Anti-crash

BoostyQ · 06/10/2016, 01:20

Hi guys,
Last day I noticed that someone crashing the server...
Well, if Aeria don't want to fix it, then I will

---------------------------------------
It happens at address: S4Client.exe + 0xBCB02A

Code:

.text:0174B020 Suspect         proc near               ; CODE XREF: Game__GameObject__CShield__CShield+3A2p
.text:0174B020                                         ; Game__Movie__CMovieObstruction__CMovieObstruction+2D3p ...
.text:0174B020
.text:0174B020 var_4           = dword ptr -4
.text:0174B020 arg_0           = dword ptr  8
.text:0174B020
.text:0174B020                 push    ebp
.text:0174B021                 mov     ebp, esp
.text:0174B023                 push    ecx
.text:0174B024 ; 4:   if ( *(_DWORD *)(this + 0x1C) )
.text:0174B024                 mov     [ebp+var_4], ecx
.text:0174B027                 mov     eax, [ebp+var_4]
.text:0174B02A                 cmp     dword ptr [eax+1Ch], 0 <--- THIS
.text:0174B02E                 jnz     short loc_174B037
.text:0174B030 ; 7:     result = &byte_203A314;
.text:0174B030                 mov     eax, offset byte_203A314
.text:0174B035                 jmp     short loc_174B046
.text:0174B037 ; ---------------------------------------------------------------------------
.text:0174B037 ; 5:     result = sub_11373B0(*(_DWORD *)(this + 0x1C), a2);
.text:0174B037
.text:0174B037 loc_174B037:                            ; CODE XREF: Suspect+Ej
.text:0174B037                 mov     ecx, [ebp+arg_0]
.text:0174B03A                 push    ecx
.text:0174B03B                 mov     edx, [ebp+var_4]
.text:0174B03E                 mov     ecx, [edx+1Ch]
.text:0174B041                 call    sub_11373B0
.text:0174B046 ; 8:   return result;
.text:0174B046
.text:0174B046 loc_174B046:                            ; CODE XREF: Suspect+15j
.text:0174B046                 mov     esp, ebp
.text:0174B048                 pop     ebp
.text:0174B049                 retn    4
.text:0174B049 Suspect         endp

It's all because that at this point EAX=0 when it crashing, so instruction tryin' to read a bad address..
---------------------------------------
Well, how to bypass it?
All you need is patch address S4Client.exe + 0xBCB02A by NOPs (5x - 90 90 90 90 90) so this function always will return 0, but crash will not touch you.

---------------------------------------
Thanks for attention,
Let me know if it works for u

What is your next move 5302822861182333 ?

정강이 · 06/10/2016, 06:49

can someone leave a feedback
to busy to redownload s4

[Beatrice] · 06/10/2016, 06:54

If this is for c0unt, it won't work. This indeed may prevent the crash but c0unt moves you out of proudnet. You need to reconnect again.

Edit : It seems its something else but no idea what it is, been a long time since i last played lol

▒ Ant. · 06/10/2016, 08:29

Quote:

Originally Posted by [Beatrice]

moves you out of proudnet.

OnTopic: Yeah, this has been happening for a while now. Basically they are sending you a bad "Create Block" packet and it throws an exception which isn't caught. It's a bit widespread now I suppose, haven't been keeping up much with S4 these days.

Alas, I threw together a quick script in CE to patch it out for a friend, I don't mind if others use it 'cause I think these crashes are bs.

Ghetto Anti-Crash (Block)

BoostyQ · 06/10/2016, 08:59

EDIT:
Crash that doing player 5302822861182333 happens when he sending you a packet about "Block" skill, you client trying to display it (Game::P2PObject::CObstruction::CObstruction), but when it reading information it crashes 'cause some pointer has null.
-------------------------------------------
I am not against this cheat, in the intellectual sense.
But what makes this guy - too brazenly.
So, to get around this, you can use my method or method of ▒ Ant. (It still works, and it's well logical point ^. ^)

~~Deverixz~~ · 06/10/2016, 10:55

for everyone who is lazy I fast made that lil cheatengine table. Credits are still going to Ant. & BoostyQ (includes both)

Xyner · 06/10/2016, 13:25

Quote:

Originally Posted by Deverixz

for everyone who is lazy I fast made that lil cheatengine table. Credits are still going to Ant. & BoostyQ (includes both)

HI HI i'm lazy thanks XD

[Melvin] · 06/10/2016, 16:34

Quote:

Originally Posted by Deverixz

for everyone who is lazy I fast made that lil cheatengine table. Credits are still going to Ant. & BoostyQ (includes both)

So this fix kick by c0unt,everytime joining a room?

If yes then thanks alot!

Minxxe · 06/10/2016, 18:29

Quote:

Originally Posted by [Melvin]

So this fix kick by c0unt,everytime joining a room?

If yes then thanks alot!

i think this will not help against c0unt only against those "noname" crasher

~~Deverixz~~ · 06/10/2016, 20:04

Quote:

Originally Posted by [Melvin]

So this fix kick by c0unt,everytime joining a room?

If yes then thanks alot!

Did I ever said its against the c0unt kick? I just put BoostyQ's and Ant.'s anticrash method into one cheattable for those, who are lazy or not able to do it. Also I've searched the pattern for BoostyQ's method but that doesnt really matter atm.

~~TheMokko~~ · 06/10/2016, 20:53

Quote:

Originally Posted by .FTF-LuckyNekox

0815

0815 ist ein Begriff der Deutschen aus dem 1. Weltkrieg. Als besserer allgemeiner begriff eignet sich da btw. 1337.

@ Maybe usefull. If I use it I'll never know if it works cause I can't get kicked if it worked

Minxxe · 06/10/2016, 23:20

Quote:

Originally Posted by TheMokko

0815 ist ein Begriff der Deutschen aus dem 1. Weltkrieg. Als besserer allgemeiner begriff eignet sich da btw. 1337.

@ Maybe usefull. If I use it I'll never know if it works cause I can't get kicked if it worked

Klugscheißen kannste woanders :^)
aber hab es extra für dich zu "noname" geändert <3

BoostyQ · 06/11/2016, 09:39

Quote:

Originally Posted by [Melvin]

So this fix kick by c0unt,everytime joining a room?

If yes then thanks alot!

Sorry, but it will not, I don't know who is c0unt and for now I've never seen this crash...
Although, It's possible, sometimes game crashes for me, but I thought it was my failures, or not?

~~Shinzuya~~ · 06/11/2016, 10:04

Quote:

Originally Posted by BoostyQ

Sorry, but it will not, I don't know who is c0unt and for now I've never seen this crash...
Although, It's possible, sometimes game crashes for me, but I thought it was my failures, or not?

If it only happens sometimes, then you dont get kicked by count.
After you joined a room, you have to wait like 10-20 Seconds and then you will get a crash.

4102 · 06/11/2016, 16:53

Quote:

Originally Posted by Shinzuya

If it only happens sometimes, then you dont get kicked by count.
After you joined a room, you have to wait like 10-20 Seconds and then you will get a crash.

Are you srs? I thought i get c0unted but seems like not. Do you know why i always keep getting a relay server connection terminated message in the second half near the end of a match. Happens with new Accounts aswell. And my internet is fine btw