Fuzzing Modern UDP Game Protocols with Snapshot-Based Fuzzers | Hacker News Reader

Fuzzing Modern UDP Game Protocols with Snapshot-Based Fuzzers

blog.ret2.io

80 pointspanic14 comments

Slightly off-topic and throwaway for legal reasons.

While reverse engineering the network protocol for Genshin Impact, I found at least a couple ways to cause memory access violations. It's really a pity most PC games aren't well sandboxed.

And then you have people claiming that security/safety in game engine code is not important, therefore Rust has no benefits over C++ for games. Nonsense!

Reminds me when Morrowind caused file corruption issues.

Reminds me when EVE Online deleted boot.ini and bricked player computers.

That's not what bricked means. These PCs could be trivially fixed by anyone who can follow simple instructions. A brick means a device is beyond repair. A literal brick that has no function

Yes, I picked a strong word to poke fun at them :)

That being said I've mostly seen the word used in the context of bad firmware updates or ROM flashes. However that's nothing booting into recovery or a JTAG won't fix.

Many games are single player and don't have any network protocol to fuzz.

Even the big games suffer from network-related vulnerabilities. One such example is GTA V. Exploits designed to crash people's games are widely used and accessible to pretty much anyone, and I wouldn't be surprised if one such exploit could have lead to a RCE in the past.

In GTA's case it may be even worse, as the p2p nature of the network may make it wormable.

The unchecked bounds example was just sad - I mean how hard is it to use common sense? Assume the entire packet is always tainted because it comes from an external source!

Any developer will say they do this. But very few, if any, can do this perfectly for every line of code that they write. Humans are terrible at doing things all of the time. Expecting developers to remember to do bounds check is setting yourself up for failure.

You can calloc the array instead of have a fixed size. You can validate the packet for <16.

The person who wrote this consciously thought to themselves "here's 16 slots I can fill, here is an external source that comes in with how many slots it wants to fill." at which point the server-authoritative-model senses should have started tinkling, as well as the experienced-c-programmer-who-has-been-bitten-by-out-of-bounds-memory-accesses-before senses.

This reminds me of a pair of episodes on Darknet Diaries - Manfred[1] - ep. 7/8. Opened my eyes to how insecure games actually are (were?) and how the economy of virtual item trading moved from E-Bay to in-game transactions:

[1]: https://darknetdiaries.com/episode/7/

wtf seems great. It seems Windows soecific, is there something similar for other targets?

Reply on news.ycombinator.com