd, uint16_t revents) {
@@ -180,9 +205,14 @@ SOCKET Monitor::init() {
     }
 
     address.sin_family = AF_INET;
-    address.sin_addr.s_addr = INADDR_ANY;
     address.sin_port = htons(settings::MONITORPORT);
 
+    if (!inet_pton(AF_INET, settings::MONITORLISTENIP.c_str(), &address.sin_addr)) {
+        std::cout << "Failed to set monitor listen address" << std::endl;
+        printSocketError("inet_pton");
+        exit(1);
+    }
+
     if (SOCKETERROR(bind(listener, (struct sockaddr*)&address, sizeof(address)))) {
         std::cout << "Failed to bind to monitor port" << std::endl;
         printSocketError("bind");
@@ -206,7 +236,7 @@ SOCKET Monitor::init() {
         exit(EXIT_FAILURE);
     }
 
-    std::cout << "Monitor listening on *:" << settings::MONITORPORT << std::endl;
+    std::cout << "Monitor listening on " << settings::MONITORLISTENIP << ":" << settings::MONITORPORT << std::endl;
 
     REGISTER_SHARD_TIMER(tick, settings::MONITORINTERVAL);
 

src/servers/Monitor.hpp

@@ -3,6 +3,11 @@
 #include "core/Core.hpp"
 
 namespace Monitor {
+    extern std::vector<std::string> chats;
+    extern std::vector<std::string> bcasts;
+    extern std::vector<std::string> emails;
+    extern std::vector<std::string> namereqs;
+
     SOCKET init();
     bool acceptConnection(SOCKET, uint16_t);
 };

src/settings.cpp

@@ -9,10 +9,13 @@
 // defaults :)
 int settings::VERBOSITY = 1;
 bool settings::SANDBOX = true;
+std::string settings::SANDBOXEXTRAPATH = "";
 
 int settings::LOGINPORT = 23000;
-bool settings::APPROVEALLNAMES = true;
+bool settings::APPROVEWHEELNAMES = true;
+bool settings::APPROVECUSTOMNAMES = true;
 bool settings::AUTOCREATEACCOUNTS = true;
+std::string settings::AUTHMETHODS = "password";
 int settings::DBSAVEINTERVAL = 240;
 
 int settings::SHARDPORT = 23001;
@@ -21,6 +24,7 @@ bool settings::LOCALHOSTWORKAROUND = true;
 time_t settings::TIMEOUT = 60000;
 int settings::VIEWDISTANCE = 25600;
 bool settings::SIMULATEMOBS = true;
+bool settings::ANTICHEAT = true;
 
 // default spawn point
 #ifndef ACADEMY
@@ -61,11 +65,15 @@ bool settings::DISABLEFIRSTUSEFLAG = true;
 // monitor settings
 bool settings::MONITORENABLED = false;
 int settings::MONITORPORT = 8003;
+std::string settings::MONITORLISTENIP = "127.0.0.1";
 int settings::MONITORINTERVAL = 5000;
 
 // event mode settings
 int settings::EVENTMODE = 0;
 
+// race settings
+bool settings::IZRACESCORECAPPED = true;
+
 void settings::init() {
     INIReader reader("config.ini");
 
@@ -80,9 +88,12 @@ void settings::init() {
 
     VERBOSITY = reader.GetInteger("", "verbosity", VERBOSITY);
     SANDBOX = reader.GetBoolean("", "sandbox", SANDBOX);
+    SANDBOXEXTRAPATH = reader.Get("", "sandboxextrapath", SANDBOXEXTRAPATH);
     LOGINPORT = reader.GetInteger("login", "port", LOGINPORT);
-    APPROVEALLNAMES = reader.GetBoolean("login", "acceptallcustomnames", APPROVEALLNAMES);
+    APPROVEWHEELNAMES = reader.GetBoolean("login", "acceptallwheelnames", APPROVEWHEELNAMES);
+    APPROVECUSTOMNAMES = reader.GetBoolean("login", "acceptallcustomnames", APPROVECUSTOMNAMES);
     AUTOCREATEACCOUNTS = reader.GetBoolean("login", "autocreateaccounts", AUTOCREATEACCOUNTS);
+    AUTHMETHODS = reader.Get("login", "authmethods", AUTHMETHODS);
     DBSAVEINTERVAL = reader.GetInteger("login", "dbsaveinterval", DBSAVEINTERVAL);
     SHARDPORT = reader.GetInteger("shard", "port", SHARDPORT);
     SHARDSERVERIP = reader.Get("shard", "ip", SHARDSERVERIP);
@@ -109,7 +120,10 @@ void settings::init() {
     ACCLEVEL = reader.GetInteger("shard", "accountlevel", ACCLEVEL);
     EVENTMODE = reader.GetInteger("shard", "eventmode", EVENTMODE);
     DISABLEFIRSTUSEFLAG = reader.GetBoolean("shard", "disablefirstuseflag", DISABLEFIRSTUSEFLAG);
+    ANTICHEAT = reader.GetBoolean("shard", "anticheat", ANTICHEAT);
+    IZRACESCORECAPPED = reader.GetBoolean("shard", "izracescorecapped", IZRACESCORECAPPED);
     MONITORENABLED = reader.GetBoolean("monitor", "enabled", MONITORENABLED);
     MONITORPORT = reader.GetInteger("monitor", "port", MONITORPORT);
+    MONITORLISTENIP = reader.Get("monitor", "listenip", MONITORLISTENIP);
     MONITORINTERVAL = reader.GetInteger("monitor", "interval", MONITORINTERVAL);
 }

src/settings.hpp

@@ -1,17 +1,23 @@
 #pragma once
 
+#include <stdint.h>
 #include <string>
+#include <time.h>
 
 namespace settings {
     extern int VERBOSITY;
     extern bool SANDBOX;
+    extern std::string SANDBOXEXTRAPATH;
     extern int LOGINPORT;
-    extern bool APPROVEALLNAMES;
+    extern bool APPROVEWHEELNAMES;
+    extern bool APPROVECUSTOMNAMES;
     extern bool AUTOCREATEACCOUNTS;
+    extern std::string AUTHMETHODS;
     extern int DBSAVEINTERVAL;
     extern int SHARDPORT;
     extern std::string SHARDSERVERIP;
     extern bool LOCALHOSTWORKAROUND;
+    extern bool ANTICHEAT;
     extern time_t TIMEOUT;
     extern int VIEWDISTANCE;
     extern bool SIMULATEMOBS;
@@ -35,8 +41,10 @@ namespace settings {
     extern int EVENTMODE;
     extern bool MONITORENABLED;
     extern int MONITORPORT;
+    extern std::string MONITORLISTENIP;
     extern int MONITORINTERVAL;
     extern bool DISABLEFIRSTUSEFLAG;
+    extern bool IZRACESCORECAPPED;
 
     void init();
 }

vendor/bcrypt/bcrypt.c

@@ -22,9 +22,14 @@
 #endif
 #include <errno.h>
 
-#ifdef _WIN32 || _WIN64
-// On windows we need to generate random bytes differently.
+#if defined(_WIN32) && !defined(_WIN64)
+typedef __int32 ssize_t;
+#elif defined(_WIN32) && defined(_WIN64)
 typedef __int64 ssize_t;
+#endif
+
+#if defined(_WIN32) || defined(_WIN64)
+// On windows we need to generate random bytes differently.
 #define BCRYPT_HASHSIZE 60
 
 #include "bcrypt.h"
@@ -33,9 +38,10 @@ typedef __int64 ssize_t;
 #include <wincrypt.h> /* CryptAcquireContext, CryptGenRandom */
 #else
 #include "bcrypt.h"
-#include "ow-crypt.h"
 #endif
 
+#include "ow-crypt.h"
+
 #define RANDBYTES (16)
 
 static int try_close(int fd)
@@ -117,7 +123,7 @@ int bcrypt_gensalt(int factor, char salt[BCRYPT_HASHSIZE])
 	char *aux;
 
 	// Note: Windows does not have /dev/urandom sadly.
-#ifdef _WIN32 || _WIN64
+#if defined(_WIN32) || defined(_WIN64)
 	HCRYPTPROV p;
 	ULONG     i;
 

vendor/bcrypt/crypt_blowfish.c

@@ -51,7 +51,7 @@
 #endif
 
 /* Just to make sure the prototypes match the actual definitions */
-#ifdef _WIN32 || _WIN64
+#if defined(_WIN32) || defined(_WIN64)
 #include "crypt_blowfish.h"
 #else
 #include "crypt_blowfish.h"

vendor/bcrypt/wrapper.c

@@ -41,7 +41,7 @@
 #define __SKIP_GNU
 #endif
 
-#ifdef _WIN32 | _WIN64
+#if defined(_WIN32) || defined(_WIN64)
 #include "ow-crypt.h"
 
 #include "crypt_blowfish.h"
@@ -251,7 +251,7 @@ char *__crypt_gensalt_ra(const char *prefix, unsigned long count,
 		input, size, output, sizeof(output));
 
 	if (retval) {
-#ifdef _WIN32 | _WIN64
+#if defined(_WIN32) || defined(_WIN64)
 		retval = _strdup(retval);
 #else
 		retval = strdup(retval);

win-setup.ps1

@@ -0,0 +1,52 @@
+# Run this first if needed:
+# Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process
+param (
+    # height of largest column without top bar
+    [Parameter(Mandatory=$true)]
+    [string]$protocolVersion
+)
+
+$ErrorActionPreference = 'Stop'
+# check for vscmd
+if ([string]::IsNullOrEmpty($env:VSCMD_VER)) {
+    Write-Host 'Must be run inside of VS Developer Powershell'
+    exit 1
+}
+
+# check for git
+try {
+    $git_version = git --version
+} catch {
+    Write-Host 'git not installed'
+    exit 1
+}
+
+# setup vcpkg
+if (Test-Path -Path 'vcpkg\') {
+    Write-Host 'vcpkg already setup'
+} else {
+    Write-Host 'Setting up vcpkg...'
+    git clone "https://github.com/microsoft/vcpkg.git"
+}
+
+if (-not (Test-Path -Path 'vcpkg\vcpkg.exe')) {
+    Write-Host 'Bootstrapping vcpkg...'
+    Start-Process -Wait -NoNewWindow -FilePath 'vcpkg\bootstrap-vcpkg.bat' -ArgumentList '-disableMetrics'
+}
+
+$env:VCPKG_ROOT='' # ignore msvc's vcpkg root, it doesn't work
+$vcpkg = (Resolve-Path -Path '.\vcpkg')
+Write-Host "vcpkg installed to $vcpkg"
+Start-Process -Wait -NoNewWindow -FilePath 'vcpkg\vcpkg.exe' -ArgumentList 'install sqlite3:x64-windows'
+
+# setup cmake project
+if (Test-Path -Path 'build\') {
+    Write-Host 'cmake project already setup';
+} else {
+    Write-Host 'Setting up cmake project...'
+    Start-Process -Wait -NoNewWindow -FilePath 'cmake' -ArgumentList "-B build -DPROTOCOL_VERSION=$protocolVersion -DCMAKE_TOOLCHAIN_FILE=$vcpkg\scripts\buildsystems\vcpkg.cmake"
+}
+
+Write-Host 'Done!'
+$sln = (Resolve-Path -Path '.\build\OpenFusion.sln')
+Write-Host "Solution file is at $sln"