[Release] Login any account / out player fix

[Pumaaa]

Send PACKETTYPE_JOIN with idPlayer of target.

-> player outed.

I do apologize for not having tested the stuff I described here.

[pbben15]

sorry if this is kinda OT
but do you have an idea what is the fix for this?

Originally Posted by pbben15

DatabaseServer.exe auto crash every like 1-2 hours but before only occurs only once a day. please help

 Spoiler

'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\ntdll.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\kernel32.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\KernelBase.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\ws2_32.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\winmm.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\odbc32.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\user32.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\gdi32.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\advapi32.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\oleaut32.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\msimg32.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\shlwapi.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\uxtheme.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\dwmapi.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\oledlg.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\oleacc.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\GdiPlus.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\propsys.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\imm32.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\winspool.drv'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\shell32.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\ole32.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\nsi.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\rpcrt4.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\winmmbase.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\msvcrt.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\sechost.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\combase.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\dbghelp.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\msctf.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\sspicli.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\cfgmgr32.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\devobj.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\cryptbase.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\bcryptprimitives.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\bcrypt.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\sqlncli11.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\msvcr100.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\version.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\comctl32.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\comdlg32.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\netapi32.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\SHCore.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\netutils.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\srvcli.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\wkscli.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\1033\sqlnclir11.rll'. Module was built without symbols.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\crypt32.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\msasn1.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\dpapi.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\odbccp32.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\secur32.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\kerberos.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\cryptdll.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\msv1_0.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\ntdsapi.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\dsparse.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\logoncli.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\clusapi.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\resutils.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\security.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\schannel.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Program Files (x86)\Microsoft SQL Server\90\Shared\instapi.dll'. Module was built without symbols.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9 a1e18e3b_8.0.50727.8428_none_d08a11e2442dc25d\msvc r80.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\mswsock.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\dnsapi.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\rasadhlp.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\IPHLPAPI.DLL'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\winnsi.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\FWPUCLNT.DLL'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\ncrypt.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\ntasn1.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\ncryptsslp.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\mtxdm.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\kernel.appcore.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\clbcatq.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\comsvcs.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\cryptsp.dll'. Symbols loaded.
'DatabaseServer.exe' (Win32): Loaded 'C:\Windows\SysWOW64\rsaenh.dll'. Symbols loaded.
The thread 0x149c has exited with code 0 (0x0).
DATABASESERVER.EXE // PACKETTYPE_JOIN // 3028
DATABASESERVER.EXE // JOIN_0 // 3028
DATABASESERVER.EXE // JOIN_1 // 3028
m_dwFlag=0x00000000, nId=531, tStart=0, tEnd=0, t=1506217049, nFlag=-2147483648, Memory used:3502657536


T: CCoupleHelper.OnTimer
m_dwFlag=0x00000000, nId=501, tStart=1238745600, tEnd=1240869600, t=1506217049, nFlag=2, Memory used:3502657536

m_dwFlag=0x00000000, nId=502, tStart=1238745600, tEnd=1240869600, t=1506217049, nFlag=4, Memory used:3502657536

after SendEventFlag Memory used:3502657536

after prj.m_EventLua.m_Access.Enter() Memory used:3502657536

after g_dpCoreSrvr.SendEventLuaNotice(); Memory used:3502657536

after CDPTrans::GetInstance()->SendEventLuaState Memory used:3502657536

after prj.m_EventLua.m_Access.Leave(); Memory used:3502657536

after CDPTrans::GetInstance()->SendGC1to1Open(); Memory used:3502657536

after __GETMAILREALTIME Memory used:3502727168

The thread 0xb48 has exited with code 0 (0x0).
The thread 0x15f8 has exited with code 0 (0x0).

T: CCoupleHelper.OnTimer
m_dwFlag=0x00000000, nId=531, tStart=0, tEnd=0, t=1506217109, nFlag=-2147483648, Memory used:3520327680

m_dwFlag=0x00000000, nId=501, tStart=1238745600, tEnd=1240869600, t=1506217109, nFlag=2, Memory used:3520327680

m_dwFlag=0x00000000, nId=502, tStart=1238745600, tEnd=1240869600, t=1506217109, nFlag=4, Memory used:3520327680

after SendEventFlag Memory used:3520327680

after prj.m_EventLua.m_Access.Enter() Memory used:3520327680

after g_dpCoreSrvr.SendEventLuaNotice(); Memory used:3520327680

after CDPTrans::GetInstance()->SendEventLuaState Memory used:3520327680

after prj.m_EventLua.m_Access.Leave(); Memory used:3520327680

after CDPTrans::GetInstance()->SendGC1to1Open(); Memory used:3520327680

after __GETMAILREALTIME Memory used:3520327680

DATABASESERVER.EXE // PACKETTYPE_JOIN // 3028
DATABASESERVER.EXE // JOIN_0 // 3028
DATABASESERVER.EXE // JOIN_1 // 3028

T: CCoupleHelper.OnTimer
m_dwFlag=0x00000000, nId=531, tStart=0, tEnd=0, t=1506217169, nFlag=-2147483648, Memory used:3535732736

m_dwFlag=0x00000000, nId=501, tStart=1238745600, tEnd=1240869600, t=1506217169, nFlag=2, Memory used:3535732736

m_dwFlag=0x00000000, nId=502, tStart=1238745600, tEnd=1240869600, t=1506217169, nFlag=4, Memory used:3535732736

after SendEventFlag Memory used:3535732736

after prj.m_EventLua.m_Access.Enter() Memory used:3535732736

after g_dpCoreSrvr.SendEventLuaNotice(); Memory used:3535732736

after CDPTrans::GetInstance()->SendEventLuaState Memory used:3535732736

after prj.m_EventLua.m_Access.Leave(); Memory used:3535732736

after CDPTrans::GetInstance()->SendGC1to1Open(); Memory used:3535732736

after __GETMAILREALTIME Memory used:3535732736

DATABASESERVER.EXE // PACKETTYPE_JOIN // 3028
DATABASESERVER.EXE // JOIN_0 // 3028
DATABASESERVER.EXE // JOIN_1 // 3028

T: CCoupleHelper.OnTimer
m_dwFlag=0x00000000, nId=531, tStart=0, tEnd=0, t=1506217229, nFlag=-2147483648, Memory used:3553660928

m_dwFlag=0x00000000, nId=501, tStart=1238745600, tEnd=1240869600, t=1506217229, nFlag=2, Memory used:3553660928

m_dwFlag=0x00000000, nId=502, tStart=1238745600, tEnd=1240869600, t=1506217229, nFlag=4, Memory used:3553660928

after SendEventFlag Memory used:3553660928

after prj.m_EventLua.m_Access.Enter() Memory used:3553660928

after g_dpCoreSrvr.SendEventLuaNotice(); Memory used:3553660928

after CDPTrans::GetInstance()->SendEventLuaState Memory used:3553660928

after prj.m_EventLua.m_Access.Leave(); Memory used:3553660928

after CDPTrans::GetInstance()->SendGC1to1Open(); Memory used:3553660928

after __GETMAILREALTIME Memory used:3553660928


T: CCoupleHelper.OnTimer
m_dwFlag=0x00000000, nId=531, tStart=0, tEnd=0, t=1506217289, nFlag=-2147483648, Memory used:3572432896

m_dwFlag=0x00000000, nId=501, tStart=1238745600, tEnd=1240869600, t=1506217289, nFlag=2, Memory used:3572432896

m_dwFlag=0x00000000, nId=502, tStart=1238745600, tEnd=1240869600, t=1506217289, nFlag=4, Memory used:3572432896

after SendEventFlag Memory used:3572432896

after prj.m_EventLua.m_Access.Enter() Memory used:3572432896

after g_dpCoreSrvr.SendEventLuaNotice(); Memory used:3572432896

after CDPTrans::GetInstance()->SendEventLuaState Memory used:3572432896

after prj.m_EventLua.m_Access.Leave(); Memory used:3572432896

after CDPTrans::GetInstance()->SendGC1to1Open(); Memory used:3572432896

after __GETMAILREALTIME Memory used:3572432896


T: CCoupleHelper.OnTimer
m_dwFlag=0x00000000, nId=531, tStart=0, tEnd=0, t=1506217349, nFlag=-2147483648, Memory used:3590545408

m_dwFlag=0x00000000, nId=501, tStart=1238745600, tEnd=1240869600, t=1506217349, nFlag=2, Memory used:3590545408

m_dwFlag=0x00000000, nId=502, tStart=1238745600, tEnd=1240869600, t=1506217349, nFlag=4, Memory used:3590545408

after SendEventFlag Memory used:3590545408

after prj.m_EventLua.m_Access.Enter() Memory used:3590545408

after g_dpCoreSrvr.SendEventLuaNotice(); Memory used:3590545408

after CDPTrans::GetInstance()->SendEventLuaState Memory used:3590545408

after prj.m_EventLua.m_Access.Leave(); Memory used:3590545408

after CDPTrans::GetInstance()->SendGC1to1Open(); Memory used:3590545408

after __GETMAILREALTIME Memory used:3590545408


T: CCoupleHelper.OnTimer
m_dwFlag=0x00000000, nId=531, tStart=0, tEnd=0, t=1506217409, nFlag=-2147483648, Memory used:3610558464

m_dwFlag=0x00000000, nId=501, tStart=1238745600, tEnd=1240869600, t=1506217409, nFlag=2, Memory used:3610558464

m_dwFlag=0x00000000, nId=502, tStart=1238745600, tEnd=1240869600, t=1506217409, nFlag=4, Memory used:3610558464

after SendEventFlag Memory used:3610558464

after prj.m_EventLua.m_Access.Enter() Memory used:3610558464

after g_dpCoreSrvr.SendEventLuaNotice(); Memory used:3610558464

after CDPTrans::GetInstance()->SendEventLuaState Memory used:3610558464

after prj.m_EventLua.m_Access.Leave(); Memory used:3610558464

after CDPTrans::GetInstance()->SendGC1to1Open(); Memory used:3610558464

after __GETMAILREALTIME Memory used:3610558464

The program '[5124] DatabaseServer.exe' has exited with code 0 (0x0).

btw I'm using Illumine Source.

[Pumaaa]

Originally Posted by pbben15

sorry if this is kinda OT
but do you have an idea what is the fix for this?



btw I'm using Illumine Source.

Assuming the "memory used" stuff is bytes (3610558464)
You're very close to the 3.7gb limit even with compiling .

I assume there's a memory leak in your databaseserver.

A very common mistake is that LPDB_OVERLAPPED_PLUS lpDBOP is not freed using FreeRequest( lpDBOP );

ALL control paths( even on error ) should do this before returning.

If you have new code that does database actions, you should check them.

That these frequent memory logs even exist show evidence that the former creator of the source also had problems of this kind.

[Wanetrain]

Endlich! Es kommt mal einer da drauf.

Ich habe solange gewartet bis es mal einer entdeckt, ja deine Hypothese ist richtig, man kann ohne den richtigen Account jeden X beliebigen Spieler spielen, braucht hierzu nicht mal zwingend die DPID, des weiteren kann man auch jeden Spieler Kicken ohne Probleme.

Dies habe ich damals im Zuge des "Fukk'iT" Hacks was ich mit Clemi entwickelt habe vor paar Jahren herausgefunden und erfolgreich getestet. Man braucht im großen und ganzen nur das Know How wie man an die Spieler ID's kommt und das ist nicht all zu schwer.

Btw du kannst auch bei jedem Spieler eine Message Aufploppen lassen über das "Blocked" System also wo du Chat Nachrichten ausmachst und co, das nervt dann ziemlich.

Mfg

[FlyffServices]

Hallo,

leider klappt dieser Hack so wie geschildert nicht.
Du müsstest die dwAuthKey variable Bruteforcen/zurückrechnen (was nicht geht). Dies geht aber auch nur bei Accounts die bereits eingeloggt sind. Der Account wird als pre-login markiert beim normalen login (wo auch das passwort verifiziert wird) und ist dann erst zum Login in den WorldServer freigeschalten.

Ansonsten könntest du dich einfach vom CacheServer an in deinen Account einloggen und somit einen Ban bypassen.

[Pumaaa]

Du brauchst den authkey nicht um das Packet zu faken.

Wenn du den accountname weißt kannst du loginauthority von einem anderen account übertragen.

Wenn du accountname + playerid eines chars weißt kannst du einen Login faken.

[Pumaaa]

Originally Posted by FlyffServices

Hallo,

bist du dir sicher? Ich hab diese Methode schon vor Jahren rauf und runter getestet und dort war nie etwas möglich.

Wenn man wie du sagst PACKETTYPE_JOIN an den CacheServer sendet greift die Funktion
CDPCacheSrvr::OnAddConnection
in der Datei
CacheServer/DPCacheSrvr.cpp

So wie du es schilderst "man sendet einfach das Join Packet an den Cacheserver der es an den Worldserver weiterleitet und der arme ahnungslose weis nicht wie im geschieht" das passiert sowieso. Der Client sendet IMMER das Join packet an den CacheServer.


Hast du das überhaupt mal getestet? Also nicht mit deinen verbuggten Imaginarum files sondern mit einer bugfreieren cleanen Source.



Ok das erklärst du mir mal wie das erfolgreich getestet wurde. Danke werde dann einen Besen fressen.

Den Besen musst du wohl fressen.

Aber was du gesagt hast ist teilweise richtig. Mir ist ein Fehler unterlaufen, der oben genannte Fix sorgt nur dafür dass man Player nicht mehr outen kann.


Wie oben angemerkt, habe ich es eben nicht getestet.
Daher, 1. post edited.

[Blouflash]

Originally Posted by Pumaaa

Den Besen musst du wohl fressen.

Aber was du gesagt hast ist teilweise richtig. Mir ist ein Fehler unterlaufen, der oben genannte Fix sorgt nur dafür dass man Player nicht mehr outen kann.


Wie oben angemerkt, habe ich es eben nicht getestet.
Daher, 1. post edited.

Ich weiß ja nicht was bei dir in der Source abgeht aber dein out fix bringt absolut nichts.

1. Wird das PACKETTYPE_LEAVE nur intern geschickt.

2. Wird man anhand von der dpid gekickt und nicht anhand der playerID

void CDPCoreClient::OnLeave( CAr & ar, DPID dpid )
{
	CMclAutoLock	Lock( CPlayerMng::Instance()->m_AddRemoveLock );

	DWORD dwSerial;
	ar >> dwSerial;
	CPlayer* pPlayer = CPlayerMng::Instance()->GetPlayerBySerial( dwSerial );  // dpid°¡ serial¹øÈ£ÀÌ´Ù.
	if( pPlayer )
		g_DPCacheSrvr.DestroyPlayer( dpid );
}

3. Wenn der Client das PACKETTYPE_LEAVE an den Cacheserver schickt wird

g_DPClientArray.SendToServer( idFrom, lpMsg, dwMsgSize );

getriggert und dadurch kommste hier raus:

void CDPSrvr::OnRemoveUser( CAr & ar, DPID dpidCache, DPID dpidUser, LPBYTE, u_long )
{
	g_UserMng.RemoveUser( (DWORD)dpidUser ); 
}

[KOPP92i]

Originally Posted by Pumaaa

Wenn du accountname + playerid eines chars weißt kannst du einen Login faken.

Yeah and without any problem if admin doesn't fix it.
-login from any account
-before char select change the string of your acc to another acc you want to out.
-go to char selection --> player out..

the fix isn't hard at all , if someone need it pm me i'll give it for free

[elitemember21]

Originally Posted by KOPP92i

Yeah and without any problem if admin doesn't fix it.
-login from any account
-before char select change the string of your acc to another acc you want to out.
-go to char selection --> player out..

the fix isn't hard at all , if someone need it pm me i'll give it for free

Can you share it?