Staredit Network > Forums > General StarCraft > Topic: How does the game list hack work, and how to stop it?
How does the game list hack work, and how to stop it?
Jan 11 2016, 3:09 am
By: sethmachine  

Jan 11 2016, 3:09 am sethmachine Post #1



Hello,

Occasionally the game list on a given gateway (e.g. US East) is unusable. By that, someone uses a hack to redirect all the games to their own game, usually labeled A > B or A OWN YOU, where A is some variable.

My question is, how does this hack work? I'm a software engineer, so I'm curious what is actually going on (and really curious why another programmer would do something so malicious).

What I noticed defeats this hack is:

1. Making a private/password game.

2. Using some kind of Ip Blocker, which blocks certains IP addresses related to the hack.



None.

Jan 11 2016, 4:33 am Oh_Man Post #2

Find Me On Discord (Brood War UMS Community & Staredit Network)

Quote from sethmachine
(and really curious why another programmer would do something so malicious).





Jan 11 2016, 7:38 am iCCup.xboi209 Post #3



The server allows any user to change the game name of any game because it doesn't check who's the host. A malicious user can send packet 0x1C with the modified game name and the server will then reflect that to everyone. My guess is that the server at least checks to see if the user sending that packet is actually in the game lobby and denies the packet if the user isn't.
It's probably possible to counter this by continuously sending packets with the proper data which will overwrite the data from the packet that the malicious user sent, I'm just not sure if anti-flooding protection applies to this packet.

Post has been edited 3 time(s), last time on Jan 11 2016, 7:46 am by iCCup.xboi209.



None.

Jan 15 2016, 3:02 am sethmachine Post #4



Quote from iCCup.xboi209
The server allows any user to change the game name of any game because it doesn't check who's the host. A malicious user can send packet 0x1C with the modified game name and the server will then reflect that to everyone. My guess is that the server at least checks to see if the user sending that packet is actually in the game lobby and denies the packet if the user isn't.
It's probably possible to counter this by continuously sending packets with the proper data which will overwrite the data from the packet that the malicious user sent, I'm just not sure if anti-flooding protection applies to this packet.

But how does a malicious user persist in doing this? Clearly nobody keeps checking the game list and changing the name of each one as it comes along. It sounds like someone wrote some software that monitors the game list and periodically sends out these packets to change the game name ?

Can this be used to redirect players to an authentic game? It seems when this hack is going, the game is redirected to a non-joinable map.




Jan 15 2016, 4:21 pm NudeRaider Post #5

We can't explain the universe, just describe it; and we don't know whether our theories are true, we just know they're not wrong. >Harald Lesch

Quote from sethmachine
It sounds like someone wrote some software that monitors the game list and periodically sends out these packets to change the game name ?
Exactly.




Jan 16 2016, 6:02 am iCCup.xboi209 Post #6



Quote from NudeRaider
Quote from sethmachine
It sounds like someone wrote some software that monitors the game list and periodically sends out these packets to change the game name ?
Exactly.
And that software is publicly available if you look hard enough.



None.

Options
  Back to forum
Please log in to reply to this topic or to report it.
Members in this topic: None.
[03:29 am]
DarkenedFantasies -- Probably just didn't care. For example, at some point before release, they've updated the graphics of some of the Protoss buildings (Forge, CyberCore, Citadel, Observatory, Arbiter Tribunal), but instead of properly re-rendering them with edited 3D models, they did crappy copy-paste jobs on the rendered graphics.
[2026-6-22. : 8:35 pm]
Ultraviolet -- :wob:
[2026-6-21. : 11:38 pm]
Symmetry -- :wob:
[2026-6-21. : 4:56 am]
Ultraviolet -- I suppose we'll likely never know, but my guess would be that they already saw it operating successfully and there was no monetary incentive to finish the original work. And the dev cycle in old school Blizzard was so hectic, it's possible it just got forgotten about after the original game got released. Plus there's an element of existing MPQ files that were packaged with the original discs becoming outdated if they updated it. And it's not like they remade the original MPQs, they just made new ones for BW specifically
[2026-6-21. : 4:26 am]
Oh_Man -- so that makes me think maybe the theory they are unfinished is not true and its a deliberate design decision, coz why not finish them wen ur making brood war?
[2026-6-21. : 4:25 am]
Oh_Man -- the thing is thos buildings are from classic. that means they went ahead and made brood war without ever finishing the 'unfinished' buildings
[2026-6-20. : 6:15 pm]
Ultraviolet -- Yeah he's talked about a lot of that stuff in his casts before. It seems plausible. Especially knowing how Blizzard of yesteryear operated.
[2026-6-20. : 3:47 pm]
NudeRaider -- to clarify: couldn't recall the behavior for every single Protoss building but I was aware the disparity exists.
[2026-6-20. : 3:43 pm]
NudeRaider -- Contained nothing new for me. Didn't know all building's behavior, but very much all unit's. Also Terran balance whine - also nothing new :lol:
[2026-6-19. : 9:57 am]
Oh_Man -- makes me wonder if SEN knows anything about the topic
Please log in to shout.


Members Online: JamaL, Moose