Understanding MOSS integrity checker

[Coconut]

Hey!

I’d like some insight to the meanings of the following messages when checking for MOSS file integrity.

ZIP renamed (doesn’t necessarily mean anything else than the zip is renamed?)
LOG corrupted (means that log file has been edited?)
ZIP corrupted (means that the zip as a whole is edited in some way?)
Invalid file (consequence of the things above?)

I’d like clarification that does getting LOG/ZIP corrupted mean for sure that the ZIP (and it’s contents) have been manipulated in some way.
Can this happen only because of intentional manipulation?

Let me know, if you want an example MOSS I found from a player.

– Coconut

• This topic was modified 2 years ago by Coconut.

[ADM_nohope]

You are globally right , zip corrupted means the zip content doesn’t match the log, images have been replaced or edited
Usually it’s a user action
In case of doubt send me the zip

[Coconut]

Hello and thanks for the answer.

So, this cannot happen without user action?

For example: https://play.eslgaming.com/player/replays/11798683/
Literally every single MOSS file he has ever uploaded:
ZIP renamed
LOG corrupted
ZIP corrupted
Invalid file

Then again if I randomly check some known high level player’s MOSS (or mine), they all are:
ZIP name is ok / renamed
ZIP is ok

Are you able to confirm confirm that his MOSS files are touched prior to upload to ESL?

[ADM_nohope]

Yes probably but the games are several months old, far from usual protest delays in the ESL

[Coconut]

Yeah, I am not looking to protest or even bring anything to ESL. Just as an example.

I am just trying to understand that if the integrity checker returns those lines, it is safe to say that the moss file has been edited in some way and therefore it is wise to protest if one ever encounters such an opponent.

[ADM_nohope]

yes the checker recalc the log CRC and compare to the final CRC stored inside , if a single byte change it means the log has been edited.
same thing with each image CRC , if there is a difference it means a JPG has been substed

so basically : removing, editing or changing a JPG => alert
touching anything in text log => alert

[Coconut]

If a player forcibly closes MOSS after the monitoring session (where MOSS “freezes”), can this happen without actually touching anything?

[ADM_nohope]

not , in there case there wouldnt be any log , the log is inserted in zip only at the last second of session

[Coconut]

Alright, thanks for the information.

[Author]

Posts