Never before seen q3 1.16 hack..

baalpeteor · **Joined:** 29 Jun 2008 21:11 **Posts:** 28

I tried just bitterman/red (as its the same as sarge/default in letters) and i did change to sarge,but it was a red sarge. I have one more I want to try. I will try to somehow use a skin, then change it to sarge/default but delete my red/blue sarge model beforehand. Last time i tried it kicked me off the server because someone else had that skin so I would prob have to find the memory location for sarge or somehow tell it that sarge/red and blue is another skin.

What I really need is a way to tell the server that im using the default and its ok. It needs to tell the other plays "hey, this player is using sarge/default and that's ok, but you guys have to use red and blue." I was thinking the sarge''''''''''''''''''''''''''''' and sarge@@@@@@@@@@@@@@@@@ comes in handy because it is just enough to put it to where it cant tell if its red or blue and maybe it forces default.

baalpeteor · **Joined:** 29 Jun 2008 21:11 **Posts:** 28

just saw him today under the name unknownplayer... here's a picture:
(The model name if you can't see it is Artitmis). I also have a video looking at his model if anyone wants to see. Also google returned no results for Artitmis

Sethioz · **Posted:** 11 Aug 2008 06:22

maybe im mislooking something, but it seems he changed the model (in memory) so server tries to give him that model but cant.

evan1715 · **Posted:** 11 Aug 2008 15:21

what version of did punkbuster start to become integrated? was it only v1.32?

aluigi · **Posted:** 11 Aug 2008 17:36

yes, exactly from 1.32

baalpeteor · **Joined:** 29 Jun 2008 21:11 **Posts:** 28

long time from when i originally posted this... but maybe luigi u can help me out a bit (or someone).

I've done a lil more research today...

first heres sound_dma.c: http://gongo.quakedev.com/src/ogg/code/snd_dma.c

in that file is the qpath variable

Code:

if ( strlen( name ) >= MAX_QPATH )
   {
      Com_Printf( "Sound name exceeds MAX_QPATH\n" );
      return 0;
   }

i've read that :

Quote:

Quote:
Originally Posted by _Mace_
"sound name exceeds MAX_QPATH"

Helps if you read the error.

That's simple - the filepath to the sound is too long. I believe it's 64 characters max. The filepath includes the filename, file extension, and whatever folders are in the way.

You just need to shorten the filepath to less than 64 characters, and it should work fine.

so that explains the 88 into 64 part. the whole path was 88 characters over the 64. (with all the added @@@'s)

now as for the com_sprintf (other part of the bug) i've read:

Quote:

The Com_sprintf function in q_shared.c in Alien Arena 2006 Gold Edition 5.00 does not properly NULL terminate certain long strings, which allows remote attackers (possibly authenticated) to cause a denial of service (application crash) via a long skin, weapon, or model name.

quake 3 arena uses the same one.

q_shared.c is found here: http://svn.jansson.be/foreign/quake/q3/ ... q_shared.c

in it it has:

Code:

void QDECL Com_sprintf( char *dest, int size, const char *fmt, ...) {
   int      len;
   va_list      argptr;
   char   bigbuffer[32000];   // big, but small enough to fit in PPC stack

   va_start (argptr,fmt);
   len = vsprintf (bigbuffer,fmt,argptr);
   va_end (argptr);
   if ( len >= sizeof( bigbuffer ) ) {
      Com_Error( ERR_FATAL, "Com_sprintf: overflowed bigbuffer" );
   }
   if (len >= size) {
      Com_Printf ("Com_sprintf: overflow of %i in %i\n", len, size);

com_printf is defined as:

Code:

Com_sprintf( path, maxSize, "%s%s", oldPath, extension );

What do you think? from what it said about the alien arena gold 2006, that files does not properly NULL terminate certain long strings, which can cause a denial of service (application crash) via a long skin, weapon, or model name. (which is what i originally reported: the long model name

Luigi Auriemma

Never before seen q3 1.16 hack..