01-18-2012, 05:04 PM
i made the same fix some minutes ago, but i use a different server, this is where the exploit packet gets read
in helper.exe:
1. patch, jump into codecave
004209A5 - E9 A6662100 JMP Helper.00637050
004209AA 90 NOP
004209AB 90 NOP
004209AC 90 NOP
2. patch, check edx (fame) and eax (exp) for buggy values (<=0 and >= 100)
00637050 8B55 8C MOV EDX,DWORD PTR SS:[EBP-74] //copy fame to edx
00637053 83FA 00 CMP EDX,0 // compare with 0
00637056 7D 05 JGE SHORT Helper.0063705D // jump if >= 0
00637058 BA 00000000 MOV EDX,0 // else fame = 0
0063705D 83FA 64 CMP EDX,64 // compare with 100
00637060 7E 05 JLE SHORT Helper.00637067 // jump if <= 100
00637062 BA 64000000 MOV EDX,64 // else fame = 100
00637067 52 PUSH EDX
00637068 8B45 98 MOV EAX,DWORD PTR SS:[EBP-68] //copy exp to eax
0063706B 83F8 00 CMP EAX,0// compare with 0
0063706E 7D 05 JGE SHORT Helper.00637075// jump if >= 0
00637070 B8 00000000 MOV EAX,0 // else exp = 0
00637075 83F8 64 CMP EAX,64// compare with 100
00637078 7E 05 JLE SHORT Helper.0063707F// jump if <= 100
0063707A B8 64000000 MOV EAX,64// else exp = 100
0063707F 50 PUSH EAX
00637080 8955 8C MOV DWORD PTR SS:[EBP-74],EDX // copy values back, so gameserver has the same fix and not only db
00637083 8945 98 MOV DWORD PTR SS:[EBP-68],EAX //
00637086 - E9 2299DEFF JMP Helper.004209AD // jump back
0063708B 90 NOP

