New ShardManager exploit has appeared

mettyou · 02/27/2013, 14:13

Hello,

Starting from 2 days ago, our shardmanager starts to get some kind of new attack. It displays in shardmanager window "Exception occured in Shard Update" thousand of times and thousand of dmp files are created in vsro directory since msg count of shardmanager reaches 100-120 k. After that, shardmanager is locked and no one can enter the game before it is restarted. Does anyone have an idea on what can be done ?

Thank you for any help.

GoneUp · 02/27/2013, 14:43

Is the port of the shard open?

鳳凰城 · 02/27/2013, 14:46

Quote:

Originally Posted by mettyou

Hello,

Starting from 2 days ago, our shardmanager starts to get some kind of new attack. It displays in shardmanager window "Exception occured in Shard Update" thousand of times and thousand of dmp files are created in vsro directory since msg count of shardmanager reaches 100-120 k. After that, shardmanager is locked and no one can enter the game before it is restarted. Does anyone have an idea on what can be done ?

Thank you for any help.

Actually , disabling dmps by olly dbg is a good choice. ( Never tested it on Shard manager , did with gameserver )

mettyou · 02/27/2013, 14:47

No, only gateway and agentserver ports are open to public as it must be

Quote:

Originally Posted by Phoenix 1337

Actually , disabling dmps by olly dbg is a good choice. ( Never tested it on Shard manager , did with gameserver )

Do you have any idea on disabling dmps with shardmanager, it is different from gameserver. Changing name of the .dll which is used to create dmps is a choice I think and did that.

LastThief* · 02/27/2013, 14:56

Face it or not sro is dead

mettyou · 02/27/2013, 15:03

Quote:

Originally Posted by LastThief*

Face it or not sro is dead

What do you mean?

Nezekan · 02/27/2013, 15:22

Which server are you running?

You can try to disable the creation of dump files, whether it will fix the exploit is an unanswered question. The error message is free for interpretation however

mettyou · 02/27/2013, 15:55

Quote:

Originally Posted by Nezekan

Which server are you running?

You can try to disable the creation of dump files, whether it will fix the exploit is an unanswered question. The error message is free for interpretation however

We use vsro 1.188 files. I tried to disable dump files for shardmanager but still not success. Have an idea on how to do it?

鳳凰城 · 02/27/2013, 16:00

Quote:

Originally Posted by mettyou

We use vsro 1.188 files. I tried to disable dump files for shardmanager but still not success. Have an idea on how to do it?

I will play some in ollydbg to figure it out , Till then , you could ask an expert in ollydbg.

sarkoplata · 02/27/2013, 17:13

[New Shard Manager Exploit] has arrived in ?
You better play sro instead of working on it lol

mettyou · 02/27/2013, 19:21

Quote:

Originally Posted by sarkoplata

[New Shard Manager Exploit] has arrived in ?
You better play sro instead of working on it lol

Thank you for your advice, but you had better keep it for your own and not comment if you dont have any idea on what we are talking about.

sarkoplata · 02/27/2013, 21:27

Quote:

Originally Posted by mettyou

Thank you for your advice, but you had better keep it for your own and not comment if you dont have any idea on what we are talking about.

This is a forum and everyone can say their thoughts freely bla bla... sorry if my comment did not include your fix. Bye

Iwa13 · 02/28/2013, 18:18

joysro ?

InZiDeR · 03/02/2013, 21:53

Write a proxy for your managers and servers that filter out those packets.

mettyou · 03/04/2013, 15:21

Quote:

Originally Posted by Iwa13

joysro ?

??

Quote:

Originally Posted by InZiDeR

Write a proxy for your managers and servers that filter out those packets.

Thank you for the answer, we already have a proxy for that but it is complicated to find out the packages which cause the problem.