Luigi Auriemma

I have been coming here for some years now... since the beginning of time.. in fact i think i lost my first account when this server lost the unknowncheats.com domain... and then the site died.. but in any case.. I am looking for something.. maybe someone can shed some light as i've never seen this before.. it works on 1.11 / 1.16n:

this guy named Iflungpoo (or something) comes in on killer server (1.16). It's freeze (red and blue team) and he comes in with a default color sarge. He isn't red or blue but on my team. When he does he like dies twice.. his body is frozen (as its freeze) and then he's in front of his body running or doing something or moving in circles like he is out his body and you can run through him.. then he does this thing where he crashes the server by changing his model... oh also he changes his model at will .. like he changed to a blue crash by pressing a button.. here's what the code looked like after he crashed it (well most of it i have a snapshot of the whole thing if someone wants it):com_sprintf: overflow of 88 in 64
Failed to load model file

models/players/''''''''''''''''''''''''''''''''''''''

'''''''''' (48 of em)
Sound name exceeds MAX_QPATH
Sound name exceeds MAX_QPATHSound name exceeds

MAX_QPATHSound name exceeds MAX_QPATHSound name

exceeds MAX_QPATHSound name exceeds MAX_QPATHSound

name exceeds MAX_QPATHSound name exceeds

MAX_QPATHSound name exceeds MAX_QPATHSound name

exceeds MAX_QPATHSound name exceeds MAX_QPATHSound

name exceeds MAX_QPATHSound name exceeds

MAX_QPATHCom_sprintf: overflow of 87 in 64
failed to load model file
models/players/sarge@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

@@@@@@@@ (approx 41?)
Failed to load skin file: sarge :
*****************
ERROR: DEFAULT_MODEL / skin (sarge/) failed to

register
*****************

i've did a little testing and by making a sarge@@@@@@@@@@ or whatnot folder and ''''''''''' in my models/players in pak0.pk3, i am able to stimulate the com_sprintf and max_qpath lines, butn othing more. i prob need special files within those folders

thanks alot. You just opened my mind to trying a memory editor on quake 3. I used one on an old game called graal I played in the 90's (artmoney and gt) but never thought of quake. The server in particular doesn't have pb enabled. The glitch where it was 2 of him was done with the /kill command. You keep spamming it and it looks like your lagging (like when you do the /callvote no glitch where u jump in lava and spam it and then u can walk in lava without dieing)... with the /kill you spawn your body running (if u were before u died) or standing wherever you are.. so on rail where the rail kills you in one hit and knocks u soo far back (but ur frozen on spot) your body reincarnates wherever the blast really hit you.

i'm going give artmoney a try right now.

do you or anyone know of a flag that forces the use of the red and/or blue model in quake 3? If that could be found and memory edited then I could be on to something.. i can set the skin one way but i don't think they see me.. like if its razor/default change it to sarge/default but im still red

u get it to work yet?

just the double model thing. he would just spam /kill to make himself out of body on a freeze game. its pretty neat cuz people try to shoot it and dont think they railed u or think ur alive.. which means ur teammates have a chance to kill them. Decoys aren't on the server but it looks like you can do it.

What I need is client side settings that effect the server and what others see. I need the flags/variables. I was thinking if the server forces u to change one or do something u can overrule it with a memory editor and put it on freeze. I tried the skin one but im still red even when I do like razor/default then change it to sarge/default (same amount of letters) and freeze it goes red.. I will have to experiment with deleting the red or blue mesh of sarge in my pak0.pk3.

I wonder what files are in his :
models/players/''''''''''''''''''''''''''''''''''''''''''''''''

folder. if any. might make a buffer overflow due to the letters but then he might ahave commands in the .tga to crash the server or use admin commands.. to restart.. or smoething else.

then the:
models/players/sarge@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

@@@@@@@@

I think its a folder called sarge@@@@@@@@@@@@@ or whatnot as its no / between sarge and @.

That dieing thing was crazy. Wish I could do that in quake it would be sooo mad crazy people would trip lol. The one in quake (at least for freeze as taht's all I play on 1.16), its like your body freezes instantly when shot with rail (the only gun you can have besides gaunt). When you're frozen, and type /kill in console (or have it binded) your body is wherever you were projected with rail (outside your body) or whatnot.. buti t makes a copy of your model there standing or moving. you have to keep pressing it to keep it there or else it will put you into spect mode (normal) instead of looking on the ground dead. When this happens your decoy goes away. you can change models fast (i binded some) so your decoy keeps changing models almost instant. If you spam /kill you will lag (just like the callvote command to get in lava) and reach a ping of 999. So I like to press it like 3 times fast and then press it slow.

i'm still messing with the memory editor. I need to run a test server and have a friend join to tell me if they actually see the changes because no one else on the server is cool nowadays.

the /vsay aaaaaa bug is another problem, search q3msgboom

about punkbuster, I have never had interest in it so probably what I say is not 100% correct.
Anyway now PB is just a service which runs on the client's machine at startup with (consequently) elevated privileges and scans the memory of any running process at regular intervals searching specific patterns.

That's why recently there has been that huge scandal about sending some of these patterns (I can't believe that Evenbalance used such simple patterns... really stupid) to another client using IRC, Xfire, MSN, a webpage and so on for banning him.
Naturally it's a design bug so it can't be fixed, Evenbalance simply removed or changed the patterns which were made public by who made this problem public... blah

http://forum.netcoders.cc/announcements ... uster.html

well it's real easy to spam kill in a script...
in jk2 i would put it like this in a .cfg:
kill;wait 1;+attack;wait 2;-attack;kill;wait 1;+attack;wait 2;-attack;kill;wait 1;+attack;wait 2;-attack;kill;wait 1;+attack;wait 2;-attack;kill;wait 1;+attack;wait 2;-attack

and of course just repeat
kill;wait 1;+attack;wait 2;-attack;
and it should do it ;p

yeah q3 source is probably out some where

q3 is suppossed to be open source.

this should be it:
http://fileforum.betanews.com/detail/Qu ... 24550740/1
or
http://www.fileshack.com/file.x?fid=7547
(same thing)

i dunno much about using source code to find bugs.. as im a network guy nowadays.. been fell out of coding. We may be on to the next biggest q3 bug/sploit/hole. Well no doubt it is just need to figure out what causes it and how to reproduce what i've seen. It kicked everyone off the server.. i think it crashed it to and restarted it.. the server must have automatic restarting now because when i did join the scores were like 0 to 0 and i believe the map changed.

thats like basically the exact same thing i said ^_^.. ur post was pointless ;p

well tell me when u get the model crash thingy working, im curious about it

I wish the whole server would crash on q3.. would make my end goal alot easier.. which is something to crash a server that is unpatchable and unstoppable. you cant patch nothing like that.. esp. when the game is that old.

I will take a look through all the source. I guess one thing i would look for is something that forces the server to make you use a color model.. if there was a line to force the use of a red or blue model.. and it was set to 1... then to set it to 0 would be what I'd want... at least that's part 1.. which is just to keep a default sarge color in a team game. Second part is the crash he did.

hmm might be.. the guy who did it I only seen twice before.. differ names (knew it was him because of the default colored sarge). It may be that he's making his client think its free for all instead of rail freeze with red/blue teams. I will investigate this weapon changing thing. Hopefully I can find how it holds these values.. but im not an expert mem editor... but i'll see what I can come up with. right now im reading the server source and looking for things.

im sure if u report to punkbuster they'll actually do their job and help prevent it
http://www.evenbalance.com/index.php?page=info.php

adding on to that...
quake live will eventually come out so yeah, that'll be good :P... i think it comes out this year, some how they are going to integrate punkbuster into the browser quake 3 arena game... so yeah, just play that instead? :P

well im interested in knowing how todo it .. esp. the default sarge color thing.. here's an update.

The guy came back today... and i figured out alot. one model he changed to was artimis (guess /models/players/artimis) and then before that to +000000000000000000000000000000000000 (a lil over 40 0's i have to count them still). Maybe after u reach a certain amount of characters it overflows and it doesn't check the color ... because ur at the end.. like if it forces sarge/red.. and the line only allows 40 chars.. you put sarge0000000000000000000000000000000000000 up to 40 and anything after you dont see (the /red part). That's my guess right now. when he changed to artimis and changed skins they all kept hit default color. I just tried deleting my red and blue sarge skin out of my sarge folder and used the artemis (differ than his) skin and they saw me as either red/blue..w hich tells me its client side... i have to fool them into seeing im using sarge/default somehow ... because it doesn't matter whats on my pc its what the server or I send them they see..

what do you think aluigi? Know anything about how models work.. the client/server side? Is it that the client (take me) tells everyone else that im using sarge/red.. or does the server tell everyone that and just sees taht im sarge.. and tells them im red because i joined red?

Maybe he has a value for joining a team and he just joins the game but not /team red or nothing just whatever it is to join the game.. but still to get on the server you have to be red or blue...

if someone needs to make some tests modifying the "connect" packet, I have just created a new plugin for sudppipe called q3conmod:

http://aluigi.org/testz.htm

hey could u perhaps u know, edit this or delete this topic please?
this works in jk2/jk3 and has grown ever since u posted it -_-

less bugs is preferred, we know what ur talking about now so just edit it so no1 else knows what ur talking about it.... please or ill beat u to death lol

uhmmm I doubt there are so much people who read this unknown support forum 8-)
anyway there is no way explained here for testing this possible bug (the \model\aaaaaaa...aaa right?) so what method are using these people?

hmm you got me thinking. I have tried that and frozen sarge/default but when I joined (i used artmoney) it was sarge/red.) what I will try now is going on the server or something and finding a model that is as long in text as sarge/default but is red (like sarge/default is 13 chars so I need a char model name that's 9 chars + /red since i have to use red or blue).

I will post if it works or not.