Hacking Game.exe file ???

[clydesavannah]

Brief background is that I play a small community fps game and there are two people that continually crash servers. Although I have prevented them from crashing my own servers via ip range blocking I have always been interested in how they crashed servers so effectively. My most recent conclusion was that they were editing the game.exe file. Is it possible to crash a server by doing this? They always seemed to crash the server upon connection so it makes enough sense to me. But then again any replication of their work I tried just resulted in my game not being able to launch. Although I truly had no idea what I was doing when I was first working the HEX editor, I've started to understand it slightly better. Guess I'm wondering if this is a dead end or if it is really posible to manipulate the game.exe file in such a way to crash a server.

Any thoughts on this matter?

[Goatboy]

If any of the software is vulnerable in any way, then yes it is entirely possible. They might also be DDoSing you if they have access to a botnet or something. I'd argue that the former is more likely though. Probably a buffer overflow or a memory leak somewhere. It would have less to do with editing their exe and more to do with sending bad traffic. And for editing a program, doing it in a hex editor is painful. Use a debugger/disassembler instead. It lets you step through the program on a very low level and view/modify all the gory details.

[insomaniacal]

It's much more likely that there is a buffer overflow vulnerability in the server-software, and they're using that to simply send some sort of exit code using it. Although possible, they probably aren't using a customised "game.exe". My best bet is that the game allows a script to be run client-side on connection to a server, and they call the exploit using that, or they connect to your server cleanly and launch an external program that takes advantage of the present vulnerability.

Most game servers run on a specific port, and it's always the same one across servers (by default anyway), so it'd be trivial for them to just write a short program that sends the server a packet that will take advantage of a buffer overflow vulnerability.

[clydesavannah]

Thanks for the replies, they are very insightful. I glad that both of you say, or at least suggest, that HEX editing is not the way to go. I'll continue doing research with the information you two have given me, as it sounds much more promising than my previous ideas. Thanks again