####################################################################### Luigi Auriemma Application: Ghost Recon engine and some games developed by Redstorm http://www.ghostrecon.com Games/Ver: Ghost Recon <= 1.4 Desert Siege The Sum of all Fears <= 1.1.1.0 Platforms: Windows Bug: remote crash, possible system freeze Exploitation: remote, versus both server and client Date: 24 Feb 2004 Author: Luigi Auriemma e-mail: aluigi@autistici.org web: aluigi.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== Ghost Recon is a military FPS game developed by RedStorm (http://www.redstorm.com) and distribuited by Ubisoft (http://www.ubisoft.com). I has been released in the far 2001 but its engine has been used also for the game "The sum of all fears" in the 2002. Furthermore this game is still supported by its gamers community because there are a lot of MODs created for it. ####################################################################### ====== 2) Bug ====== The bug is located in the management of the text strings. In fact each string is preceded by a 32bit number specifing its size. When the server (or the client) receives the data it calls some functions to manage these 32bit numbers and the data that follows them but the return value of these functions is never checked so we get some exceptions, where the first is at the instruction "mov byte ptr [eax], 00" with EAX equal to 0x00000000. After the crash the system seems unrecoverable and reboot is needed. ####################################################################### =========== 3) The Code =========== http://aluigi.org/poc/grboom.zip ####################################################################### ====== 4) Fix ====== No fix available. I have talked with the developers and the game seems no longer supported. #######################################################################