Thought that the 0x00sec hive mind might be able to point me in the right direction. Long story short, I’m looking to do some fuzzing for a pc game which allows custom code [ mods ] for things such as icons for in-game items. I’ll mention the exact game name if you want, but I figured I’d leave it off for now so as to bypass any possible legalities.
[ SWIM doesn’t want to have to say SWIM everytime he speaks about SWIM, etc… ]
Shouldn’t be difficult to find if you simply look up games that are based off the minecraft crafting with blocks and throw zombies into the mix.
As I said, I’ve been supporting the game since it’s early inception, but left off for quite awhile once my computer starting showing signs of compromise when connecting to online servers. Given the alpha state of the game [even today] I figured they just needed time to get their code in order.
Fast forward to lately, and given the fact I’d planned to rewipe my PC shortly, I threw her in and started getting my gaming binge on.
After awhile I found a neat server with a bunch of people that have presence on a lot of survival games [ark, some pirate thing, this, etc.] and decided that since they’ve seem to got a name to defend they should be safe[ish]/[er] than most.
These guys have been busy, they’ve got people that dive into the XML and item sets to be able to turn on stuff that the official release hasn’t enabled, but the code is present and good to go. Along with that, they seem to of put together there own ICON sets which is heavily advertised to download and install.
As any good security person is aware, this is an excellent attack surface and has inspired me to dust off some of my skills that I’ve been letting gather dust.
My plan is to setup my machine to do some automated fuzzing. First I want to figure out how to do some testing of the icon rendering to see if there’s anything to dive into for potential crashes and then move onto [what I’m thinking] will be the easier thing and do network based fuzzing from an emulated server.
the network fuzzing I’ll probably just try to setup Boo/sully fuzzing and go from there given I’ve prior experience in that arena [OSCE study]
The thing that has me stumped, is the icon fuzzing. The game itself takes quite a bit of time to start / restart / get into a new world and each icon to fuzz would [I’m guessing based off of play experience] require a restart of the game.
The icons can be in JPG / GIF / BMP / [maybe] TIFF.
So this is where I seek the experience of the others! If someone can point me in the direction of where to begin, I’d highly appreciate it.