Time’s short, the workload’s heavy
0. Why this change
First, maimai’s own security architecture never accounted for the mainland server’s environment. Who could have imagined someone could pull the hard drive out of a cabinet
Second, cheating running rampant on the mainland maimai server isn’t a one-day thing, and the main trigger this time was ttnk publishing the player database and account-killing scripts; before that there had been several large-scale full-server account scans and black-room incidents. After the ttnk incident, the mainland server went down for five days of maintenance and added mainland-exclusive security patches, and today’s 1.53 is an upgrade on top of the original foundation
1. First patch addition
1.1 Changing the QR code service URL
The original address http://wq.sys-allnet.cn/qrcode/req/ was changed to https://wq.wahlap.net/qrcode/req/
HTTP was upgraded to HTTPS, which blocks QR code hijacking
CAUTIONOnly the QR code service URL was changed this time; the game servers and so on weren’t touched. Changing the game server requires pushing a cabinet program — it’s not something you can just change. Anyone spreading rumours about the game server URL being swapped is either stupid or malicious
1.2 Forced token verification LEVEL ALPHA
Before User ID Login, you’re now forced to use a QR code to obtain the UID, you must sign with chiral matter, and UID Login and Logout must use the same signature
This means logging in directly via user ID stops working outright; malicious hacks can no longer log into your account directly. For now this only affects uploads
2. The 1.53 additional patch
2.1 Forced token verification LEVEL BETA
After the 1.53 rollout, almost all operations are forced to go through QR code token verification, including preview (fetching basic player info), a targeted strike against malicious scripts that build whole-server databases
2.2 Fixing 0010
Fixed the problem where malicious hacks handed out the “滚木” collectible and crashed the cabinet. All currently known methods have been fixed
2.3 Changing methods
For the method of implementing chiral network server communication leaked in the currently known scripts, the implementation has been modified. After 1.53 goes out, they are all… of… them… done for
3. Account recovery guide
If malicious scripts blew up your account and stuffed it with abnormal data, I recommend sorting it out through the official form. It’s fast — huge thumbs up
4. Conclusion
After these two updates, 100.4999% of malicious hacks will be killed outright, along with 90% of script kiddies and the tech-HDD resellers on Xianyu. For ordinary players this is a good thing, a good thing, all good things; script kiddies got what was coming to them, meow
When the update will be applied is unknown, probably 2weeks; during this period the Japanese side has probably been busy adding verification. When the cabinet song data update will be applied is also unknown, but that’s forgivable — at least this time the protection is stricter than the international server
5. Debunking
Regarding the image below, the claim that SEGA officially adopted Xiong Guling’s solution is false. It’s a group chat doing a bit and role-playing. Everything this update fixes has nothing whatsoever to do with the solution Xiong Guling proposed. Please judge for yourselves. Trusting a chat log is no better than believing I’m Qin Shi Huang — after all, I wouldn’t lie to you
