Quake3World.com Forums
     Programming Discussion
        Q3 game exploit


Post new topicReply to topic
Login | Profile | | FAQ | Search | IRC




Print view Previous topic | Next topic 
Topic Starter Topic: Q3 game exploit

Commander
Commander

Joined: 06 Oct 2006
Posts: 148
PostPosted: 03-28-2008 10:51 AM           Profile Send private message  E-mail  Edit post Reply with quote


I had made a post previously on this topic and have sense then made some significant progress. I am trying to patch my q3 1.32c server for the q3msgboom exploit detailed below:

http://aluigi.altervista.org/adv/q3msgboom-adv.txt
http://bani.anime.net/banimod/forums/viewtopic.php?p=27322

I am running a mod on my server that I have the source code to and have compiled a custom copy of it. The problem I am having is that I have applied the patch that is detailed in the bani link posted above. I compiled the source and run the qagamei386.so file on the server and the exploit is still able to be used in game via the 'say' client command. Does anyone know why this fix isn't working with the game code?




Top
                 

Mentor
Mentor

Joined: 12 Mar 2005
Posts: 3958
PostPosted: 03-28-2008 01:00 PM           Profile Send private message  E-mail  Edit post Reply with quote


What is the exact command line you are starting your server with?




Top
                 

Commander
Commander

Joined: 06 Oct 2006
Posts: 148
PostPosted: 03-28-2008 01:42 PM           Profile Send private message  E-mail  Edit post Reply with quote


./q3ded +set net_ip <ip here> +set net_port 27960 +set dedicated 2 +sets gamestartup \"`date +"%D %T"`\" +set ttycon 0 +set com_hunkmegs 56 +set com_zonemegs 16 +set fs_basepath $HOME/quake3 +set fs_homepath $HOME/quake3 +set sv_pure 0 +set fs_game CTF +set vm_game 0 +exec server.cfg




Top
                 

Mentor
Mentor

Joined: 12 Mar 2005
Posts: 3958
PostPosted: 03-29-2008 01:28 AM           Profile Send private message  E-mail  Edit post Reply with quote


Looks alright. I presume you put the qagamei386.so in $HOME/quake3/CTF? Could you post a dump of the console?




Top
                 

Commander
Commander

Joined: 06 Oct 2006
Posts: 148
PostPosted: 03-29-2008 11:25 AM           Profile Send private message  E-mail  Edit post Reply with quote


Yes, it is in $HOME/quake3/CTF.




Q3 1.32c linux-i386 May 8 2006
----- FS_Startup -----
Current search path:
/home/test/quake3/baseq3/q3wpak4.pk3 (562 files)
/home/test/quake3/baseq3/q3wpak3.pk3 (447 files)
/home/test/quake3/baseq3/q3wpak2.pk3 (195 files)
/home/test/quake3/baseq3/q3wpak1.pk3 (396 files)
/home/test/quake3/baseq3/q3wpak0.pk3 (287 files)
/home/test/quake3/baseq3/pak8.pk3 (9 files)
/home/test/quake3/baseq3/pak7.pk3 (4 files)
/home/test/quake3/baseq3/pak6.pk3 (64 files)
/home/test/quake3/baseq3/pak5.pk3 (7 files)
/home/test/quake3/baseq3/pak4.pk3 (272 files)
/home/test/quake3/baseq3/pak3.pk3 (4 files)
/home/test/quake3/baseq3/pak2.pk3 (148 files)
/home/test/quake3/baseq3/pak1.pk3 (26 files)
/home/test/quake3/baseq3/pak0.pk3 (3539 files)
/home/test/quake3/baseq3
./q3ded_test/baseq3

----------------------
5960 files in pk3 files
execing default.cfg
execing q3config.cfg
couldn't exec autoexec.cfg
Hunk_Clear: reset the hunk ok
--- Common Initialization Complete ---
Opening IP socket: ip:27961
Hostname: blah.net
Alias: blah.net
IP: ip
^3PunkBuster Server: pb_sv_SsNext = 127 (0 to 999999)
^3PunkBuster Server: pb_sv_LogNext = 916 (1 to 999999)
^3PunkBuster Server: PB Log File /home/test/quake3/pb/svlogs/00000916.log Opened for Q3A (l)
^3PunkBuster Server: 1 Power Player loaded from /home/test/quake3/pb/pbpower.dat
^3PunkBuster Server: 1 PB Rcon Filter loaded from /home/test/quake3/pb/pbrcon.dat
^3PunkBuster Server: 0 Map lines loaded from /home/test/quake3/pb/pbsvmaps.cfg
^3PunkBuster Server: Attempting to resolve master5.evenbalance.com
^3PunkBuster Server: Resolved to [66.36.231.175]
^3PunkBuster Server: PunkBuster Server (v1.641 | A1353 C2.041) Enabled
execing server.cfg
Cvar_Set2: fs_debug 1
Cvar_Set2: g_logsync 3
Cvar_Set2: logfile 0
Cvar_Set2: rconpassword pw
Cvar_Set2: sv_master1 monster.idsoftware.com
Cvar_Set2: sv_master2 master0.gamespy.com:27900
Cvar_Set2: g_gametype 4
g_gametype will be changed upon restarting.
Cvar_Set2: timelimit 20
Cvar_Set2: capturelimit 10
Cvar_Set2: dmflags 0
Cvar_Set2: g_quadfactor 4
Cvar_Set2: g_weaponRespawn 1
Cvar_Set2: g_weaponTeamRespawn 1
Cvar_Set2: g_inactivity 100
Cvar_Set2: g_forcerespawn 0
Cvar_Set2: g_obeliskRespawnDelay 10
Cvar_Set2: g_obeliskHealth 2500
Cvar_Set2: g_obeliskRegenPeriod 1
Cvar_Set2: g_obeliskRegenAmount 15
Cvar_Set2: g_cubeTimeout 30
Cvar_Set2: g_proxMineTimeout 20000
Cvar_Set2: g_teamforcebalance 1
Cvar_Set2: g_teamautojoin 1
Cvar_Set2: g_friendlyFire 0
Cvar_Set2: g_dowarmup 1
Cvar_Set2: g_warmup 40
Cvar_Set2: sv_maxclients 12
Cvar_Set2: sv_privateClients 2
Cvar_Set2: sv_privatePassword pw
Cvar_Set2: sv_fps 30
Cvar_Set2: disable_holdable_teleporter 0
Cvar_Set2: disable_holdable_medkit 0
Cvar_Set2: disable_item_quad 0
Cvar_Set2: disable_item_enviro 0
Cvar_Set2: disable_item_haste 0
Cvar_Set2: disable_item_invis 0
Cvar_Set2: disable_item_regen 0
Cvar_Set2: disable_item_flight 0
Cvar_Set2: disable_weapon_gauntlet 0
Cvar_Set2: disable_weapon_shotgun 0
Cvar_Set2: disable_weapon_machinegun 0
Cvar_Set2: disable_weapon_grenadelauncher 0
Cvar_Set2: disable_weapon_rocketlauncher 0
Cvar_Set2: disable_weapon_lightning 0
Cvar_Set2: disable_weapon_railgun 0
Cvar_Set2: disable_weapon_plasmagun 0
Cvar_Set2: disable_weapon_bfg 1
Cvar_Set2: disable_weapon_grapplinghook 0
Cvar_Set2: disable_ammo_shells 0
Cvar_Set2: disable_ammo_bullets 0
Cvar_Set2: disable_ammo_grenades 0
Cvar_Set2: disable_ammo_cells 0
Cvar_Set2: disable_ammo_lightning 0
Cvar_Set2: disable_ammo_rockets 0
Cvar_Set2: disable_ammo_bfg 1
Cvar_Set2: disable_item_armor_shard 0
Cvar_Set2: disable_item_armor_combat 0
Cvar_Set2: disable_item_armor_body 0
Cvar_Set2: disable_item_health_small 0
Cvar_Set2: disable_item_health 0
Cvar_Set2: disable_item_health_large 0
Cvar_Set2: disable_item_health_mega 0
Cvar_Set2: sv_punkbuster 1
Cvar_Set2: sv_strictAuth 0
Cvar_Set2: restart exec quit.cfg
FS_FOpenFileRead: q3as.cfg (found in '/home/test/quake3/baseq3')
execing q3as.cfg
Cvar_Set2: as_headhunter 0
Cvar_Set2: as_mode_number 0
Cvar_Set2: as_preserve_gamename 1
Cvar_Set2: as_maprotation_vote_preserve 1
Cvar_Set2: as_debug_file debug.log
Cvar_Set2: as_referee_password gatorade101
Cvar_Set2: as_ra_addbot 1
Cvar_Set2: as_ra_as_addip 1
Cvar_Set2: as_ra_kick 1
Cvar_Set2: as_ra_clientkick 1
Cvar_Set2: as_ra_as_status 1
Cvar_Set2: as_motd_1
Cvar_Set2: as_motd_2
Cvar_Set2: as_motd_3
Cvar_Set2: as_motd_4
Cvar_Set2: as_motd_5
Cvar_Set2: as_motd_spectator_duration 20
Cvar_Set2: as_motd_firstspawn_duration 5
Cvar_Set2: as_motd_at_firstspawn 1
Cvar_Set2: as_debug_console 0
Cvar_Set2: as_maprotation_type 0
Cvar_Set2: as_maprotation_autoload 0
Cvar_Set2: as_maprotation_spacing 40
Cvar_Set2: as_maprotation_gametype_mask 1
Cvar_Set2: as_maprotation_file rotation.cfg
Cvar_Set2: as_maprotation_state_file blah.cfg
Cvar_Set2: as_report_to_master 0
Cvar_Set2: as_kick_spectator_bots 0
Cvar_Set2: as_max_spectator_time 0
Cvar_Set2: as_vote_mask 23
Cvar_Set2: as_vote_gametype_mask 0
Cvar_Set2: as_vote_mintimelimit 10
Cvar_Set2: as_vote_maxtimelimit 30
Cvar_Set2: as_vote_minfraglimit 10
Cvar_Set2: as_vote_maxfraglimit 30
Cvar_Set2: as_vote_connected_percent 50
Cvar_Set2: as_vote_maxcall 1
Cvar_Set2: as_vote_mode_mask 79
Cvar_Set2: as_ban_file ban.txt
Cvar_Set2: as_spam_interval 60000
Cvar_Set2: as_spam_warn 0
Cvar_Set2: as_spam_kick 0
Cvar_Set2: as_unbalanced_warning 2
Cvar_Set2: as_log_osp 1
Cvar_Set2: as_team_balance 3
Cvar_Set2: as_fok_AllowFixTeams 1
FS_FOpenFileRead: maps/q3ctf1.bsp (found in '/home/test/quake3/baseq3/pak0.pk3')
Cvar_Set2: g_gametype 4
------ Server Initialization ------
Server: q3ctf1
Hunk_Clear: reset the hunk ok
Cvar_Set2: sv_running 1
Cvar_Set2: nextmap map_restart 0
Cvar_Set2: cl_paused 0
----- FS_Startup -----
FS_SV_FOpenFileRead (fs_homepath): /home/test/quake3/baseq3/q3key
FS_SV_FOpenFileRead (fs_cdpath) : ./q3ded_test/baseq3/q3key
FS_SV_FOpenFileRead (fs_homepath): /home/test/quake3/baseq3/q3key
FS_SV_FOpenFileRead (fs_cdpath) : ./q3ded_test/baseq3/q3key
Current search path:
/home/test/quake3/baseq3/q3wpak4.pk3 (562 files)
/home/test/quake3/baseq3/q3wpak3.pk3 (447 files)
/home/test/quake3/baseq3/q3wpak2.pk3 (195 files)
/home/test/quake3/baseq3/q3wpak1.pk3 (396 files)
/home/test/quake3/baseq3/q3wpak0.pk3 (287 files)
/home/test/quake3/baseq3/pak8.pk3 (9 files)
/home/test/quake3/baseq3/pak7.pk3 (4 files)
/home/test/quake3/baseq3/pak6.pk3 (64 files)
/home/test/quake3/baseq3/pak5.pk3 (7 files)
/home/test/quake3/baseq3/pak4.pk3 (272 files)
/home/test/quake3/baseq3/pak3.pk3 (4 files)
/home/test/quake3/baseq3/pak2.pk3 (148 files)
/home/test/quake3/baseq3/pak1.pk3 (26 files)
/home/test/quake3/baseq3/pak0.pk3 (3539 files)
/home/test/quake3/baseq3
./q3ded_test/baseq3

----------------------
11920 files in pk3 files
FS_FOpenFileRead: productid.txt (found in '/home/test/quake3/baseq3/pak0.pk3')
FS_FOpenFileRead: default.cfg (found in '/home/test/quake3/baseq3/pak0.pk3')
CM_LoadMap( maps/q3ctf1.bsp, 0 )
FS_FOpenFileRead: maps/q3ctf1.bsp (found in '/home/test/quake3/baseq3/pak0.pk3')
Cvar_Set2: mapname q3ctf1
Cvar_Set2: sv_mapChecksum -744491580
Cvar_Set2: sv_serverid 737
Loading dll file qagame.
Sys_LoadDll(/home/test/quake3/baseq3/qagamei386.so)...
Sys_LoadDll(/home/test/quake3/baseq3/qagamei386.so): succeeded ...
Sys_LoadDll(qagame) found **vmMain** at 0xb2f08ee0
Sys_LoadDll(qagame) succeeded!
------- Game Initialization -------
gamename: baseq3
gamedate: Mar 19 2008
Warning: cvar "dedicated" given initial values: "1" and "0"
Cvar_Set2: as_log_mask 2147483647
Cvar_Set2: g_banIPs 64.81.116.0
Cvar_Set2: g_banIPs 64.81.116.0 97.82.213.161
Cvar_Set2: g_banIPs 64.81.116.0 97.82.213.161 76.99.181.154
FS_FOpenFileAppend: /home/test/quake3/baseq3/debug.log
FS_FOpenFileRead: rotation.cfg (found in '/home/test/quake3/baseq3')
2 template(s) loaded from 'rotation.cfg'
5 maps(s) loaded from 'rotation.cfg'
5 maps loaded
FS_FOpenFileWrite: /home/test/quake3/baseq3/blah.cfg
Cvar_Set2: as_scheduledMap q3ctf1
FS_FOpenFileAppend: /home/test/quake3/baseq3/games.log
------------------------------------------------------------
InitGame: \sv_maxclients\12\g_maxGameClients\0\capturelimit\10\sv_floodProtect\0\sv_maxPing\300\sv_minPing\0\sv_maxRate\25000\sv_hostname\TEST BOX\timelimit\20\fraglimit\30\dmflags\0\sv_punkbuster\1\version\Q3 1.32c linux-i386 May 8 2006\g_gametype\4\protocol\68\mapname\q3ctf1\sv_privateClients\2\sv_fps\30\sv_allowDownload\0\g_needpass\0\as_headhunter\0\gamename\baseq3\as_version\1.99q
Gametype changed, clearing session data.
FS_FOpenFileRead: modes_2-1.dat (found in '/home/test/quake3/baseq3')
Loading modes from modes_2-1.dat (revision 1)
FS_FOpenFileRead: modes_2-1.dat (found in '/home/test/quake3/baseq3')
Setting mode to: 0
Mode 'Default' initialized.
Cvar_Set2: g_gravity 800
Cvar_Set2: g_enableDust 0
Cvar_Set2: g_enableBreath 0
Warmup:
Can't find spawnvars/q3ctf1.sv
2 teams with 4 entities
15 items registered
-----------------------------------
Opened log botlib.log
------- BotLib Initialization -------
FS_FOpenFileRead: botfiles/weapons.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/inv.h (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded weapons.c
FS_FOpenFileRead: botfiles/items.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/inv.h (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded items.c
FS_FOpenFileRead: botfiles/syn.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/syn.h (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/syn.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/syn.h (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded syn.c
FS_FOpenFileRead: botfiles/rnd.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/rnd.c (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded rnd.c
FS_FOpenFileRead: botfiles/match.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/match.h (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded match.c
FS_FOpenFileRead: botfiles/rchat.c (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded rchat.c
------------ Map Loading ------------
trying to load maps/q3ctf1.aas
FS_FOpenFileRead: maps/q3ctf1.aas (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded maps/q3ctf1.aas
found 43 level items
-------------------------------------
FS_FOpenFileRead: scripts/bots.txt (found in '/home/test/quake3/baseq3/pak0.pk3')
32 bots parsed
FS_FOpenFileRead: scripts/arenas.txt (found in '/home/test/quake3/baseq3/pak0.pk3')
FS_FOpenFileRead: scripts/q3wpak4.arena (found in '/home/test/quake3/baseq3/q3wpak4.pk3')
FS_FOpenFileRead: scripts/bastir.arena (found in '/home/test/quake3/baseq3/q3wpak4.pk3')
FS_FOpenFileRead: scripts/q3w1.arena (found in '/home/test/quake3/baseq3/q3wpak3.pk3')
FS_FOpenFileRead: scripts/q3w2.arena (found in '/home/test/quake3/baseq3/q3wpak3.pk3')
FS_FOpenFileRead: scripts/q3w3.arena (found in '/home/test/quake3/baseq3/q3wpak3.pk3')
FS_FOpenFileRead: scripts/q3w4.arena (found in '/home/test/quake3/baseq3/q3wpak3.pk3')
FS_FOpenFileRead: scripts/q3w5.arena (found in '/home/test/quake3/baseq3/q3wpak3.pk3')
FS_FOpenFileRead: scripts/q3w6.arena (found in '/home/test/quake3/baseq3/q3wpak3.pk3')
FS_FOpenFileRead: scripts/q3w7.arena (found in '/home/test/quake3/baseq3/q3wpak3.pk3')
FS_FOpenFileRead: scripts/q3w8.arena (found in '/home/test/quake3/baseq3/q3wpak3.pk3')
FS_FOpenFileRead: scripts/q3wxs3.arena (found in '/home/test/quake3/baseq3/q3wpak3.pk3')
FS_FOpenFileRead: scripts/q3wc.arena (found in '/home/test/quake3/baseq3/q3wpak2.pk3')
FS_FOpenFileRead: scripts/q3wcp10.arena (found in '/home/test/quake3/baseq3/q3wpak1.pk3')
FS_FOpenFileRead: scripts/q3wcp11.arena (found in '/home/test/quake3/baseq3/q3wpak1.pk3')
FS_FOpenFileRead: scripts/q3wcp12.arena (found in '/home/test/quake3/baseq3/q3wpak1.pk3')
FS_FOpenFileRead: scripts/q3wcp13.arena (found in '/home/test/quake3/baseq3/q3wpak1.pk3')
FS_FOpenFileRead: scripts/q3wcp14.arena (found in '/home/test/quake3/baseq3/q3wpak1.pk3')
FS_FOpenFileRead: scripts/q3wcp15.arena (found in '/home/test/quake3/baseq3/q3wpak1.pk3')
FS_FOpenFileRead: scripts/q3wcp16.arena (found in '/home/test/quake3/baseq3/q3wpak1.pk3')
FS_FOpenFileRead: scripts/q3wcp9.arena (found in '/home/test/quake3/baseq3/q3wpak1.pk3')
FS_FOpenFileRead: scripts/q3wxs2.arena (found in '/home/test/quake3/baseq3/q3wpak1.pk3')
FS_FOpenFileRead: scripts/q3wpak0.arena (found in '/home/test/quake3/baseq3/q3wpak0.pk3')
FS_FOpenFileRead: scripts/promaps.arena (found in '/home/test/quake3/baseq3/pak6.pk3')
FS_FOpenFileRead: scripts/q3tourney6_ctf.arena (found in '/home/test/quake3/baseq3/pak2.pk3')
78 arenas parsed
Cvar_Set2: gamestartup 03/29/2008 15:26:36.00
Server initialized and ready.
Cvar_Set2: as_log_mask 2147483647
Cvar_Set2: g_needpass 0
Q3AS: TICK: 03/29/2008 15:26:36
TICK: 03/29/2008 15:26:36
Cvar_Set2: as_scheduledMap
Can't find maps/q3ctf1.rcd
AAS initialized.
Cvar_Set2: sv_paks
Cvar_Set2: sv_pakNames
Cvar_Set2: sv_referencedPaks 1197932710 1566731103
Cvar_Set2: sv_referencedPakNames baseq3/pak4 baseq3/pak0
-----------------------------------
Cvar_Set2: sv_punkbuster 1
Cvar_Set2: sv_cheats 0
Player allbots is not on the server
Cvar_Set2: sv_master5
FS_FOpenFileRead: maps/q3ctf1.bsp (found in '/home/test/quake3/baseq3/pak0.pk3')
==== ShutdownGame ====
Server shutting down.
ShutdownGame:
------------------------------------------------------------
Cvar_Set2: session 4
AAS shutdown.
Closed log botlib.log
------ Server Initialization ------
Server: q3ctf1
Hunk_Clear: reset the hunk ok
Cvar_Set2: nextmap map_restart 0
Cvar_Set2: cl_paused 0
----- FS_Startup -----
FS_SV_FOpenFileRead (fs_homepath): /home/test/quake3/baseq3/q3key
FS_SV_FOpenFileRead (fs_cdpath) : ./q3ded_test/baseq3/q3key
FS_SV_FOpenFileRead (fs_homepath): /home/test/quake3/baseq3/q3key
FS_SV_FOpenFileRead (fs_cdpath) : ./q3ded_test/baseq3/q3key
Current search path:
/home/test/quake3/baseq3/q3wpak4.pk3 (562 files)
/home/test/quake3/baseq3/q3wpak3.pk3 (447 files)
/home/test/quake3/baseq3/q3wpak2.pk3 (195 files)
/home/test/quake3/baseq3/q3wpak1.pk3 (396 files)
/home/test/quake3/baseq3/q3wpak0.pk3 (287 files)
/home/test/quake3/baseq3/pak8.pk3 (9 files)
/home/test/quake3/baseq3/pak7.pk3 (4 files)
/home/test/quake3/baseq3/pak6.pk3 (64 files)
/home/test/quake3/baseq3/pak5.pk3 (7 files)
/home/test/quake3/baseq3/pak4.pk3 (272 files)
/home/test/quake3/baseq3/pak3.pk3 (4 files)
/home/test/quake3/baseq3/pak2.pk3 (148 files)
/home/test/quake3/baseq3/pak1.pk3 (26 files)
/home/test/quake3/baseq3/pak0.pk3 (3539 files)
/home/test/quake3/baseq3
./q3ded_test/baseq3

----------------------
17880 files in pk3 files
FS_FOpenFileRead: productid.txt (found in '/home/test/quake3/baseq3/pak0.pk3')
FS_FOpenFileRead: default.cfg (found in '/home/test/quake3/baseq3/pak0.pk3')
CM_LoadMap( maps/q3ctf1.bsp, 0 )
FS_FOpenFileRead: maps/q3ctf1.bsp (found in '/home/test/quake3/baseq3/pak0.pk3')
Cvar_Set2: mapname q3ctf1
Cvar_Set2: sv_mapChecksum -744491580
Cvar_Set2: sv_serverid 737
Loading dll file qagame.
Sys_LoadDll(/home/test/quake3/baseq3/qagamei386.so)...
Sys_LoadDll(/home/test/quake3/baseq3/qagamei386.so): succeeded ...
Sys_LoadDll(qagame) found **vmMain** at 0xb2f08ee0
Sys_LoadDll(qagame) succeeded!
------- Game Initialization -------
gamename: baseq3
gamedate: Mar 19 2008
Warning: cvar "dedicated" given initial values: "1" and "0"
Cvar_Set2: g_banIPs 64.81.116.0
Cvar_Set2: g_banIPs 64.81.116.0 97.82.213.161
Cvar_Set2: g_banIPs 64.81.116.0 97.82.213.161 76.99.181.154
FS_FOpenFileAppend: /home/test/quake3/baseq3/debug.log
FS_FOpenFileRead: blah.cfg (found in '/home/test/quake3/baseq3')
FS_FOpenFileAppend: /home/test/quake3/baseq3/games.log
------------------------------------------------------------
InitGame: \sv_maxclients\12\g_maxGameClients\0\capturelimit\10\sv_floodProtect\0\sv_maxPing\300\sv_minPing\0\sv_maxRate\25000\sv_hostname\TEST BOX\timelimit\20\fraglimit\30\dmflags\0\sv_punkbuster\1\version\Q3 1.32c linux-i386 May 8 2006\g_gametype\4\protocol\68\mapname\q3ctf1\sv_privateClients\2\sv_fps\30\sv_allowDownload\0\bot_minplayers\2\g_needpass\0\as_headhunter\0\gamename\baseq3\as_version\1.99q
FS_FOpenFileRead: modes_2-1.dat (found in '/home/test/quake3/baseq3')
Loading modes from modes_2-1.dat (revision 1)
FS_FOpenFileRead: modes_2-1.dat (found in '/home/test/quake3/baseq3')
Setting mode to: 0
Mode 'Default' initialized.
Cvar_Set2: g_gravity 800
Cvar_Set2: g_enableDust 0
Cvar_Set2: g_enableBreath 0
Warmup:
Can't find spawnvars/q3ctf1.sv
2 teams with 4 entities
15 items registered
-----------------------------------
Opened log botlib.log
------- BotLib Initialization -------
FS_FOpenFileRead: botfiles/weapons.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/inv.h (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded weapons.c
FS_FOpenFileRead: botfiles/items.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/inv.h (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded items.c
FS_FOpenFileRead: botfiles/syn.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/syn.h (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/syn.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/syn.h (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded syn.c
FS_FOpenFileRead: botfiles/rnd.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/rnd.c (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded rnd.c
FS_FOpenFileRead: botfiles/match.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/match.h (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded match.c
FS_FOpenFileRead: botfiles/rchat.c (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded rchat.c
------------ Map Loading ------------
trying to load maps/q3ctf1.aas
FS_FOpenFileRead: maps/q3ctf1.aas (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded maps/q3ctf1.aas
found 43 level items
-------------------------------------
FS_FOpenFileRead: scripts/bots.txt (found in '/home/test/quake3/baseq3/pak0.pk3')
32 bots parsed
FS_FOpenFileRead: scripts/arenas.txt (found in '/home/test/quake3/baseq3/pak0.pk3')
FS_FOpenFileRead: scripts/q3wpak4.arena (found in '/home/test/quake3/baseq3/q3wpak4.pk3')
FS_FOpenFileRead: scripts/bastir.arena (found in '/home/test/quake3/baseq3/q3wpak4.pk3')
FS_FOpenFileRead: scripts/q3w1.arena (found in '/home/test/quake3/baseq3/q3wpak3.pk3')
FS_FOpenFileRead: scripts/q3w2.arena (found in '/home/test/quake3/baseq3/q3wpak3.pk3')
FS_FOpenFileRead: scripts/q3w3.arena (found in '/home/test/quake3/baseq3/q3wpak3.pk3')
FS_FOpenFileRead: scripts/q3w4.arena (found in '/home/test/quake3/baseq3/q3wpak3.pk3')
FS_FOpenFileRead: scripts/q3w5.arena (found in '/home/test/quake3/baseq3/q3wpak3.pk3')
FS_FOpenFileRead: scripts/q3w6.arena (found in '/home/test/quake3/baseq3/q3wpak3.pk3')
FS_FOpenFileRead: scripts/q3w7.arena (found in '/home/test/quake3/baseq3/q3wpak3.pk3')
FS_FOpenFileRead: scripts/q3w8.arena (found in '/home/test/quake3/baseq3/q3wpak3.pk3')
FS_FOpenFileRead: scripts/q3wxs3.arena (found in '/home/test/quake3/baseq3/q3wpak3.pk3')
FS_FOpenFileRead: scripts/q3wc.arena (found in '/home/test/quake3/baseq3/q3wpak2.pk3')
FS_FOpenFileRead: scripts/q3wcp10.arena (found in '/home/test/quake3/baseq3/q3wpak1.pk3')
FS_FOpenFileRead: scripts/q3wcp11.arena (found in '/home/test/quake3/baseq3/q3wpak1.pk3')
FS_FOpenFileRead: scripts/q3wcp12.arena (found in '/home/test/quake3/baseq3/q3wpak1.pk3')
FS_FOpenFileRead: scripts/q3wcp13.arena (found in '/home/test/quake3/baseq3/q3wpak1.pk3')
FS_FOpenFileRead: scripts/q3wcp14.arena (found in '/home/test/quake3/baseq3/q3wpak1.pk3')
FS_FOpenFileRead: scripts/q3wcp15.arena (found in '/home/test/quake3/baseq3/q3wpak1.pk3')
FS_FOpenFileRead: scripts/q3wcp16.arena (found in '/home/test/quake3/baseq3/q3wpak1.pk3')
FS_FOpenFileRead: scripts/q3wcp9.arena (found in '/home/test/quake3/baseq3/q3wpak1.pk3')
FS_FOpenFileRead: scripts/q3wxs2.arena (found in '/home/test/quake3/baseq3/q3wpak1.pk3')
FS_FOpenFileRead: scripts/q3wpak0.arena (found in '/home/test/quake3/baseq3/q3wpak0.pk3')
FS_FOpenFileRead: scripts/promaps.arena (found in '/home/test/quake3/baseq3/pak6.pk3')
FS_FOpenFileRead: scripts/q3tourney6_ctf.arena (found in '/home/test/quake3/baseq3/pak2.pk3')
78 arenas parsed
Server initialized and ready.
Cvar_Set2: g_needpass 0
Can't find maps/q3ctf1.rcd
AAS initialized.
Cvar_Set2: sv_paks
Cvar_Set2: sv_pakNames
Cvar_Set2: sv_referencedPaks 1197932710 1566731103
Cvar_Set2: sv_referencedPakNames baseq3/pak4 baseq3/pak0
-----------------------------------
Cvar_Set2: sv_punkbuster 1
Cvar_Set2: sv_cheats 0
Player allbots is not on the server
Cvar_Set2: sv_master5
Hitch warning: 737 msec frame time
Resolving monster.idsoftware.com
monster.idsoftware.com resolved to 192.246.40.56:27950
Sending heartbeat to monster.idsoftware.com
Resolving master0.gamespy.com:27900
master0.gamespy.com:27900 resolved to 207.38.11.34:27950
Sending heartbeat to master0.gamespy.com:27900
Cvar_Set2: sv_punkbuster 1
^3PunkBuster Server: PunkBuster Server (v1.641 | A1353 C2.041) Enabled
^3PunkBuster Server: pb_sv_AutoUpdBan = 1 (0 to 1)
^3PunkBuster Server: pb_sv_NoGuidGrace = 1 (0 to 300)
^3PunkBuster Server: pb_sv_GuidRelax = 7 (0 to 7)
^3PunkBuster Server: pb_sv_Sleep = 100 (20 to 100)
^3PunkBuster Server: pb_sv_maxsendrate = 8 (1 to 64)
^3PunkBuster Server: pb_sv_DupNameGrace = 90 (0 to 90)
^3PunkBuster Server: pb_sv_ExtChar = 1 (0 to 1)
^3PunkBuster Server: pb_sv_MinName = 1 (0 to 4)
^3PunkBuster Server: pb_sv_EmptyName = 0 (0 to 1)
^3PunkBuster Server: NameLock list (in Memory) has been Emptied
^3PunkBuster Server: pb_sv_AutoSs = 1 (0=No, 1=Yes)
^3PunkBuster Server: pb_sv_AutoSsFrom = 300 (30 to 300)
^3PunkBuster Server: pb_sv_AutoSsTo = 1500 (300 to 1500)
^3PunkBuster Server: pb_sv_SsCeiling = 300 (1 to 999999)
^3PunkBuster Server: pb_sv_KickLen = 1 (0 to 60)
^3PunkBuster Server: pb_sv_PowerKickLen = 20 (0 to 60)
^3PunkBuster Server: pb_sv_PowerDef = 4 (0 to 10)
^3PunkBuster Server: pb_sv_PowerMin = 24 (1 to 1000)
^3PunkBuster Server: Cvar List (in Memory) has been Emptied
^3PunkBuster Server: pb_sv_CvarLogging = 0 (0 to 3)
^3PunkBuster Server: pb_sv_CvarFreq = 2 (2 to 10)
^3PunkBuster Server: pb_sv_CvarUserPulse = 99 (10 to 99)
^3PunkBuster Server: pb_sv_CvarChangedPulse = 99 (10 to 99)
^3PunkBuster Server: pb_sv_CvarWalk = 0 (0 to 4)
^3PunkBuster Server: Cvar Check Added: snaps IN 20 60
^3PunkBuster Server: Cvar Check Added: rate IN 2500 25000
^3PunkBuster Server: Cvar Check Added: cl_maxpackets IN 30 125
^3PunkBuster Server: Cvar Check Added: cl_timenudge IN -50 0
^3PunkBuster Server: Cvar Check Added: cg_bobup IN 0 0.005
^3PunkBuster Server: Cvar Check Added: com_maxfps OUT 1 30
^3PunkBuster Server: Cvar Check Added: com_maxfps IN 1 125
^3PunkBuster Server: Cvar Check Added: sv_padpackets IN 0 0
^3PunkBuster Server: Cvar Check Added: cg_shadows IN 0 1
^3PunkBuster Server: Cvar Check Added: r_znear IN 4 4
^3PunkBuster Server: Cvar Check Added: r_shownormals IN 0 0
^3PunkBuster Server: Cvar Check Added: r_nocurves IN 0 0
^3PunkBuster Server: Cvar Check Added: cm_oncurves IN 0 0
^3PunkBuster Server: Cvar Check Added: cm_noAreas IN 0 0
^3PunkBuster Server: Cvar Check Added: r_drawworld IN 1 1
^3PunkBuster Server: Cvar Check Added: cl_packetdup IN 0 3
^3PunkBuster Server: Cvar Check Added: r_singlesheader IN 0 0
^3PunkBuster Server: Cvar Check Added: guid IN 0 0
^3PunkBuster Server: Cvar Check Added: alias IN 0 0
^3PunkBuster Server: Cvar Check Added: ace_aaim IN 0 0
^3PunkBuster Server: Cvar Check Added: ace_active IN 0 0
^3PunkBuster Server: Cvar Check Added: activate IN 0 0
^3PunkBuster Server: Cvar Check Added: activate_off IN 0 0
^3PunkBuster Server: Cvar Check Added: activate_on IN 0 0
^3PunkBuster Server: Cvar Check Added: aim IN 0 0
^3PunkBuster Server: Cvar Check Added: rbx_aaim IN 0 0
^3PunkBuster Server: Cvar Check Added: rbx_activate IN 0 0
^3PunkBuster Server: Cvar Check Added: 66_wall IN 0 0
^3PunkBuster Server: Cvar Check Added: 66_shoot IN 0 0
^3PunkBuster Server: Cvar Check Added: gup_pingpredict IN 0 0
^3PunkBuster Server: Cvar Check Added: gup_mode IN 0 0
^3PunkBuster Server: Cvar Check Added: gup_wall IN 0 0
^3PunkBuster Server: Cvar Check Added: pc_shoot IN 0 0
^3PunkBuster Server: Cvar Check Added: pc_aim IN 0 0
^3PunkBuster Server: Cvar Check Added: tab_pingpredict IN 0 0
^3PunkBuster Server: Cvar Check Added: tab_fov IN 0 0
^3PunkBuster Server: Cvar Check Added: darkhex_wall IN 0 0
^3PunkBuster Server: Cvar Check Added: darkhex_glow IN 0 0
^3PunkBuster Server: Cvar Check Added: darkhex_shoot IN 0 0
^3PunkBuster Server: Cvar Check Added: darkhex_pingpredict IN 0 0
^3PunkBuster Server: Cvar Check Added: rasin_wall IN 0 0
^3PunkBuster Server: Cvar Check Added: rasin_glow IN 0 0
^3PunkBuster Server: Cvar Check Added: rasin_shoot IN 0 0
^3PunkBuster Server: Cvar Check Added: rasin_pingpredict IN 0 0
^3PunkBuster Server: Cvar Check Added: s66AS_on IN 0 0
^3PunkBuster Server: Cvar Check Added: s66AS_wait IN 0 0
^3PunkBuster Server: pb_sv_ScoreKick = 0 (-20 to 0)
^3PunkBuster Server: pb_sv_HttpPort = 1081 (0 to 65535)
^3PunkBuster Server: pb_sv_HttpAddr = 75.126.212.236
^3PunkBuster Server: pb_sv_HttpKey = *****
^3PunkBuster Server: Rcon Record Added for vstr restart
^3PunkBuster Server: pb_sv_ChangePeriod = 900 (1 to 999)
^3PunkBuster Server: pb_sv_ChangeMax = 15 (1 to 50)
^3PunkBuster Server: Added Bad Name: "JESUS" Grace=60
FS_FOpenFileWrite: /home/test/quake3/baseq3/q3config.cfg
SV packet 192.246.40.56:49166 : getchallenge
Resolving authorize.quake3arena.com
authorize.quake3arena.com resolved to 192.246.40.56:27952
sending getIpAuthorize for 192.246.40.56:49166
SV packet 192.246.40.56:49166 : getinfo
Hitch warning: 1506 msec frame time
SV packet 192.246.40.56:27952 : ipAuthorize
^3PunkBuster Server: Game Version [Q3 1.32c linux-i386 May 8 2006]
^3PunkBuster Server: Not Listening for HTTP
SV packet 84.201.223.184:27960 : getinfo
SV packet 82.160.51.41:27960 : getinfo
SV packet 83.29.126.8:27960 : getinfo
SV packet 87.110.168.98:27960 : getinfo
SV packet 87.123.35.59:27961 : getinfo
SV packet 70.124.58.174:34548 : getinfo
SV packet 86.206.233.5:27960 : getinfo
Can't find ban.txt
Cvar_Set2: session0 2 10040 1 0 0 0 0 0 0 0.0
FS_FOpenFileRead: botfiles/bots/default_c.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/chars.h (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded skill 1 from bots/default_c.c
FS_FOpenFileRead: botfiles/bots/sarge_c.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/chars.h (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded skill 1 from bots/sarge_c.c
FS_FOpenFileRead: botfiles/bots/default_c.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/chars.h (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded skill 4 from bots/default_c.c
FS_FOpenFileRead: botfiles/bots/sarge_c.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/chars.h (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded skill 4 from bots/sarge_c.c
FS_FOpenFileRead: botfiles/bots/sarge_i.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/inv.h (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/fw_items.c (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded bots/sarge_i.c
FS_FOpenFileRead: botfiles/bots/sarge_w.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/inv.h (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/fw_weap.c (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded bots/sarge_w.c
FS_FOpenFileRead: botfiles/bots/sarge_t.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/teamplay.h (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/bots/sarge_t.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/teamplay.h (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded sarge from bots/sarge_t.c
ClientConnect: 0
ClientUserinfoChanged: 0 n\Sarge\t\2\model\sarge\hmodel\sarge\c1\4\c2\5\hc\90\w\0\l\0\skill\ 3.00\tt\0\tl\0
Client number 0 (name = 'Sarge') connecting from (BOT)
broadcast: print "Sarge^7 connected\n"
broadcast: print "Sarge^7 entered the game\n"
ClientBegin: 0
Can't find ban.txt
Cvar_Set2: session1 1 10040 1 0 0 0 0 0 0 0.0
loaded cached skill 1.000000 from bots/default_c.c
FS_FOpenFileRead: botfiles/bots/orbb_c.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/chars.h (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded skill 1 from bots/orbb_c.c
loaded cached skill 4.000000 from bots/default_c.c
FS_FOpenFileRead: botfiles/bots/orbb_c.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/chars.h (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded skill 4 from bots/orbb_c.c
FS_FOpenFileRead: botfiles/bots/orbb_i.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/inv.h (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/fw_items.c (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded bots/orbb_i.c
FS_FOpenFileRead: botfiles/bots/orbb_w.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/inv.h (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/fw_weap.c (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded bots/orbb_w.c
FS_FOpenFileRead: botfiles/bots/orbb_t.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/teamplay.h (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/bots/orbb_t.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/teamplay.h (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded orbb from bots/orbb_t.c
ClientConnect: 1
ClientUserinfoChanged: 1 n\Orbb\t\1\model\orbb\hmodel\orbb\c1\4\c2\5\hc\90\w\0\l\0\skill\ 3.00\tt\0\tl\0
Client number 1 (name = 'Orbb') connecting from (BOT)
broadcast: print "Orbb^7 connected\n"
broadcast: print "Orbb^7 entered the game\n"
ClientBegin: 1
SV packet 192.246.40.56:49166 : getstatus
SV packet 93.81.24.51:65035 : getinfo
SV packet 84.221.251.11:27960 : getinfo
Item: 1 weapon_shotgun
Item: 0 weapon_shotgun
SV packet 89.42.62.103:27960 : getinfo
Item: 1 ammo_bullets
Item: 1 ammo_bullets
Item: 0 item_armor_combat
SV packet 90.151.203.158:27960 : getinfo
SV packet 89.44.32.135:6737 : getinfo
SV packet 193.231.209.153:27960 : getinfo
SV packet 89.44.32.135:27220 : getinfo
Item: 1 weapon_plasmagun
Item: 0 weapon_shotgun
sayteam: Sarge: I'm going to capture the enemy flag!
(Sarge^7) (Blue Base): I'm going to capture the enemy flag!
SV packet 89.44.32.135:27220 : getchallenge
sending getIpAuthorize for 89.44.32.135:27220
SV packet 192.246.40.56:27952 : ipAuthorize
SV packet 190.21.140.29:61575 : getinfo
SV packet 89.44.32.135:27220 : connect
SVC_DirectConnect ()
Client 1 connecting with 33 challenge ping
Cvar_Set2: as_ip2 89.44.32.135:27220
Can't find ban.txt
Cvar_Set2: session2 2 17564 1 0 0 0 0 0 0 0.0
ClientConnect: 2
ClientUserinfoChanged: 2 n\^b^1Z^7od\t\2\model\visor/blue\hmodel\visor/blue\g_redteam\\g_blueteam\\c1\1\c2\4\hc\100\w\0\l\0\tt\0\tl\0
Client number 2 (name = '^b^1Z^7od') connecting from 89.44.32.135:27220
broadcast: print "^b^1Z^7od^7 connected\n"
Going from CS_FREE to CS_CONNECTED for ^b^1Z^7od
^b^1Z^7od : dropped gamestate, resending
SV_SendClientGameState() for ^b^1Z^7od
Going from CS_CONNECTED to CS_PRIMED for ^b^1Z^7od
SV packet 193.231.209.153:27960 : getinfo
SV packet 84.201.223.184:27960 : getinfo
Item: 1 item_armor_combat
SV packet 80.98.158.40:27960 : getinfo
sayteam: Sarge: Who is the team leader
(Sarge^7) (Blue Base): Who is the team leader
sayteam: Orbb: I am on my way to capture the enemy flag.
(Orbb^7) (Red Base): I am on my way to capture the enemy flag.
sayteam: Orbb: Who is the team leader
(Orbb^7) (Red Base): Who is the team leader
Can't find ban.txt
Cvar_Set2: session3 1 20072 1 0 0 0 0 0 0 0.0
loaded cached skill 1.000000 from bots/default_c.c
FS_FOpenFileRead: botfiles/bots/cadavre_c.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/chars.h (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded skill 1 from bots/cadavre_c.c
loaded cached skill 4.000000 from bots/default_c.c
FS_FOpenFileRead: botfiles/bots/cadavre_c.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/chars.h (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded skill 4 from bots/cadavre_c.c
FS_FOpenFileRead: botfiles/bots/cadavre_i.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/inv.h (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/fw_items.c (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded bots/cadavre_i.c
FS_FOpenFileRead: botfiles/bots/cadavre_w.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/inv.h (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/fw_weap.c (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded bots/cadavre_w.c
FS_FOpenFileRead: botfiles/bots/cadavre_t.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/teamplay.h (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/bots/cadavre_t.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/teamplay.h (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded cadavre from bots/cadavre_t.c
ClientConnect: 3
ClientUserinfoChanged: 3 n\Cadavre\t\2\model\biker/cadavre\hmodel\biker/cadavre\c1\4\c2\5\hc\90\w\0\l\0\skill\ 3.00\tt\0\tl\0
Client number 3 (name = 'Cadavre') connecting from (BOT)
broadcast: print "Cadavre^7 connected\n"
broadcast: print "Cadavre^7 entered the game\n"
ClientBegin: 3
Can't find ban.txt
Cvar_Set2: session4 2 20072 1 0 0 0 0 0 0 0.0
loaded cached skill 1.000000 from bots/default_c.c
FS_FOpenFileRead: botfiles/bots/uriel_c.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/chars.h (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded skill 1 from bots/uriel_c.c
loaded cached skill 4.000000 from bots/default_c.c
FS_FOpenFileRead: botfiles/bots/uriel_c.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/chars.h (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded skill 4 from bots/uriel_c.c
FS_FOpenFileRead: botfiles/bots/uriel_i.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/inv.h (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/fw_items.c (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded bots/uriel_i.c
FS_FOpenFileRead: botfiles/bots/uriel_w.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/inv.h (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/fw_weap.c (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded bots/uriel_w.c
FS_FOpenFileRead: botfiles/bots/uriel_t.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/teamplay.h (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/bots/uriel_t.c (found in '/home/test/quake3/baseq3/pak4.pk3')
FS_FOpenFileRead: botfiles/teamplay.h (found in '/home/test/quake3/baseq3/pak4.pk3')
loaded uriel from bots/uriel_t.c
ClientConnect: 4
ClientUserinfoChanged: 4 n\Uriel\t\1\model\uriel\hmodel\uriel\c1\4\c2\5\hc\90\w\0\l\0\skill\ 3.00\tt\0\tl\0
Client number 4 (name = 'Uriel') connecting from (BOT)
broadcast: print "Uriel^7 connected\n"
broadcast: print "Uriel^7 entered the game\n"
ClientBegin: 4
SV packet 89.250.2.244:27960 : getinfo
Kill: 4 4 20: Uriel killed Uriel by MOD_SUICIDE 2
ClientUserinfoChanged: 4 n\Uriel\t\1\model\uriel\hmodel\uriel\c1\4\c2\5\hc\90\w\0\l\0\skill\ 3.00\tt\0\tl\1
ClientUserinfoChanged: 4 n\Uriel\t\1\model\uriel\hmodel\uriel\c1\4\c2\5\hc\90\w\0\l\0\skill\ 3.00\tt\0\tl\1
broadcast: print "Uriel^7 entered the game\n"
ClientBegin: 4
Kill: 3 3 20: Cadavre killed Cadavre by MOD_SUICIDE 2
ClientUserinfoChanged: 3 n\Cadavre\t\2\model\biker/cadavre\hmodel\biker/cadavre\c1\4\c2\5\hc\90\w\0\l\0\skill\ 3.00\tt\0\tl\0
broadcast: print "Cadavre^7 entered the game\n"
ClientBegin: 3
Item: 1 ammo_rockets
Item: 0 ammo_shells
clientCommand: ^b^1Z^7od : 1 : cp 737 -104864601 -1167426494 @ -104864601 809532492 -1167426494 -898865432 -305742731 -1920593051 -975001615 1391361210 132998210 296784011
clientCommand: ^b^1Z^7od : 2 : userinfo "\cl_guid\67FD6C7098FE919B9CCF0A00BDE61793\rate\25000\model\doom/blue\password\$pr1v@te$\name\^b^1Z^7od\cg_predictItems\1\cl_anonymous\0\sex\male\handicap\100\color2\4\color1\1\team_headmodel\visor/blue\team_model\visor/blue\headmodel\visor/blue\snaps\30\cg_scorePlums\1\cg_smoothClients\0\cl_punkbuster\1\teamtask\0\osp_client\1008\teamoverlay\1"
ClientUserinfoChanged: 2 n\^b^1Z^7od\t\2\model\visor/blue\hmodel\visor/blue\g_redteam\\g_blueteam\\c1\1\c2\4\hc\100\w\0\l\0\tt\0\tl\1
Going from CS_PRIMED to CS_ACTIVE for ^b^1Z^7od
broadcast: print "^b^1Z^7od^7 entered the game\n"
ClientBegin: 2
^3PunkBuster Server: New Connection (slot #3) 89.44.32.135:27220 [?] "^b^1Z^7od" (seq 11514988)
Item: 3 weapon_shotgun
^3PunkBuster Server: Player GUID Computed c01f05c6a92a9fd9cfc9120dd04eb594(-) (slot #3) 89.44.32.135:27220 ^b^1Z^7od
^3PunkBuster Server: GUID AUTH: c01f05c6a92a9fd9cfc9120dd04eb594 VALID
Item: 4 weapon_shotgun
SV packet 190.30.119.186:27960 : getinfo
Item: 1 ammo_shells
clientCommand: ^b^1Z^7od : 3 : score
tell: Uriel to Orbb: Eyeball get the flag
Item: 0 ammo_rockets
sayteam: Sarge: I am on guard at the Blue Flag!
(Sarge^7) (Blue Base): I am on guard at the Blue Flag!
sayteam: Cadavre: I am on guard at the Blue Flag!
(Cadavre^7) (Blue Base): I am on guard at the Blue Flag!
Item: 1 ammo_cells
SV packet 83.20.153.100:27960 : getinfo
Item: 2 ammo_bullets
Item: 2 ammo_bullets
SV packet 80.54.97.4:27960 : getinfo
sayteam: Uriel: I'll guard the Red Flag!
(Uriel^7) (Red Base): I'll guard the Red Flag!
Item: 0 weapon_plasmagun
Item: 2 item_armor_combat
SV packet 91.122.116.192:27960 : getinfo
SV packet 91.122.116.192:27960 : getinfo
Item: 3 weapon_shotgun
SV packet 91.122.116.192:27960 : getinfo
sayteam: Orbb: I am going in for the capture!
(Orbb^7) (Courtyard): I am going in for the capture!
Item: 1 weapon_rocketlauncher
broadcast: print "Sarge^7 was kicked\n"
Going to CS_ZOMBIE for Sarge
Client number 0 (name = 'Sarge') disconnected
ClientDisconnect: 0
^3PunkBuster Server: Lost Connection (slot #1) bot (-) Sarge
Item: 1 ammo_shells
Item: 3 weapon_shotgun
Item: 3 weapon_shotgun
SV packet 82.210.157.183:27960 : getinfo
Item: 4 weapon_plasmagun
Item: 3 weapon_shotgun
SV packet 67.177.5.17:27960 : getinfo
Item: 3 weapon_shotgun
Item: 1 ammo_cells
SV packet 213.251.173.32:41336 : getinfo
SV packet 213.251.173.32:41336 : getstatus
clientCommand: ^b^1Z^7od : 4 : say aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
say: ^b^1Z^7od: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Received signal 11, exiting...




Last edited by nexus024 on 03-29-2008 11:41 AM, edited 1 time in total.

Top
                 

Commander
Commander

Joined: 06 Oct 2006
Posts: 148
PostPosted: 03-29-2008 11:36 AM           Profile Send private message  E-mail  Edit post Reply with quote


However, the server in this example is running out of the baseq3/ so the qagamei386.so is in there.

Once again this is with the fix applied to the g_syscalls.c file and the trap_SendServerCommand function modifed to look like this...

Code:
void trap_SendServerCommand( int clientNum, const char *text ) {
        // rain - hack - commands over 1022 chars will crash the
        // client upon receipt, so ignore them
        if( strlen( text ) > 1022 ) {
                G_LogPrintf( "trap_SendServerCommand( %d, ... ) length exceeds 1022.\n", clientNum );
                G_LogPrintf( "text [%s]\n", text );
                return;
        }
        syscall( G_SEND_SERVER_COMMAND, clientNum, text );
}




Top
                 

Recruit
Recruit

Joined: 30 Mar 2008
Posts: 1
PostPosted: 03-30-2008 03:25 AM           Profile Send private message  E-mail  Edit post Reply with quote


Hello,

I was here looking for something else when I saw your post.

That code you are trying to add, If you read a little more in detail is for Enemy Territory, not specifically Quake 3. I saw someone post that url on the ioquake3 mailing list but most of those exploits are based around punkbuster, which custom q3 servers won't have and most of the other exploits are not related directly to quake 3 from what I've seen.

Chris




Top
                 

Commander
Commander

Joined: 15 Nov 2006
Posts: 129
PostPosted: 03-30-2008 03:47 AM           Profile Send private message  E-mail  Edit post Reply with quote


You'll note that the way the server errors will have changed with your fix. Instead of clients getting disconnected with an error message, the server is segfaulting. This is because theres an error in the code change you've made. ;)

As pointed out by the previous poster, the code-change you're copy+pasting is for W:ET. It would appear that simply applying this to Q3 opens up a worse exploit ;)

Code:
G_LogPrintf( "text [%s]\n", text );


This is the cause of your segfault - G_LogPrintf in the q3 source uses vsprintf to output the text into a buffer 1024 bytes long without checking the length of the string being logged. While in W:ET, G_LogPrintf uses vsnprintf, which does a buffer length check.

Either remove the call to G_LogPrintf (you dont really want the console logging the problematic strings, do you?), or update it so that it too is buffer safe (eg uses vsnprintf).

ioq3 already has the issue addressed in the engine side of the trapcall btw (in rev 95)




Top
                 

Commander
Commander

Joined: 06 Oct 2006
Posts: 148
PostPosted: 03-30-2008 05:25 AM           Profile Send private message  E-mail  Edit post Reply with quote


Quote:
ioq3 already has the issue addressed in the engine side of the trapcall btw (in rev 95)


Yes, but this is an engine side fix and I want to still be able to run 1.32c with punkbuster. Also, I just noticed that I have both of the G_LogPrintf function calls commented out so that still doesn't explain why this exploit is still able to be used.




Top
                 

Mentor
Mentor

Joined: 12 Mar 2005
Posts: 3958
PostPosted: 03-30-2008 05:48 AM           Profile Send private message  E-mail  Edit post Reply with quote


AnthonyJ wrote:
G_LogPrintf in the q3 source uses vsprintf to output the text into a buffer 1024 bytes long without checking the length of the string being logged. While in W:ET, G_LogPrintf uses vsnprintf, which does a buffer length check.

Beginner's error, you'd expect better from iD. Bad developer, no cookie. :(

@nexus: from the console dump, it appears your mod is loaded correctly. Could you add something like
Code:
Com_Printf("No worries, I'm really here!\n");

at the top of trap_SendServerCommand(), just to be sure your patch is actually executed? If it is, add this:
Code:
/* at the top */
#define _GNU_SOURCE
#include <string.h>

/* in trap_SendServerCommand() */
if (strnlen(text, 1022) >= 1022) {
    /* log hacking attempt */
    return;
}




Top
                 

Commander
Commander

Joined: 06 Oct 2006
Posts: 148
PostPosted: 03-30-2008 06:30 AM           Profile Send private message  E-mail  Edit post Reply with quote


Interesting, 'say' isn't passing into that function at all...




Top
                 

Commander
Commander

Joined: 15 Nov 2006
Posts: 129
PostPosted: 03-30-2008 06:44 AM           Profile Send private message  E-mail  Edit post Reply with quote


nexus024 wrote:
Interesting, 'say' isn't passing into that function at all...


Ahhh.... The answer is because the exploit you're testing isnt the one that you've got a code-fix for ;) The clue is in your own console log:
Quote:
clientCommand: ^b^1Z^7od : 4 : say ....


There is a similar issue but unrelated with the client command "say". You'll notice that G_Say is also calling G_LogPrintf with the buffer its been given, and that is the line responsible for outputting the last line of the log before the segfault.

Fix G_LogPrintf.

(There may be further follow on bugs on a similar vein though, I've not debugged into this code to test this)

Edit: hmmm, actually, I'm not so sure the problem completely lies with G_LogPrintf, but it should be fixed anyway. Looks like you should debug into what the actual problem is rather than just taking stabs in the dark.




Top
                 

Commander
Commander

Joined: 06 Oct 2006
Posts: 148
PostPosted: 03-30-2008 09:40 AM           Profile Send private message  E-mail  Edit post Reply with quote


Well in G_Say I have this ...

Code:
#define   MAX_SAY_TEXT   150

// don't let text be too long for malicious reasons
char      text[MAX_SAY_TEXT];


This was coded into my mod so I would assume that should stop any msg's with text over 150 chars from passing through...




Top
                 

Commander
Commander

Joined: 15 Nov 2006
Posts: 129
PostPosted: 03-30-2008 10:03 AM           Profile Send private message  E-mail  Edit post Reply with quote


nexus024 wrote:
This was coded into my mod so I would assume that should stop any msg's with text over 150 chars from passing through...


You'd think.... but no.

Code:
   char      text[MAX_SAY_TEXT];
:
   case SAY_ALL:
      G_LogPrintf( "say: %s: %s\n", ent->client->pers.netname, chatText );
      Com_sprintf (name, sizeof(name), "%s%c%c"EC": ", ent->client->pers.netname, Q_COLOR_ESCAPE,
:
:
   Q_strncpyz( text, chatText, sizeof(text) );

Its overflowing the buffer in G_LogPrintf using the input chatText, which in your console log above is 1020 chars long (+5 for "say: " + name length + space and newline). The MAX_SAY_TEXT value only comes into play when it does the Q_strncpyz, where it copies into the text buffer. You could refactor the code so that it does the copy first, and then lower down doesnt reference chatText, but only text.

Like I said, fix G_LogPrintf.

Since I dont think you're a programmer, what you actually need to do is either do some more investigation of "known" exploits and see if you can find the correct fix for this problem in an already existing codebase. Or, you'll need to get a programmer to debug into it and find out what the actual crash is. It shouldnt take that long. Not me tho :) Guessing at the problem by looking at the code is fine, as clearly I've managed to uncover at least two potential overruns (both ultimately G_LogPrintf tho), but running it in a debugger should find you the one that is *actually* crashing.

If you want to make it properly secure, you should search for any other instances of sprintf etc and change all of them to be buffer safe. This revision in the ioq3 source would be a good place to start (covers game, cgame, botlib etc): http://svn.icculus.org/quake3?view=rev&revision=1277




Top
                 

Commander
Commander

Joined: 06 Oct 2006
Posts: 148
PostPosted: 03-30-2008 10:41 AM           Profile Send private message  E-mail  Edit post Reply with quote


Ok, that fixed the problem for 'say', however 'tell' and 'say_team' are still exploitable. For say_team it seems that it doesn't get into that first if statement that sends it to G_LogPrintf.




Top
                 

Commander
Commander

Joined: 15 Nov 2006
Posts: 129
PostPosted: 03-30-2008 11:04 AM           Profile Send private message  E-mail  Edit post Reply with quote


nexus024 wrote:
Ok, that fixed the problem for 'say', however 'tell' and 'say_team' are still exploitable. For say_team it seems that it doesn't get into that first if statement that sends it to G_LogPrintf.


A debugger would tell you instantly the problem. Time for you to learn how to use it IMO.

You didnt just comment out the G_LogPrintf did you? If so, dont forget to comment out the one from the SAY_TEAM: case in that switch...




Top
                 

Commander
Commander

Joined: 06 Oct 2006
Posts: 148
PostPosted: 03-30-2008 12:02 PM           Profile Send private message  E-mail  Edit post Reply with quote


No, I wrote a if strlen( text ) > 1022 within the G_LogPrintf function to catch it. Unfortunately I don't have a debugger. I am just using make to build it and running it on the server to view changes with the log file.




Top
                 
Quake3World.com | Forum Index | Programming Discussion


Post new topic Reply to topic


cron
Quake3World.com
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group