- Joined
- Sep 5, 2012
- Messages
- 124
- Reaction score
- 109
Pet Attribute Overflow Exploit - Battle of the Immortals (BOI) / War of the Immortals (WOI)
What is it
Integer overflow bug in the server-side handler for packet 0x4466 (MsgPet_C2S_AddPoint) — the packet the client sends when you distribute pet attribute points. You can allocate 63k+ to every stat while the server thinks you spent zero points.
How it works
When you distribute pet attribute points in-game, the client sends 5 uint16 values to the server (STR, CON, DEX, INT, SPR). The server:
- Sums all 5 values
- Checks if sum ≤ available points
- If yes: applies each stat individually with the full value you sent
- If no: rejects
Seems fine, right? The catch is in how the sum gets stored. Whoever wrote this handler stored the sum as a 16-bit word (max 65535). But 5 × 65535 = 327675 — easily overflows a word.
When the real sum exceeds 65535, the word wraps around to zero. The server then compares 0 ≤ availablePoints → approves. But it still writes each stat with the full uint16 value you sent.
Code:
Pseudocode of the vulnerable handler:
sum = str + con + dex + int + spr // e.g. 63536+63536+63536+63536+8000 = 262144
mov word ptr [sum], ax // ⚠️ truncates to 16-bit → 0x0000
...
movzx ecx, word ptr [sum] // loads zero
cmp ecx, [availablePoints] // 0 ≤ anything → ALWAYS PASSESThe magic numbers:
- STR = -2000 (signed) → interpreted as uint16 = 63536 (0xF830)
- CON = -2000 → uint16 = 63536
- DEX = -2000 → uint16 = 63536
- INT = -2000 → uint16 = 63536
- SPR = 8000
Real sum: 4×63536 + 8000 = 262144 (0x40000)
Truncated to word: 0x0000
Server sees: "0 points used, approved"
Server applies: STR=63536, CON=63536, DEX=63536, INT=63536, SPR=8000
You just got a quarter million stat points. For free.
Proof of Concept Tool
Attached is a C++/CLI tool that automates the exploit:
- Opens game.exe with read/write access
- Reads your owned pet list and shows all pets with their current stats
- Writes the exploit values directly into the pet's distribution fields in client memory
- Forces the "Done" button so you can send without having real points
Usage:
- Summon your pet in-game first
- Run PetExploit.exe as Administrator
- Select game.exe, click Attach
- Pick your pet from the list, click Exploit
- Open pet attribute window in-game, click Done
The client sends the manipulated values via packet 0x4466, the server's broken validation approves it, and the stats stick. No packet injection needed — the game client does the sending for you.
Affected
Any server running Battle of the Immortals (BOI) or War of the Immortals (WOI) server binaries that still have the original 0x4466 handler. If the server uses the unmodified handler, it's vulnerable. The bug is in the server binary, not the client — so every player on that server can do this.
Why it works in depth
The root cause is a type width mismatch in the validation logic. The individual stat values are 16-bit (uint16). Five of them summed need at least 18 bits (log2(327675) ≈ 18.3). But the developer used a word-sized temporary for the sum — effectively validating with `(sum & 0xFFFF)` instead of the actual sum.
This is a classic CWE-190 (Integer Overflow/Wraparound) combined with a TOCTOU-style logic gap: the validation uses the truncated sum, but the application uses the full values. The three `movzx` instructions in the handler confirm it — they load the sum assuming it's a word that needs zero-extending to dword, which is correct for a word, but wrong when that word should have been a dword all along.
Download:
To view the content, you need to sign in or register
VirusTotal:
To view the content, you need to sign in or register
Credits: Research & PoC by Necros
