diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index c3e08ea..1158786 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -13,6 +13,9 @@ concurrency: group: ${{ github.ref }} cancel-in-progress: true +env: + PREMAKE_VERSION: "5.0.0-beta2" + jobs: build: name: Build binaries @@ -20,8 +23,8 @@ jobs: strategy: matrix: configuration: - - Debug - - Release + - debug + - release steps: - name: Check out files uses: actions/checkout@main @@ -34,8 +37,13 @@ jobs: - name: Add msbuild to PATH uses: microsoft/setup-msbuild@main + - name: Install Premake5 + uses: diamante0018/setup-premake@master + with: + version: ${{ env.PREMAKE_VERSION }} + - name: Generate project files - run: tools/premake5 vs2022 + run: premake5 vs2022 - name: Set up problem matching uses: ammaraskar/msvc-problem-matcher@master diff --git a/README.md b/README.md index 51f865b..123c4ad 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,7 @@ This software has been created purely for the purposes of academic research. It This software is a proof of concept for a vulnerability that is patched. You can't harm anyone with it if you use it on Pluto (If you were to update the addresses for the 1.9 patch of the game). You also can't use this vulnerability on Tekno as it was fixed in 2021 (2.0.6 version of their client). If you think your server is vulnerable you should seek help in the appropriate discord server or forum of the client you use. -The exploit is documented in [exploit.cpp](https://github.com/diamante0018/MW3ServerFreezer/blob/main/src/client/component/exploit.cpp) +The exploit is documented in [exploit.cpp](src/client/component/exploit.cpp) ## Update @@ -23,7 +23,7 @@ The patch made by Discord user "Zero Bytes" made the Netchan_Process stub return The return value is completely non-sensical and allows for the execution of SV_PacketEvent to continue. ```c -int __cdecl Netchan_Process_stub(netchan_t* a1, msg_t* a2) +int __cdecl Netchan_Process_Stub(netchan_t* a1, msg_t* a2) { if ( a2->cursize <= 14 || !a2->data[14] ) return Netchan_Process_Original(a1, a2); @@ -37,9 +37,10 @@ int __cdecl Netchan_Process_stub(netchan_t* a1, msg_t* a2) ``` Later revisions of the Tekno gods server DLL seem to have changed this behaviour and now the stub returns `0` when a suspicious packet is detected. +The exploit was finally fixed. ```c -int __cdecl Netchan_Process_stub(netchan_t* a1, msg_t* a2) +int __cdecl Netchan_Process_Stub(netchan_t* a1, msg_t* a2) { if ( a2->cursize <= 14 || !a2->data[14] ) return Netchan_Process_Original(a1, a2); @@ -54,9 +55,14 @@ int __cdecl Netchan_Process_stub(netchan_t* a1, msg_t* a2) ## Compile from source -- Clone the Git repo. Do NOT download it as ZIP, that won't work. -- Update the submodules and run `premake5 vs2022` or simply use the delivered `generate.bat`. -- Build via solution file in `build\mw3-server-freezer.sln`. +- Install [Visual Studio 2022][vs-link] and enable `Desktop development with C++` +- Install [Premake5][premake5-link] and add it to your system PATH +- Clone this repository using [Git][git-link] +- Update the submodules using ``git submodule update --init --recursive`` +- Run Premake with the option ``premake5 vs2022`` (Visual Studio 2022). No other build systems are supported. +- Build the project via the solution file in `build\mw3-server-freezer.sln`. + +Only the Win32 platform is supported. Do not attempt to build for Windows ARM 64 or x64. ## Commands @@ -68,3 +74,7 @@ List of hard-coded key binds: ## Credits - QUADFOST posted the original exploit on a popular gaming forum. I wrote this software implementing the exploit. + +[vs-link]: https://visualstudio.microsoft.com/vs +[premake5-link]: https://premake.github.io/download +[git-link]: https://git-scm.com diff --git a/generate.bat b/generate.bat deleted file mode 100644 index 2bad27b..0000000 --- a/generate.bat +++ /dev/null @@ -1,4 +0,0 @@ -@echo off -echo Updating submodules... -call git submodule update --init --recursive -call tools\premake5 %* vs2022 diff --git a/premake5.lua b/premake5.lua index 69287ee..ba4c670 100644 --- a/premake5.lua +++ b/premake5.lua @@ -36,7 +36,7 @@ location "./build" objdir "%{wks.location}/obj" targetdir "%{wks.location}/bin/%{cfg.platform}/%{cfg.buildcfg}" -configurations {"Debug", "Release"} +configurations {"debug", "release"} language "C++" cppdialect "C++20" @@ -57,15 +57,15 @@ filter "platforms:Win*" defines {"_WINDOWS", "WIN32"} filter {} -filter "configurations:Release" +filter "configurations:release" optimize "Size" defines {"NDEBUG"} flags {"FatalCompileWarnings"} buildoptions {"/GL"} - linkoptions { "/IGNORE:4702", "/LTCG" } + linkoptions {"/IGNORE:4702", "/LTCG"} filter {} -filter "configurations:Debug" +filter "configurations:debug" optimize "Debug" defines {"DEBUG", "_DEBUG"} filter {} @@ -91,7 +91,7 @@ targetname "mw3-server-freezer" pchheader "std_include.hpp" pchsource "src/client/std_include.cpp" -linkoptions {"/IGNORE:4254", "/PDBCompress"} +linkoptions {"/PDBCompress"} files {"./src/client/**.hpp", "./src/client/**.cpp"} diff --git a/tools/premake5.exe b/tools/premake5.exe deleted file mode 100644 index 1a637aa..0000000 Binary files a/tools/premake5.exe and /dev/null differ