Milamber

iTrader: (2)

Anyone played it yet, whats it like?

InvisibleMan

had one go at the demo lastnight, looks good. Slo-mo is fun. check out the 2 or so other threads about it

Milamber

iTrader: (2)

Aaaahhh the fabled Scoobynet "search" function......

badcompany

i was playing this game before ..its very taxing on a pc in any setting it seems

even on low settings the tracer bullets from the guns dont seem to

go where you aim the gun ?????

MJW

Its shadow effects and lighting effects which kill the performance - if you turn these down the game should be more playable.

Nicks VR4

Worth a read

http://aluigi.altervista.org/adv/lithsock-adv.txt

Luigi Auriemma

Application: Lithtech engine (new network protocol)
http://www.lithtech.com
Games: Contract Jack <= 1.1
F.E.A.R. <= 1.01
No one lives forever 2 <= 1.3
Tron 2.0 <= 1.042
... others?
Platforms: Windows and Mac
Bug: socket unreacheable
Exploitation: remote, versus server
Date: 13 December 2004
Author: Luigi Auriemma
e-mail: aluigi@autistici.org
web: http://aluigi.altervista.org


################################################## #####################


1) Introduction
2) Bug
3) The Code
4) Fix


################################################## #####################

===============
1) Introduction
===============


The Lithtech engine is a game engine used by many games.
Some of the latest games released and based on this engine use a
network protocol different than all the others (probably they use a new
version of the engine but naturally I don't know all these details).

Just these latest games (all developed by Monolith) are those affected
by the bug I'm going to describe: Contract Jack (Nov 2003), No one
lives forever 2 (Oct 2002) and Tron 2.0 (Aug 2003), but possibly others
too.

F.E.A.R and its 1.01 patch have been released in October 2005 and are
vulnerable too.


################################################## #####################

======
2) Bug
======


The new network protocol used by the Lithtech engine is composed by a
loop used to handle all the UDP packets received.

A select() function with a time out of 30 seconds searchs for new data
into the socket's queue. If data is received or the socket goes in
time out, a recvfrom() is called and its return value is checked to
know if has happened an error.
If there is a socket error, the game calls WSAGetLastError() to catch
the error code and returns reaching a main check that is made ever
before the usual select() function.
This so-called "main check" simply controls that the error returned by
WSAGetLastError() (and stored in a specific variable) is "Operation
would block" (10035, the only type of error accepted to continue the
listening loop).

If an attacker sends an UDP packet of zero bytes, recvfrom() returns
this length and an instruction checks just if it is equal than zero. In
this case the code flow returns to the "main check" that controls the
error code (not set, so equal to zero) and since it is not 10035 exits
from the loop that handles the socket's data.

After that, the server will be no longer able to receive packets
because the loop is completely dead.

A similar problem happens if an attacker sends an UDP packet with a
size major/equal than 8193 bytes (max data read by recvfrom()) and
minor/equal than 12280 (otherwise select() doesn't catch it).
The "main check" will fail as before because the error code will be
different than 10035 (in fact it will be 10040, "Message too long").


################################################## #####################

===========
3) The Code
===========


http://aluigi.altervista.org/poc/lithsock.zip


################################################## #####################

======
4) Fix
======


No fix.
Just some weeks ago I released an advisory about another bug in the
Lithtech engine and ignored by the developers, so is useless to try to
recontact them again.

However I have found a work-around to avoid the problem and I have
written an universal autopatcher that can fix both lithtech.exe (the
server launched from the game) and server.dll (the dedicated server):

http://aluigi.altervista.org/patches/lithsockfix.zip

stevebt

iTrader: (8)

im busy playing it and its a good game, i prefer it to quake 4

Milamber

iTrader: (2)

UnrealQuake 4 you mean bit similar for my liking, lost it's way.

stevebt

iTrader: (8)

if i had to say anything i would say doom3 and quake4 are very similar, nothing like unreal ???

Milamber

iTrader: (2)

Thought the gameplay and weapons were all a bit similar for my liking, bit bored of the franchise now to be honest.

badcompany

after a few tweeks here and there it plays 100% now

very impressed .but i couldnt play it on high settings with

pentium 4

2 gig of ram

ge f 6800gt 256mb ddr3

but even with some settings on medium

its one of the best games ive seen on a pc..

stevebt

iTrader: (8)

i cant play it on top settings as my LCD tv will only allow 1280x768 res, but even at that res this game and all my other games look far better than when i had them at 1600x1200 on my crt monitor

MadGrip

completed it

Milamber

iTrader: (2)

Nice one, I have to keep walking away coz it scares the crap out of me

InvisibleMan

cant be that difficult if youve completed it already? How many hrs & how many saves? try it again on hard & no pressing the F5

InvisibleMan

its like a John Woo movie & The Ring

The live action prequel short film is abit creepy