Colonial Marines Code Leak

Crab_Nicholson · Sat Jul 30, 2016 3:43 am

There was an announcement a bit ago in OOC that the source code for the Colonial Marines server was leaked by a trusted coder along with a link to the thread he did it in. Shortly after there was full panic mode and they contacted the digg admin or whatever to have the thread deleted. I managed to snag the details before hand.

Here are the links proper:
https://github.com/ColonialMarinesRelea ... PHA-master
https://github.com/ColonialMarinesRelea ... HA-DevTest

Bawhoppennn · Post by **Bawhoppennn** » Sat Jul 30, 2016 4:17 am #199618

oh shit son

kevinz000 · Post by **kevinz000** » Sat Jul 30, 2016 4:20 am #199619

DRAMA TIME?!!

Bawhoppennn · Post by **Bawhoppennn** » Sat Jul 30, 2016 4:30 am #199622

now that I think of it tbh theres nothing exciting codewise, its not like they had secrets like goon that people obsessed over

Remie Richards · Sat Jul 30, 2016 4:33 am

It's just for the Schadenfreude, it's nice to look at shitcode once in a while.

Davidchan · Post by **Davidchan** » Sat Jul 30, 2016 4:46 am #199625

Having seen how apop runs his server, interacts with his community and the staff he entrusts to run the server when he's not around, this comes as no shock. Will have to take a look when I'm not on mobile but I can pretty much bet the code is sloppy and imbalanced as shit, the server always lagged when I played and the admin team were the biggest bunch of babies if their xeno team didn't win.

Remie Richards · Sat Jul 30, 2016 4:53 am

Davidchan wrote:Having seen how apop runs his server, interacts with his community and the staff he entrusts to run the server when he's not around, this comes as no shock. Will have to take a look when I'm not on mobile but I can pretty much bet the code is sloppy and imbalanced as shit, the server always lagged when I played and the admin team were the biggest bunch of babies if their xeno team didn't win.

Looking at it it's definitely... low standards.
MSO has also found lots of old exploits that we fixed aeons ago.

Davidchan · Post by **Davidchan** » Sat Jul 30, 2016 5:08 am #199628

Well we got our next aprils fools event then. Colonial marines with tg rules and community. Let the escelation begin!

DrPillzRedux · Sat Jul 30, 2016 5:16 am

Call me when lw is leaked.

iamgoofball · Post by **iamgoofball** » Sat Jul 30, 2016 5:19 am #199631

DO NOT RUN THIS CODE UNSANDBOXED

DO NOT OPEN ANY SOUNDS OR ICONS

Screemonster · Sat Jul 30, 2016 6:09 am

iamgoofball wrote:DO NOT RUN THIS CODE UNSANDBOXED

DO NOT OPEN ANY SOUNDS OR ICONS

Just as precaution, or actually bad shit confirmed?

iamgoofball · Post by **iamgoofball** » Sat Jul 30, 2016 6:28 am #199641

Precaution.

Alex Crimson · Sat Jul 30, 2016 6:46 am

Apparently it was a hacker/script kiddie/whatever, not the admin/coder. Their account was hacked. People were saying its the same person who leaked Gooncode, but i wasnt around for that so i have no idea.

Remie Richards · Sat Jul 30, 2016 6:51 am

Alex Crimson wrote:Apparently it was a hacker/script kiddie/whatever, not the admin/coder. Their account was hacked. People were saying its the same person who leaked Gooncode, but i wasnt around for that so i have no idea.

We know, and yes, it's the same guy.

Screemonster · Sat Jul 30, 2016 7:58 am

Okay, just had a message from a buddy, apparently there's a bitcoin miner in it.

[8:19 AM] : "ust as an aside, can confirm he snuck a BCM into the source.
Don't compile and run the server
Don't credit me on that, but I ran it in Virtual box
Immediate seizure of the Artificial ram and CPU usage spiked to 95%"
[8:19 AM] : Just got PM'd this
[8:24 AM] : Compiled the code, this happened: http://puu.sh/qjvAb/4fb60971de.png

So with that in mind:

TAKE GOOFBALL'S ADVICE

J_Madison · Post by **J_Madison** » Sat Jul 30, 2016 9:19 am #199661

wonderful. Lets get that miner removed.

Sat Jul 30, 2016 9:44 am

Is there even anything of value in this code to begin with

Isn't cm just old tg with weirdly high res sprites and loadsa guns

J_Madison · Post by **J_Madison** » Sat Jul 30, 2016 10:06 am #199669

Likely some sprites and xeno based code in regards to Xeno fighting styles. Also some kind of dismemberment and mechanics such as knives on heads and pulling tables down as cover.

Small bits of salavagable code.

Post by **oranges** » Sat Jul 30, 2016 11:04 am #199680

A bitcoin miner in dm?

I have a hard time believing that.

iamgoofball · Sat Jul 30, 2016 11:39 am

oranges wrote:A bitcoin miner in dm?

I have a hard time believing that.

dee ell ells?

J_Madison · Post by **J_Madison** » Sat Jul 30, 2016 11:52 am #199687

Goof I believe you made a similar accusation with the goon leak. None of my guys found anything unusual.

iamgoofball · Sat Jul 30, 2016 11:59 am

Better safe than sorry tbh

Post by **oranges** » Sat Jul 30, 2016 12:03 pm #199692

I dont' see anything specific pointing to a miner, although I suppose someone could have modified the mysql dll.

Alipheese · Post by **Alipheese** » Sat Jul 30, 2016 2:12 pm #199718

Well wouldnt surprise me that CM forces its users to mine bit coins* for them. The entire server is just filled cancer and autism and its a tumour on our great game.

Remie Richards · Sat Jul 30, 2016 2:30 pm

Alipheese wrote:Well wouldnt surprise me that CM forces its users to mine bit coins* for them. The entire server is just filled cancer and autism and its a tumour on our great game.

That doesn't even work, all Byond games run server-side.
the bitcoin miner, if one exists, is in the source code so that the leaker can get some bitcoins from people foolish enough to compile the stolen code.

Jacough · Post by **Jacough** » Sat Jul 30, 2016 5:22 pm #199744

Screemonster wrote:Okay, just had a message from a buddy, apparently there's a bitcoin miner in it.

So we'll be able to allow shaft miners mine for bitcoins?

Oldman Robustin · Sat Jul 30, 2016 5:56 pm

Someone let me know if any of this is usable from a practical perspective.

I was contemplating doing a Xeno mode here, but I needed someone to make a map, to write some of the more complex code aspects, and to help sprite. A CM leak could help with all three.

Ricotez · Post by **Ricotez** » Sat Jul 30, 2016 8:22 pm #199782

I'm not sure if we could use any of it under our own license, especially since the code itself already breaks Bay's license

Slignerd · Post by **Slignerd** » Sat Jul 30, 2016 8:40 pm #199786

I don't think we even should use any of their sprites. Most of them don't really fit the game well at all.

onleavedontatme · Sat Jul 30, 2016 9:53 pm

The CM host and coders whining about how their hard work has been "stolen" is amusing considering their game is built on the back of a decade of open source work by other people, and using the intellectual property of Fox.

Saegrimr · Post by **Saegrimr** » Sat Jul 30, 2016 9:56 pm #199804

"stolen"
The real joke here is anybody actually wanting to use any of their assets. Goon on the other hand, they got some nice stuff probably worth pinching if it were actually viable considering licenses.

Davidchan · Post by **Davidchan** » Sun Jul 31, 2016 1:20 am #199857

Yeah Oldman you'd be better off going from ground up. CM code is hilariously outdated, ineffective and full of so many exploits and nuances. It being the only server you can get a gun as nonantag being the reason most of the kiddos play there.

Drynwyn · Post by **Drynwyn** » Sun Jul 31, 2016 7:00 am #199952

Ricotez wrote:I'm not sure if we could use any of it under our own license, especially since the code itself already breaks Bay's license

I still don't understand why we care so much about licensing when the game's code :
a) was stolen in it's original format and all current servers are ultimately descended from this stolen flash drive
b) was relicensed without consent from all contributors on the basis of "eh they'll say something if they've got issues"
c) contains numerous copyright/trademark violations and gray areas that have only gone undetected due to the extreme niche appeal of the game itself
d) is modified for a number of downstream servers, several of which then run on closed-source licenses (which as I understand it violates the terms of our license but nobody gives two shits)

ShadowDimentio · Sun Jul 31, 2016 7:12 am

Breaking the law and then saying "well we haven't gotten arrested yet so it must not matter" is not an attitude to keep towards these things.

DrPillzRedux · Sun Jul 31, 2016 8:54 pm

Not sure why you guys shit on CM aside from their stupidness for being closed source. I'm actually quite liking it for what it is.

Post by **MrStonedOne** » Sun Jul 31, 2016 9:04 pm #200076

The code sucks, is full of exploits, is closed sourced. The game sucks, is full of gimmicks, isn't even ss13 anymore, the admins suck, are full of contradictions and disagreement on how to enforce the rules, and finally, the rules suck, tries to prevent rule breaking with more rules, has contradictions, and is just in general too subjective to be useful as rules.

DrPillzRedux · Sun Jul 31, 2016 9:20 pm

MrStonedOne wrote:The game sucks, is full of gimmicks, isn't even ss13 anymore, the admins suck, are full of contradictions and disagreement on how to enforce the rules, and finally, the rules suck, tries to prevent rule breaking with more rules, has contradictions, and is just in general too subjective to be useful as rules.

Sounds like tgstation to me tbh familia.

FantasticFwoosh · Sun Jul 31, 2016 9:32 pm

Steal the ladders and multi level design (aka the transport ships existing on the sucalmento *i forget the name of the ship* exist below the main ship level meant to be a sort of maintenance area without detracting from the main z level, maintenance below has been discussed before) for xhuis's aquastation as to simulate vertical depth rather than using ugly stair z level teleporting which will get sloppy with water mechanics or having to stretch the station psuedo horizontally in some ugly optical illusion where water in one area causes you to instantly die but the water in lets say the north place is perfectly fine.

Their loss is our gain if handled carefully again the code is shit so uh, proceed with caution.

Bawhoppennn · Sun Jul 31, 2016 11:10 pm

we have ladders

FantasticFwoosh · Mon Aug 01, 2016 12:10 pm

Bawhoppennn wrote:we have ladders

Unless I've misinterpreted a very clever artistic trick, they don't teleport to a new z level, they are DIRECTLY UNDERNEATH VERTICALLY and you can see out over the top. I am unsure if objects being thrown carry through though.

Remie Richards · Mon Aug 01, 2016 12:13 pm

get us a picture, we'll be able to tell Fwoosh.

Davidchan · Post by **Davidchan** » Mon Aug 01, 2016 12:13 pm #200207

Ladders were stolen from BestRP/Unbound Travels. They had a 3 z-level map and if you were on level 2 or 3 and stepped on a tile that was destroyed you'd fall down a level and could literally break your legs. So no, it's not something CM made and their execution was even worse.

calzilla1 · Post by **calzilla1** » Mon Aug 01, 2016 12:22 pm #200210

Can anyone post some of the exploits for... documentation?

ohnopigeons · Post by **ohnopigeons** » Mon Aug 01, 2016 1:05 pm #200215

All the exploits are there in the code, right in front of you. Open your eyes, dude.

Spoiler:

FantasticFwoosh · Mon Aug 01, 2016 3:31 pm

Remie Richards wrote:get us a picture, we'll be able to tell Fwoosh.

Dropship zone as i've said, i haven't been on CM in ages but its there.

Davidchan wrote:Ladders were stolen from BestRP/Unbound Travels. They had a 3 z-level map and if you were on level 2 or 3 and stepped on a tile that was destroyed you'd fall down a level and could literally break your legs. So no, it's not something CM made and their execution was even worse.

Post by **MrStonedOne** » Mon Aug 01, 2016 9:01 pm #200268

calzilla1 wrote:Can anyone post some of the exploits for... documentation?

from a rudimentary glance thru the code, there is sql injection in bible/religion names, and in the library search feature, but both of these are just that it doesn't properly escape \, something byond tends to try to filter if you try to send it. how ever byond doesn't allow multiple queries, so you can't use ; at all in sql injections, but you could abuse union or subqueries to get people's ip address/cids if you can figure out how to get a \ pass and use \ to escape the code's escaping of the ' you enter. (\' turns into \\' meaning your close quote still exists)

Their attacklogs aren't properly filtered so if you can get html into the name of something, and hit somebody with it, the html will run when an admin views VV of you or the other person.

mechs seem to still have the center bug, meaning if you press numpad 5 in a mech, you will move to the next zlevel up, and you can just keep repeating that to cycle thru all of the z-levels.

MrEousTranger · Tue Aug 02, 2016 2:52 am

Well on the topic of Aliens
But off the topic of Cucklonial Marines
anyone else hype for alien 5?

A3STH3T1CS · Post by **A3STH3T1CS** » Tue Aug 02, 2016 3:20 am #200335

What are they scared for? Their game runs like dog shit because their FPS and smoothing matchs like two gay puzzle pieces.

It doesn't work so fuck their pointless drama. They don't have anything of value besides a mediocre collection of the excrement from two girls in one cup put into digital interactive slag.

WJohnston · Post by **WJohnston** » Tue Aug 02, 2016 6:47 am #200350

From what I briefly looked over, I couldn't see any of the newer xeno sprites in the mob files. Unless these were stored somewhere else this might actually just be a much older copy of the code.

In any case I'm firmly against using any of their xeno sprites, I've bitched long enough about how I'm not okay with them using my sprites and it'd be absolutely horrible to take theirs in return.

Besides I like my sprites better.

But I'd like to check theirs out.

For comparison reasons.

Honest.

A3STH3T1CS · Post by **A3STH3T1CS** » Tue Aug 02, 2016 6:54 am #200351

subtle