bf1942

staticline · **Joined:** 16 Aug 2007 16:44 **Posts:** 24

and perhaps the -f option too?

aluigi · **Posted:** 20 Oct 2007 19:13

The Gamespy thing is not possible I think, then I have not understood very well how you would implement it.

While for the -f (flooding) option used also in bf2fp there is no poblem, I will add it tomorrow

staticline · **Joined:** 16 Aug 2007 16:44 **Posts:** 24

We have a list of details from the players whom we've captured with the gamespy hack. Can we not somehow use those details and pass them to the game server itself so the server thinks they are connecting?

Good work on the -f flood option.

aluigi · **Posted:** 22 Oct 2007 09:06

no it's not possible since the data you see is somewhat "salted", I mean that you don't have the original hash or the original cdkey so you can't duplicate it

staticline · **Joined:** 16 Aug 2007 16:44 **Posts:** 24

okay, but getting a list of hashes isn't hard at all - there must be a way to do this!

staticline · **Joined:** 16 Aug 2007 16:44 **Posts:** 24

did you ever impliment the -f flood option aluigi?

aluigi · **Posted:** 23 May 2008 19:11

yes, I implemented it the 25 Oct 2007 in version 0.1.2

staticline · **Joined:** 16 Aug 2007 16:44 **Posts:** 24

I seem to be running this correctly, but when I test it the server continuously crashes - the server starts (briefly see the normal console with details) but then crashes completely and restarts automatically. Can you see anything I'm doing wrong?

Thanks!

Code:

C:\lpatch>md5sums.exe BF1942_w32ded.exe

MD5sums 1.2 freeware for Win9x/ME/NT/2000/XP+
Copyright (C) 2001-2005 Jem Berkes - http://www.pc-tools.net/
Type md5sums.exe -h for help

[Path] / filename                              MD5 sum
-------------------------------------------------------------------------------
[C:\lpatch\]
BF1942_w32ded.exe                              1f75eb8b55ab5bb4d6782dd6f3be2e45

C:\lpatch>lpatch_nogui.exe server.lpatch

Lame patcher 0.4.2
by Luigi Auriemma
e-mail: aluigi@autistici.org
web:    aluigi.org



BF1942_w32ded.exe test

Specify the name of the file (BF1942_w32ded.exe):


Success:
I'm ready for starting the patching of the file
Do you want to create a backup file (BF1942_w32ded.exe.LPATCH_BACKUP)?
- choice (y/n): n


Success:
File has been successfully patched!

11 bytes changed

Do you want to see the report of the changes?

- choice (y/n): y


Report:
OFFSET          FROM    TO
00002474        57      90
0000247C        68      C7
0000247D        B0      00
0000247E        96      32
0000247F        6D      33
00002481        50      00
00002482        E8      51
00002483        99      51
00002484        81      51
00002485        13      90
00002486        00      90


C:\lpatch>

aluigi · **Posted:** 03 Oct 2008 14:58

my fault, recheck my post for the new patch:

bf1942-t21.html#p66

staticline · **Joined:** 16 Aug 2007 16:44 **Posts:** 24

ok perfect. It is working nicely. Thanks :)

staticline · **Joined:** 16 Aug 2007 16:44 **Posts:** 24

Argh. No - it deosn't work perfectly at all :(

Before it would crash after just a moment. Now it works great until a player joins - then crashes as the player tries to connect. Any advice?

aluigi · **Posted:** 03 Oct 2008 22:46

it's normal that doesn't work... the byte at offset 0000245B must be 0xEB 8-)
now it should work

staticline · **Joined:** 16 Aug 2007 16:44 **Posts:** 24

ah perfect. :)

It's working nicely now - is there a way that this can be varied? For example, if the server is less than the set number, it shows this number. If it is above, it shows the actual number? Or perhaps doesn't show a fixed number but just multiplies the actual number a bit - up to the server limit? That'd look much more realistic :)

Excellent work so far :)

aluigi · **Posted:** 04 Oct 2008 12:11

everything is possible
in that case the solution is the most obvious modification, a JMP/CALL to an empty zone of the executable where you check the value of EDI and modify it as you want

staticline · **Joined:** 16 Aug 2007 16:44 **Posts:** 24

hehe. But remember you are talking to a beginner trying to learn :)

Can you point me in the right direction here please?

aluigi · **Posted:** 05 Oct 2008 00:33

I can give you a hint.
place a JMP or a CALL at offset 0x2474 which points to a zone of the exe without code (like NOPs and so on) and then you need only to read the number of players in EDI and modify this register as you wish... oh and don't forget to restore the "push edi" and "lea eax, blahblahblah"

staticline · **Joined:** 16 Aug 2007 16:44 **Posts:** 24

I've tried to read up on this but I am beaten :(

aluigi · **Posted:** 05 Oct 2008 14:17

take it as an exercise to learn something about assembly 8-)

staticline · **Joined:** 16 Aug 2007 16:44 **Posts:** 24

I did take it this way :P I'm just in over my depth here! I would like to learn more but don't know if i've got it in me ;) Could you assist possibly a little further?

Sethioz · **Posted:** 06 Oct 2008 11:59

Luigi, think he wants you to explain debugger and how you do that exactly and how you edit file :)

SnoopUW · **Joined:** 11 Mar 2009 08:51 **Posts:** 7

hey,

how can i block this fakeplayers. A guy attack me, that the server is full all time.

thx

??? okay i find the other topic!

Sethioz · **Posted:** 11 Mar 2009 20:28

http://aluigi.org/patches/playerslimiter.zip

SnoopUW · **Joined:** 11 Mar 2009 08:51 **Posts:** 7

someone know the join packet string of bf1942?

aluigi · **Posted:** 15 Apr 2009 17:33

in general you need to use a sniffer (for example wireshark http://www.wireshark.org) to catch the exact packet that you want to filter.

the join packet for bf1942 (the same for any retail version) is attached

SnoopUW · **Joined:** 11 Mar 2009 08:51 **Posts:** 7

thx man!

SnoopUW · **Joined:** 11 Mar 2009 08:51 **Posts:** 7

okay i have a linux server.
i have compiled the source code and copy it to the bf1942 folder.
then i restart my server and export the the LD_PRELOAD.... (duno what it is)

but when i start the attack, the server is still full!

i use your tool:
http://aluigi.org/patches/playerslimiter.zip

aluigi · **Posted:** 15 Apr 2009 20:35

uhmmm I don't know what could be the problem.
if you have followed the step-by-step I wrote in playerslimit.txt I don't have additional ideas/suggestions

SnoopUW · **Joined:** 11 Mar 2009 08:51 **Posts:** 7

ok i have installed kdm and vnc on my root and i sniffed the attack package!
I put the beginning in the packet.dat and compile the file etc.
but when i start the attack again, the server is full!

aluigi · **Posted:** 16 Apr 2009 21:49

uhmmm are you sure that package is correct? it doesn't look like the join packet.

anyway the only thing to which I can thing about your problem is that LD_PRELOAD is not handled or is not possible to hook the recvfrom function of bf1942 for some unknown reasons (uhmmm probably because the server is statically compiled but it's only a hypothesis).
I don't have other ideas at the moment.

upgem · **Joined:** 16 May 2009 17:47 **Posts:** 2

Hi All and Aluigi,

sorry back this old topic, and sorry my bad english!

Resolved the serverfull problem thanks for the instructions (in bf1942fp.exe), but I can??t block attack use tcpfp (remote attack full), dat file is there any protection for this attack? using the program for luigi proxocket?

if they can help me! If you need donations to help I am available too!

thanks

Upgem