New ShardManager exploit has appeared

Hello,

Starting from 2 days ago, our shardmanager starts to get some kind of new attack. It displays in shardmanager window "Exception occured in Shard Update" thousand of times and thousand of dmp files are created in vsro directory since msg count of shardmanager reaches 100-120 k. After that, shardmanager is locked and no one can enter the game before it is restarted. Does anyone have an idea on what can be done ?

Thank you for any help.

Is the port of the shard open?

Quote:

Originally Posted by mettyou Hello, Starting from 2 days ago, our shardmanager starts to get some kind of new attack. It displays in shardmanager window "Exception occured in Shard Update" thousand of times and thousand of dmp files are created in vsro directory since msg count of shardmanager reaches 100-120 k. After that, shardmanager is locked and no one can enter the game before it is restarted. Does anyone have an idea on what can be done ? Thank you for any help.

Actually , disabling dmps by olly dbg is a good choice. ( Never tested it on Shard manager , did with gameserver )

No, only gateway and agentserver ports are open to public as it must be

Quote:

Originally Posted by Phoenix 1337 Actually , disabling dmps by olly dbg is a good choice. ( Never tested it on Shard manager , did with gameserver )

Do you have any idea on disabling dmps with shardmanager, it is different from gameserver. Changing name of the .dll which is used to create dmps is a choice I think and did that.

Face it or not sro is dead

Quote:

Originally Posted by LastThief* Face it or not sro is dead

What do you mean?

Which server are you running?

You can try to disable the creation of dump files, whether it will fix the exploit is an unanswered question. The error message is free for interpretation however

Quote:

Originally Posted by Nezekan Which server are you running? You can try to disable the creation of dump files, whether it will fix the exploit is an unanswered question. The error message is free for interpretation however

We use vsro 1.188 files. I tried to disable dump files for shardmanager but still not success. Have an idea on how to do it?

Quote:

Originally Posted by mettyou We use vsro 1.188 files. I tried to disable dump files for shardmanager but still not success. Have an idea on how to do it?

I will play some in ollydbg to figure it out , Till then , you could ask an expert in ollydbg.

[New Shard Manager Exploit] has arrived in ?
You better play sro instead of working on it lol

Quote:

Originally Posted by sarkoplata [New Shard Manager Exploit] has arrived in ? You better play sro instead of working on it lol

Thank you for your advice, but you had better keep it for your own and not comment if you dont have any idea on what we are talking about.

Quote:

Originally Posted by mettyou Thank you for your advice, but you had better keep it for your own and not comment if you dont have any idea on what we are talking about.

This is a forum and everyone can say their thoughts freely bla bla... sorry if my comment did not include your fix. Bye

joysro ? :D

Write a proxy for your managers and servers that filter out those packets.

Quote:

Originally Posted by Iwa13 joysro ? :D

??

Quote:

Originally Posted by InZiDeR Write a proxy for your managers and servers that filter out those packets.

Thank you for the answer, we already have a proxy for that but it is complicated to find out the packages which cause the problem.