Hacker attack my AZ by Spell. Maybe some bug in core. So help me

chinaryan commented 5 years ago

Hacker attack my AZ by WPE Spell. I think Maybe some bug in core

SMALL DESCRIPTION:

pos： src\server\game\spells\spell.cpp Spell::CheckEffectExecuteData() if(!m_effectExecuteData) NullException OR ArrayBoundException Exception code: C0000005 ACCESS_VIOLATION

EXPECTED BLIZZLIKE BEHAVIOUR:

Normal run without the bug

CURRENT BEHAVIOUR:

A lots of Spell data package send my AZ service by hacker, while spell finished , AZ core execute Spell()::CheckEffectExecuteData() faction , Crashed! I guess bug on ACE core. Dmp log:

//=====================================================
Exception code: C0000005 ACCESS_VIOLATION
Fault address:  0000000076E3A365 01:0000000000029365 C:\Windows\SYSTEM32\ntdll.dll

Call stack:
Address   Frame     Function      SourceFile
0000000076E3A365  00000000124CF570  RtlFreeHeap+1A5
0000000076D115AA  00000000124CF5A0  HeapFree+A
000007FEF43169D8  00000000124CF5D0  free+1C
000000013F62DA70  00000000124CF610  Spell::~Spell+1B0  d:\core\src\server\game\spells\spell.cpp line 698
000000013F66F386  00000000124CF7D0  PetAI::UpdateAI+7B6  d:\core\src\server\game\ai\coreai\petai.cpp line 264
000000013F540EB8  00000000124CF840  Creature::Update+2E8  d:\core\src\server\game\entities\creature\creature.cpp line 607
000000013F5AB3EE  00000000124CF870  Trinity::ObjectUpdater::Visit<Creature>+5E  d:\core\src\server\game\grids\notifiers\gridnotifiers.cpp line 322
000000013F50F515  00000000124CF8A0  VisitorHelper<Trinity::ObjectUpdater,Creature,TypeList<Corpse,TypeList<DynamicObject,TypeNull> > >+15  d:\core\src\server\shared\dynamic\typecontainervisitor.h line 67
000000013F50F230  00000000124CF8F0  Map::Visit<Trinity::ObjectUpdater,TypeMapContainer<TypeList<GameObject,TypeList<Player,TypeList<Creature,TypeList<Corpse,TypeList<DynamicObject,TypeNull> > > > > > >+B0  d:\core\src\server\game\maps\map.h line 730
000000013F51E493  00000000124CF980  Map::VisitNearbyCellsOf+183  d:\core\src\server\game\maps\map.cpp line 626
000000013F51DBF0  00000000124CFA50  Map::Update+270  d:\core\src\server\game\maps\map.cpp line 709
000000013F51D957  00000000124CFA80  InstanceMap::Update+17  d:\core\src\server\game\maps\map.cpp line 2583
000000013F57EA8D  00000000124CFAB0  MapUpdateRequest::call+1D  d:\core\src\server\game\maps\mapupdater.cpp line 58
000000013F70A939  00000000124CFAE0  DelayExecutor::svc+49  d:\core\src\server\shared\threading\delayexecutor.cpp line 54
000007FEF3D47E4C  00000000124CFB10  ACE_Task_Base::svc_run+3C  d:\core\dep\acelite\ace\task.cpp line 273
000007FEF3D484E9  00000000124CFB50  ACE_Thread_Adapter::invoke_i+69  d:\core\dep\acelite\ace\thread_adapter.cpp line 159
000007FEF3D48441  00000000124CFB90  ACE_Thread_Adapter::invoke+71  d:\core\dep\acelite\ace\thread_adapter.cpp line 94 
//=====================================================

STEPS TO REPRODUCE THE PROBLEM:

I don't know how to make this bug, because it's hacker attacked me.

EXTRA NOTES:

BRANCH(ES):

master

AC HASH/COMMIT:

commit 4e40707f5a2da55fb7d2544e5be856e498fe4b76

OPERATING SYSTEM:

Windows Server 2008 R2 Server 4.0, Enterprise Edition Service Pack 1 (Version 6.1, Build 7601)

MODULES:

\core\src\server\game\spells\spell.cpp

OTHER CUSTOMIZATIONS:

lineagedr commented 5 years ago

Need more information.

chinaryan commented 5 years ago

Need more information.

thank you reply me~ I had update my question

ELdoBA commented 5 years ago

Post crash log on pastebin, and share it here

chinaryan commented 5 years ago

Post crash log on pastebin, and share it here OK thank you relay me ！

crash log ：

Hardware Processor: Intel(R) Xeon(R) CPU L5630 @ 2.13GHz Number Of Processors: 16 Physical Memory: 33545012 KB (Available: 25604688 KB) Commit Charge Limit: 37733320 KB

Operation System Windows Server 2008 R2 Server 4.0, Enterprise Edition Service Pack 1 (Version 6.1, Build 7601)

//===================================================== Exception code: C0000005 ACCESS_VIOLATION Fault address: 0000000076E3A365 01:0000000000029365 C:\Windows\SYSTEM32\ntdll.dll

Registers: RAX:000000F9DE61D80C RBX:0000000A18A52180 RCX:000000FFFFFFFFFF RDX:0000000000000000 RSI:0000000000000000 RDI:0000000000000000 R8: 0000000000000000 R9: 0000000000000000 R10:00060C7603B2002E R11:0000000000370000 R12:00000000D6103220 R13:00000000D3BFFDE0 R14:0000000000000000 R15:0000000000000001 CS:RIP:0033:0000000076E3A365 SS:RSP:002B:00000000124CF500 RBP:DA560E70 DS:002B ES:002B FS:0053 GS:002B Flags:00010202

Call stack: Address Frame Function SourceFile 0000000076E3A365 00000000124CF570 RtlFreeHeap+1A5 0000000076D115AA 00000000124CF5A0 HeapFree+A 000007FEF43169D8 00000000124CF5D0 free+1C 000000013F62DA70 00000000124CF610 Spell::~Spell+1B0 d:\core\src\server\game\spells\spell.cpp line 698 000000013F66F386 00000000124CF7D0 PetAI::UpdateAI+7B6 d:\core\src\server\game\ai\coreai\petai.cpp line 264 000000013F540EB8 00000000124CF840 Creature::Update+2E8 d:\core\src\server\game\entities\creature\creature.cpp line 607 000000013F5AB3EE 00000000124CF870 Trinity::ObjectUpdater::Visit+5E d:\core\src\server\game\grids\notifiers\gridnotifiers.cpp line 322 000000013F50F515 00000000124CF8A0 VisitorHelper<Trinity::ObjectUpdater,Creature,TypeList<Corpse,TypeList<DynamicObject,TypeNull> > >+15 d:\core\src\server\shared\dynamic\typecontainervisitor.h line 67 000000013F50F230 00000000124CF8F0 Map::Visit<Trinity::ObjectUpdater,TypeMapContainer<TypeList<GameObject,TypeList<Player,TypeList<Creature,TypeList<Corpse,TypeList<DynamicObject,TypeNull> > > > > > >+B0 d:\core\src\server\game\maps\map.h line 730 000000013F51E493 00000000124CF980 Map::VisitNearbyCellsOf+183 d:\core\src\server\game\maps\map.cpp line 626 000000013F51DBF0 00000000124CFA50 Map::Update+270 d:\core\src\server\game\maps\map.cpp line 709 000000013F51D957 00000000124CFA80 InstanceMap::Update+17 d:\core\src\server\game\maps\map.cpp line 2583 000000013F57EA8D 00000000124CFAB0 MapUpdateRequest::call+1D d:\core\src\server\game\maps\mapupdater.cpp line 58 000000013F70A939 00000000124CFAE0 DelayExecutor::svc+49 d:\core\src\server\shared\threading\delayexecutor.cpp line 54 000007FEF3D47E4C 00000000124CFB10 ACE_Task_Base::svc_run+3C d:\core\dep\acelite\ace\task.cpp line 273 000007FEF3D484E9 00000000124CFB50 ACE_Thread_Adapter::invoke_i+69 d:\core\dep\acelite\ace\thread_adapter.cpp line 159 000007FEF3D48441 00000000124CFB90 ACE_Thread_Adapter::invoke+71 d:\core\dep\acelite\ace\thread_adapter.cpp line 94 000007FEF42D4F7F 00000000124CFBC0 _beginthreadex+107 000007FEF42D5126 00000000124CFBF0 _endthreadex+192 0000000076D0556D 00000000124CFC20 BaseThreadInitThunk+D 0000000076E6385D 00000000124CFC70 RtlUserThreadStart+1D

chinaryan commented 5 years ago

when I changed thread is one ， crash log ：

Exception code: C0000005 ACCESS_VIOLATION Fault address: 0000000076E3A365 01:0000000000029365 C:\Windows\SYSTEM32\ntdll.dll

Registers: RAX:000000BEDE61D80C RBX:0000000A62323C60 RCX:000000FFFFFFFFFF RDX:0000000000000000 RSI:0000000000000000 RDI:0000000000000000 R8: 0000000000000224 R9: 0000000000000001 R10:000164400B300214 R11:00000000001F0000 R12:0000000000000000 R13:0000000000000000 R14:0000000000000000 R15:0000000000000001 CS:RIP:0033:0000000076E3A365 SS:RSP:002B:000000001090F8C0 RBP:AEC41410 DS:002B ES:002B FS:0053 GS:002B Flags:00010206

Call stack: Address Frame Function SourceFile 0000000076E3A365 000000001090F930 RtlFreeHeap+1A5 0000000076D115AA 000000001090F960 HeapFree+A 000007FEF40869D8 000000001090F990 free+1C 000000013FCFE872 000000001090F9C0 MapUpdateRequest::`scalar deleting destructor'+22 000000013FE8A907 000000001090F9F0 DelayExecutor::svc+57 d:\core\src\server\shared\threading\delayexecutor.cpp line 54 000007FEF1217E4C 000000001090FA20 ACE_Task_Base::svc_run+3C d:\core\dep\acelite\ace\task.cpp line 273 000007FEF12184E9 000000001090FA60 ACE_Thread_Adapter::invoke_i+69 d:\core\dep\acelite\ace\thread_adapter.cpp line 159 000007FEF1218441 000000001090FAA0 ACE_Thread_Adapter::invoke+71 d:\core\dep\acelite\ace\thread_adapter.cpp line 94 000007FEF4044F7F 000000001090FAD0 _beginthreadex+107 000007FEF4045126 000000001090FB00 _endthreadex+192 0000000076D0556D 000000001090FB30 BaseThreadInitThunk+D 0000000076E6385D 000000001090FB80 RtlUserThreadStart+1D

chinaryan commented 5 years ago

https://pastebin.com/jhqj3EKm

ELdoBA commented 5 years ago

You re using Sunwell Core, not AZ

Revision: SunwellCore rev. () (Win64, RelWithDebInfo) Date 27:5:2019. Time 11:2

chinaryan commented 5 years ago

You re using Sunwell Core, not AZ

Revision: SunwellCore rev. () (Win64, RelWithDebInfo) Date 27:5:2019. Time 11:2

no ， I just changed SunwellCore few days after hacker attack me ， but still have the same bug。 so I posted sunwellCore logs 。

FrancescoBorzi commented 5 years ago

@chinaryan please fill AC HASH/COMMIT: so the issue can be reopened

lineagedr commented 5 years ago

@chinaryan Post Spell.cpp on pastebin

chinaryan commented 5 years ago

@chinaryan please fill AC HASH/COMMIT: so the issue can be reopened

ok ，I had updated ‘AC HASH/COMMIT’ and reopened please ， thank you！

chinaryan commented 5 years ago

@chinaryan Post Spell.cpp on pastebin

https://pastebin.com/w8R8hkVa
I had fix this code for my game， so it‘s had some different to git version。

pak3935 commented 5 years ago

Similar crash https://pastebin.com/d8GEt6CK

zqgmzq commented 5 years ago

have the same attack https://github.com/azerothcore/azerothcore-wotlk/issues/2043 On last AC

Kaev commented 5 years ago

If the position you wrote is correct, we might should check if the array is bigger than the index here: https://github.com/azerothcore/azerothcore-wotlk/blob/master/src/server/game/Spells/Spell.cpp#L7974

blackdev01 commented 5 years ago

confirm

blackdev01 commented 5 years ago

try it

spell.cpp :

if (WorldObject* target = m_targets.GetObjectTarget())
    {
        // check if object target is valid with needed target flags
        // for unit case allow corpse target mask because player with not released corpse is a unit target
 if ((target->ToUnit() &&  target->IsInWorld() && !(neededTargets & (TARGET_FLAG_UNIT_MASK | TARGET_FLAG_CORPSE_MASK)))
            || (target->ToGameObject() && !(neededTargets & TARGET_FLAG_GAMEOBJECT_MASK))
            || (target->ToCorpse() && !(neededTargets & TARGET_FLAG_CORPSE_MASK)))
            m_targets.RemoveObjectTarget();
creature.cpp :
void Creature::Update(uint32 diff)
{ 
 + if (!IsInWorld())
 +    return;
    if (IsAIEnabled && TriggerJustRespawned)
    {
        TriggerJustRespawned = false;
        AI()->JustRespawned();
        if (m_vehicleKit)
            m_vehicleKit->Reset();
    }

alihajipoor commented 5 years ago

@blackdev01 Does this code fix the crash ?

blackdev01 commented 5 years ago

@blackdev01 Does this code fix the crash ?

test this patch and notice us the result

wowmane commented 5 years ago

try it

spell.cpp :

if (WorldObject* target = m_targets.GetObjectTarget())
    {
        // check if object target is valid with needed target flags
        // for unit case allow corpse target mask because player with not released corpse is a unit target
 if ((target->ToUnit() &&  target->IsInWorld() && !(neededTargets & (TARGET_FLAG_UNIT_MASK | TARGET_FLAG_CORPSE_MASK)))
            || (target->ToGameObject() && !(neededTargets & TARGET_FLAG_GAMEOBJECT_MASK))
            || (target->ToCorpse() && !(neededTargets & TARGET_FLAG_CORPSE_MASK)))
            m_targets.RemoveObjectTarget();
creature.cpp :
void Creature::Update(uint32 diff)
{ 
 + if (!IsInWorld())
 +    return;
    if (IsAIEnabled && TriggerJustRespawned)
    {
        TriggerJustRespawned = false;
        AI()->JustRespawned();
        if (m_vehicleKit)
            m_vehicleKit->Reset();
    }

@blackdev01

https://github.com/azerothcore/azerothcore-wotlk/blob/master/src/server/game/Spells/Spell.cpp

Not Found cod Lines in AC:

creature.cpp :
void Creature::Update(uint32 diff)
if (IsAIEnabled && TriggerJustRespawned)
{
TriggerJustRespawned = false;
AI()->JustRespawned();
if (m_vehicleKit)
m_vehicleKit->Reset();
}

Your Core Don't AC , and this patch no't work For AC ! ! !

What are you looking for?

I Said, Your Project Core is => Mythcore , and your crash reports is for another project.

I can read well Crash logs....

Your issues: https://github.com/azerothcore/azerothcore-wotlk/issues/2152 https://github.com/azerothcore/azerothcore-wotlk/issues/2170

blackdev01 commented 5 years ago

@wowmane i know what is core ! and i know what i need and what i ask but you just know this(core version) is this mythcore? https://github.com/azerothcore/azerothcore-wotlk/tree/4e40707f5a2da55fb7d2544e5be856e498fe4b76 @chinaryan is using this rev and my update is for this rev . i added at spell.cpp https://github.com/azerothcore/azerothcore-wotlk/blob/d45cd730b213a9121e5dab6d0a8b3ad9bc75c037/src/server/game/Spells/Spell.cpp#L702

target->IsInWorld()

this article is not about my core or my rev. i'm trying to help @chinaryan have a good time .

wowmane commented 5 years ago

@blackdev01 For me it does not matter , I just know that Your core not AC, I Sure!

You are deceiving us.

And not found cod lines on the your rev: AC/tree/4e40707f5a2da55fb7d2544e5be856e498fe4b76

https://github.com/azerothcore/azerothcore-wotlk/blob/4e40707f5a2da55fb7d2544e5be856e498fe4b76/src/game/Spells/Spell.cpp

creature.cpp : void Creature::Update(uint32 diff) if (IsAIEnabled && TriggerJustRespawned) { TriggerJustRespawned = false; AI()->JustRespawned(); if (m_vehicleKit) m_vehicleKit->Reset(); }

Good luck too.

Kitzunu commented 4 years ago

@Helias got any idea?

Helias commented 4 years ago

Sorry, is there a way to reproduce this? May I miss it from this issue...?

If I can reproduce the crash I will try to fix it.

Voxstrasza commented 3 years ago

@chinaryan how can we reproduce this? is it a problem over a year later?

@Helias have you figured out how to reproduce? labeling unconfirmed

Helias commented 3 years ago

I don't know how to reproduce this :(

Helias commented 3 years ago

I think we can close this because the problem is a lot "old" and the core now is different. I tested some async system related to spells for this issue https://github.com/azerothcore/azerothcore-wotlk/issues/2170 that can be related to this one and I didn't find anything.

I think that we can leave open https://github.com/azerothcore/azerothcore-wotlk/issues/2170 but we can close this issue.

azerothcore / azerothcore-wotlk