Main server 100% cpu crash

[Sagrak]

Hey guys, its my first post here.

My main server is reaching 100% cpu at random times, it normally stays around 3%, i do not have that many players for the hardware i hired.

I have searched around the forum for a few days and read about packet filters.

I do have anti ddos protection and i suspect its some kind of packet crash, does anyone has a list of known packet crashes or abusable bugs? i temporarily disabled egg packets and crashes stopped for a day, but they started again, seems like other exploit has been found.

I am using a modified core.dll that got cleaned and transformed into a simple event dispatcher so i can hook those events in my own dll, if that information helps.

Thanks everyone for the possible help, the code posted on this forum was very inspiring in my journey.

 

[DrOr-CoOl]

http://forum.ragezone.com/f315/core-memory-leaks-fixes-1156082/

Follow this guide mate ,
the functions on core 2017 doesn't release memory so it might be this.
you should end the skills like the guide says.

P.S: look at my reply there becouse he didnt write the code well. (it will not execute the way he did)
Hope i helped you mate

 

[Sagrak]

Thanks for your reply!
Sorry if i'm being missinformed, but wouldnt a memory leak be affecting the memory as well? i have a 16gb ram server and atm only 200mb is being used in avarage, when cpu reaches 100% its still at the same avarage. My core.dll doesent have most of the original core code, right now its something like only:

int __fastcall Tick(void *Player, void *edx){
  IChar IPlayer(Player);
  BattlefieldMode::PlayerTick(IPlayer);
  PlayerBattleRoyaleMode::PlayerTick(IPlayer);
  PartyBattleRoyaleMode::PlayerTick(IPlayer);
  ...
}

 

[DrOr-CoOl]

Thanks for your reply!
Sorry if i'm being missinformed, but wouldnt a memory leak be affecting the memory as well? i have a 16gb ram server and atm only 200mb is being used in avarage, when cpu reaches 100% its still at the same avarage. My core.dll doesent have most of the original core code, right now its something like only:

int __fastcall Tick(void *Player, void *edx){
  IChar IPlayer(Player);
  BattlefieldMode::PlayerTick(IPlayer);
  PlayerBattleRoyaleMode::PlayerTick(IPlayer);
  PartyBattleRoyaleMode::PlayerTick(IPlayer);
  ...
}

Thats make it easier mate.
go inside the code blocks and look for a function that you might didn't close well.
(thats mean it repeat untill it dies XD )
Player tick can be risky if you dont know what you are doing.

 

[RevEngKal]

.....

 

[DrOr-CoOl]

A memory leak does not really affect CPU usage though.

in that case what can it be?
my mainserver takes 0.5/5-0.6% of memory when i use it for testing 2 or even 3 days..
i think its a running function that repeat itself.

btw look at his core.. he put all the code in 4 files, thats makes the memory leaks more critical.

 

[Sagrak]

in that case what can it be?btw look at his core.. he put all the code in 4 files, thats makes the memory leaks more critical.

That was just for the sake of the example showing i converted each hook into a event dispatcher instead of using core code by itself, but thanks anyway hehe.

The weird thing is that server runs for days without the cpu spiraling, i have unit tested most of the code, that leads me to believe that the fault is in the original main server and someone is exploiting some kind of old packet crash. Any known ones?

 

[RevEngKal]

.....

 

[DrOr-CoOl]

if you are not about to help than why you came to the help section?
last time i checked , no one was born with knowladge of c++.
learning isnt the mistakes you don't make, its the learning of tham.
people are here to learn dont push them down!

 

[RevEngKal]

.....

 

[MajorIG247]

Hello, i would like to inform it has nothing to do with it core.dll, if you're using beshoy userpanel disable it temproary and and this problem will be sloved, its someone ddosing your userpanel
core.dll it has some leaks etc and it does not touch the cpu usage

 

[RevEngKal]

.....

 

[MajorIG247]

Given all information in the submitters post, this explanation is completely wrong. The userpanel AFAIK does not connect to main, but rather directly to the MSSQL server. Threfore, a DDOS attack on the userpand would result in CPU spikes in the MSSQL processes and the webserver processes, but not the main server process.

okay use beshoy userpanel and i will prove for you if my words was correct or not...
its not ddos attacks exactly but its spams cuasing the problem i know what i am saying i had the problem ago and thats how i sloved mr pro

 

[BeshoyFD]

ddosing ucp results = php cgi , mssql , iis > high cpu
thread subject is : Main server 100% cpu crash
of course he checked process usage and found that mainsvrt with high cpu usage
don't reply on something that you aren't sure about it and dont answer if you don't have enough knowledge ,

 

[Sagrak]

Hey guys thanks for the help, i have the issue solved atm.

About some of the guesses above: I am not using Beshoys user panel, currently running a custom one made in node.js, and i'm not using most of the code in core.dll which could leak, just took the memory addresses to make my own event dispatcher as posted above. Ill make sure to post a better environment dump before the next posts!

The 100% cpu was being caused by malicious packets being sent with a size different to what its header claimed it to have, therefore causing everything after that to loop and meet the wrong requirements. I was able to find the bug after having a try catch around the Process function just so i could see what was last packet to cause error, then notice it was always with wrong size. Filtering by size made the server stable again.

This is probably a bug that none of you more experienced guys would face since trying to use my own code didn't guard me against this, but it was my first time diving into kal code. Thanks all for your help and for everyone who posts snippets around the forum, the last days as server admin made me realize how frustrating it is to be part of the community sometimes and that you guys don't get thanked enough

 

[DrOr-CoOl]

Hey guys thanks for the help, i have the issue solved atm.

About some of the guesses above: I am not using Beshoys user panel, currently running a custom one made in node.js, and i'm not using most of the code in core.dll which could leak, just took the memory addresses to make my own event dispatcher as posted above. Ill make sure to post a better environment dump before the next posts!

The 100% cpu was being caused by malicious packets being sent with a size different to what its header claimed it to have, therefore causing everything after that to loop and meet the wrong requirements. I was able to find the bug after having a try catch around the Process function just so i could see what was last packet to cause error, then notice it was always with wrong size. Filtering by size made the server stable again.

This is probably a bug that none of you more experienced guys would face since trying to use my own code didn't guard me against this, but it was my first time diving into kal code. Thanks all for your help and for everyone who posts snippets around the forum, the last days as server admin made me realize how frustrating it is to be part of the community sometimes and that you guys don't get thanked enough

good to hear you solved it.
keep going mate!

 

[MajorIG247]

ddosing ucp results = php cgi , mssql , iis > high cpu
thread subject is : Main server 100% cpu crash
of course he checked process usage and found that mainsvrt with high cpu usage
don't reply on something that you aren't sure about it and dont answer if you don't have enough knowledge ,

your ucp is the main source of the high cpu usage problem and i just explained how did i fixed, i just disabled your userpanel and then i had no more problems with ucp, your ucp was usefully and still but hope you update it with new ways and codes overwise its will be useless its can destory whole srv.