PDA

View Full Version : message injection


GrO
13 May 2011, 18:41
Today one guy was disconnected from my game with:

"forced out by possible message injection".

First time i see something like this. I found something about it in v31 release notes, but I still have no idea what that means exactly. Can anyone explain it?

franpa
13 May 2011, 20:41
The person may have been attempting to hack the game or inadvertently been hacking the game via a Wormkit module. The server (Host) detected this and dropped them.

GrO
14 May 2011, 04:52
Thanks. That's, what I was suspecting, but just wanted to be sure.

In case of hacking using WK module, host running WK is more open for such hack attempts, it's more resistant or it's meaningless?

Lex
14 May 2011, 06:27
No. WormKit itself is just a DLL loader.

GrO
14 May 2011, 07:47
Yes, bad question. I should ask, if any of existing WK modules is making a successful hack attempt possible or easier, but I think it's hard to answer.

CyberShadow
14 May 2011, 09:04
Downloaded WormKit modules pose the same risks as any software you download from the Internet - they can do whatever they want with your computer. There's no reason someone wouldn't be able to sneak in a backdoor or leave in a security vulnerability in a module they wrote, which could allow someone to completely take over your computer.

Pac-Man
14 May 2011, 10:16
wkTrojanHorse

Deadcode
20 May 2011, 20:49
Today one guy was disconnected from my game with:

"forced out by possible message injection".

First time i see something like this. I found something about it in v31 release notes, but I still have no idea what that means exactly. Can anyone explain it?

Forced surrender by message injection was something Silkworm 3.5 could do, but I'm not aware of anyone doing that in modern WK modules. Most likely it is a false positive.

I'd like to see the replay, please. That way hopefully I'll be able to see if it is a false positive, and if so, adapt the code to detect whatever kind of false positive it happened to be (if possible).

GrO
20 May 2011, 23:03
Here You go (4th minute):

2011-05-13 16.56.53 [Online] @GrO, eVo`Mycy, OmuS-V-.WAgame (http://www.fileden.com/files/2011/4/16/3116402/2011-05-13%2016.56.53%20%5BOnline%5D%20%40GrO%2C%20eVo%60M ycy%2C%20OmuS-V-.WAgame)

Deadcode
20 May 2011, 23:52
Here You go (4th minute):

2011-05-13 16.56.53 [Online] @GrO, eVo`Mycy, OmuS-V-.WAgame (http://www.fileden.com/files/2011/4/16/3116402/2011-05-13%2016.56.53%20%5BOnline%5D%20%40GrO%2C%20eVo%60M ycy%2C%20OmuS-V-.WAgame)

Thanks. It definitely looks like a false positive. It would seem that OmuS-V- really got disconnected, but the proper disconnection message didn't get created, making it look to W:A like OmuS's team got fake-surrendered by you. The weirdest thing is that you saw the "message injection" message during the game!

Do you remember if OmuS's name went from bright white to gray at that point when the game was being played? Was there any lag?

GrO
21 May 2011, 14:41
Do you remember if OmuS's name went from bright white to gray at that point when the game was being played? Was there any lag?

For me his nick was gray, but for eVo`Mycy was still white and he could even PM him. I think there were no lag, while it happened before OmuS's turn, but I'm not 100% sure now.

Additionally 2 WK modules were loaded: WkAntiLag and WkKawooshKick.

Deadcode
21 May 2011, 20:15
For me his nick was gray, but for eVo`Mycy was still white and he could even PM him. I think there were no lag, while it happened before OmuS's turn, but I'm not 100% sure now.

Additionally 2 WK modules were loaded: WkAntiLag and WkKawooshKick.

It would be helpful if I could see the replays of eVo`Mycy and OmuS of that game, please!

I suspect wkKawooshKick could be responsible for the bug, perhaps due to being written without adequate understanding of W:A v3.6.30+'s inner workings. (wkAntiLag apparently just changes the process priority.)

GrO
21 May 2011, 20:59
I'll try to get those replays, when I'll meet them.

Deadcode
22 May 2011, 00:19
I'll try to get those replays, when I'll meet them.
Thank you.

Some more questions:
Did you use any wkKawooshKick features during that game?
Did you use any wkKawooshKick features during that W:A instance, before that game? (e.g. kicking someone in a previous game but in the same WA.EXE launching)

GrO
22 May 2011, 02:25
Thank you.

Some more questions:
Did you use any wkKawooshKick features during that game?
Did you use any wkKawooshKick features during that W:A instance, before that game? (e.g. kicking someone in a previous game but in the same WA.EXE launching)

For both questions the answer is no.
I've only tried to kick OmuS, after he got disconnected, when Mycy told me he still sees him as connected, but I couldn't kick him, while for me he was offline.