Hiding the invitation command-line in Steam

News and discussions about new, recent and work-in-progress security vulnerabilities affecting games and game-related software
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Hiding the invitation command-line in Steam

Post by aluigi »

An interesting feature of Steam is that you can invite your friends to join your game and you can also specify the command-line arguments that will be appended to the default ones of the game.

The Steamworks API to use for the invitation is the following:

Code: Select all

   // rich invite support
   // if the target accepts the invite, the pchConnectString gets added to the command-line for launching the game
   // if the game is already running, a GameRichPresenceJoinRequested_t callback is posted containing the connect string
   // invites can only be sent to friends
   virtual bool InviteUserToGame( CSteamID steamIDFriend, const char *pchConnectString ) = 0;

So if we set pchConnectString to "-blah blahblah" then the game of the friend who accepts the invite will run with that additional arguments.

The problem is that the invited user will see the full custom command-line before accepting the invitation and so no fun for us:
Image

Let's try to add some bad chars like those below space (0x20):
Image
Yeah no fun yet.

Steam has an interesting interface option for improving the quality of the font, DirectWrite is switched off by default but many users like to improve everything:
Image

Let's send the same message sent before and watch the result :)
Image

Probably you are thinking that it's not that good but before the 11 July 2014 you didn't see those messy covered chars, the command-line was completely hidden.
The reason is probably explained in this changelog:
http://store.steampowered.com/news/13846/
Fixed Korean text being cut off

Anyway it doesn't mean that we can't have fun doing things like the following:
Image
The command-line has been completely covered.

If you trust your "friend" why don't you accept the invite?
trololo
Posts: 2
Joined: Mon Nov 30, 2015 10:20 pm

Re: Hiding the invitation command-line in Steam

Post by trololo »

how ?
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: Hiding the invitation command-line in Steam

Post by aluigi »

With the Steam API, you have to write a small program to do that.
I have the old code that sends the message to all your friends (GetFriendCount()), but I don't know what's the current status of this "issue".
If needed I can upload both the code and the precompiled exe.
trololo
Posts: 2
Joined: Mon Nov 30, 2015 10:20 pm

Re: Hiding the invitation command-line in Steam

Post by trololo »

yeah, it would be nice, if you can upload both
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: Hiding the invitation command-line in Steam

Post by aluigi »

I guess Valve changed something because the InviteUserToGame API doesn't seem to work now, I mean even sending the "hello" command-line is not accepted, the friend will not receive the invite.

Anyway, just for reference, I have attached the code I used in my old test (over one year ago) that I have simply cleaned.
Totally useless.