D2GSErrorHandle: Unhandled exception occurred

Its not necessary I am going to explain my theory

If you have Linux host you have a firewall at very low level integrated in the system, not like windows (more higher level).-
In this case you can filter packets incoming from your Ethernet/Wifi connection by hex code to a specific port or the whole connection.-

Ok, so... if we have a PVPGN network inside the host working like we now - The only file you still need its the D2GS - This file only run in Windows.-
But if you install a Virtual Machine for example a Windows 7 32 bits in Virtualbox - And the network adapter of the virtual machine you set to NAT - Your connection will be always behind the host conection in this case controled by the firewall (iptables) in theory if you drop the packet from the host connection this will not affect the D2GS process at all.-
Im going to work this and see what happend - I think probably this will be a little tricky accepting people from outside (Internet) because the NAT rules... but we know the D2GS accept specific port from outside, and in the case of "local" ports this not affect at all.-

Good you detect in automatic way the attacks ? - Its a Firewall or a full router like mikrotik? - Looks like Komodo firewall

I see, Well im going to try to filter via IPTables the Hex code of the attack, that the only way to make crash D2GS I know as far - If there another Hex codes, can be loaded too.-

No because the firewall of Windows its not low level but i am going to try to make a guide for any person its simple.-
Its not imposible I mean there are free applications to catch packets - But windows its not the best platform for that type of filtering

------ WORKS!!!! ------

I filter the Hex Code, with Iptables, and send the packet bum! not crash de D2GS and users dont feel nothing.-
I need more information but Work!

[video]

Great work!  This is awesome.. hopefully we'll all be able to finally solve this.

I guess next question would be - are there different packets that can be sent to crash D2GS.  I assume we'd need a different line in our IPTables config to block each one.

Good, in private Harpy can you send me a example? Dont know nothing about hex code or programing.-
I know iptable accept comodin Like a few Hex code, and then everything else drop.-

Allow ASCI code and Binary too.-

Thats how i made it - The information I dont know its if the Hex code I load in the IPTABLE its OK - I send you the code in private.-

Added: 03.08.2017 22:04

HarpyWar - Show my about the 4 bytes its in basic the 4 first pairs of code.-
Tomorrow at home I will set up the Hex Code in the IPtable using only 4 bytes and try to send hack combinations to see if the iptables drop well.-
If that works - I will make final guide to make it work in linux.-
Of course in the case somebody know how to drop a hex packet in Windows, will be more better to have everything in the same front end.-

Well i was thinking a bit about, and I have some information about.-

First, my English its not the best im from Argentina.-
Ok - So, lets see - In Linux inside the system at Kernel level you have a firewall we are going to call it "IPTables" so... everything related to LAN (internet / LAN) pass through that firewall.-
By default its all allowed for normal using.-

The difference it's how Linux firewall works compared to Windows.-
Windows firewalls works at Network and transport level- That's why you can drop ports, process, etc.-
Linux firewall works at application level, thats how you can "examinate" the information of every packet.-
This all in general lines

It's more deep the Linux firewall - The Windows firewall it's not bad, I mean for normal or server applications go OK - This is a very specific situation, usually this work its made by proxies, for example pfsense (linux based) Mikrotik (linux based) etc.-

---

The question it's we can do something similar in Windows? - Yes but my understanding of programming and all that it's bad - I only work in servers and infrastructure area.-
How? - Well the Idea of HarpyWar it's good, with a Sniffer - You can catch a packet (late) make a examination and detect the code, then send that IP to firewall (network level) and avoid any hack from that IP.-
But you will not avoid the hack, and attack IP can change anytime.-

The best resource I find, is this

www.nirsoft.net/utils/smsniff.html

---

The best solution I find at this moment is this:

Run a Linux host, any distribution you want - put a virtual machine (VirtualBox / VMWare) with any OS you want XP will do the trick - put the network of the virtual machine in NAT mode, set in the NAT rule of the VirtualBox / VMWare - Port 4000 TCP/UDP from any host, to any host.-
Install PVPGN in the linux host run everything OK and MySQL too (bnetd / d2gc and d2dbs) configure the address translation of D2GS - Im not sure if the NAT IP (10.1.1.2 for example) or put the local IP and the NAT will do the trick I need test that tomorrow.-
Finally the IP Table rule in the Host and ready to go.

So you have everything in a native environment - A powerfull Firewall and probably will be stable.-

--

I know in practice we want use Windows because probably you run more things - If you are using a hosting, you probably ask to Tech support to drop that Hex code to your IP of your Windows server because usually hosting have a proxy behind, router, speed control, DDOS avoid, etc.-

-

But this is the only easy situation I can Find - Probably a D2GS emulation in Wine works too.- and that will avoid you to use a virtual machine, and a NAT rule.-

Added: 04.08.2017 12:41

Hi guys,

Well today i finish a few more test of the IPTable anti hack -

First the hack its the first 4 hex values example (this not the hack funny girls)

F3 F3 FA FA 00 00 00 00 00

The process D2GS crash using the first "F3 F3" you can add more random code but the first 4 digits are the crash.-
In this example F3 F3 make the crash - So, If I put in the packet F3 F2 will not be detected by the IP Table but, that will not crash the process becase its not the "hack code".-

So GOOD news.-
I have the code for the IP Table rule, using the first 4 digits, and will use regular expression to see the first 4 digits and ignore any length of code or combination.-

---

I will implement this in my server, in a real enviroment using external conections and all that stuff - And the attack my self (hell yeah!) - And see what happend.-
If this work, I want to talk with you @harpyWar and @Meanski - And see how we can inform this fix, because the IPTable rule will expose the hack - And the people dont have Linux will no be safe.-

Added: 04.08.2017 13:26

By the way if this works fine - Im going to put the D2GS in a Linux with Wine and see estability - Because if that works - You can do the same using Windows host, create a full PVPGN network in Windows, put a Virtual Machine with linux (a tiny version) install Wine, configurate - Run D2GS - And put the IP Table rule - that will protect you D2GS process - And ready to go.-
Because for NAT its the same
If this Idea Works Fine - I can create a virtual machine of 300 mb with a Tiny Linux - And upload to test in any Windows Enviroment with D2GS, loaded, you only will need to change the IP in the .reg file - And will have the IP Table rule ready.

Yes well that's the base, but like say in the post it's intensive and can make a mess inside the environment (crash).-
So I start to make a new rule, taking in mind the real situation (players, connections).-

Good News

At the moment the D2GS emulated with the modify version of Wine 2.0.1 with the socket.c edited by HarpyWar works fine.-
The last final step its create the Tiny Linux to be used in VMWare or VirtualBox.-
So you are going to have your own proxy for the D2GS process inside Windows.-

Yes!.

You have two options

1 - Linux HOST = PVPGN in Linux (with the rule in the IPTable) + Virtual Machine with Windows inside running only D2GS using a NAT connection - This pass throuth the iptables because its inside linux HOST.-

2 - Windows HOST = PVPGN in Windows + Virtual Machine with a Tiny Linux inside running only D2GS (emulating with Wine) using NAT connection the Linux with the IPTable rule.-

---

Im going to prepare the second option, because the first it's very easy, but not to much people have the PVPGN in Linux environments, more in Windows.-
And if I create a virtual machine with the tiny Linux I can upload pre-configurated, because it's universal.-
You only will need to change a few parameters, like password, D2GS ip, and ready to go.-

Sure - Send it - And we can improve if is posible

Added: 05.08.2017 16:54

Ok - It's working - Windows Enviroment with a virtual machine in NAT with Linux, D2GS it's emulated with Wine and sock.c modify by HarpyWar - you can use Telnet too in the D2GS port 8888.-
And protected with the IPTable rule to avoid the HEX hack.-

Image:
i.imgur.com/qIEyuws.jpg

--

The complete .rar with the virtual machine (VirtualBox) 2.20 GB extracted ready to use 6.60 GB - I need to tweak a few things and prepare the guide, very easy - Will have D2GS 1.13c and the Diablo II files inside - Of course you can change it, and you will have all the information in the guide - If you want to do it by your self with another Linux version, or Virtual Machine system.-

You only need 512 MB of Ram dedicated to the virtual machine, and only one CPU core setup.-
Will run a Debian version with Graphical Enviroment - I decide to left it with GUI because, a lot of users don't really know how to use the Terminal and comands in Linux.-

Good News

FeoFilakkt

Show me the flood hack, its using the chat over the head of the players

! text

So using the IPTABLES we block the ! function in the chat - The user will be kicked and they cant clone items (no roll back)
Its a extreme solution - Its optional of course.-

But With this 2 rules you avoid the usual RedVex scripts and, the common hack of the D2GS

Added: 07.08.2017 00:25

Well the Machine its ready, and tonight I will Upload - And create a New post with instructions, video - And all that Stuff.-

Alright team, looks like I've solved the attacks which were causing the c00000005 errors but now I'm dealing with a daily crash and this is found in the D2-XXXXXXX.log:

UNHANDLED EXCEPTION: BREAKPOINT (80000003)

In any testing with the new DieTesseract block method, did anyone see this error or were you all trying to fix the c0000005 one?

I kinda beg to differ on that front. The c00000005 error does and happens frequently client side but the only time I've ever seen it is when the server is being attacked.  You may be right in some regards but after I found the attacking IP and banned it, we haven't had any errors that produces the c00000005 error, and the way that Harpy taught me to crash the server, that hex code creates that error (which I've tested and confirmed).

Since banning a few IP ranges my crashes have gone from 3-5 a day to 1 a day and only the breakpoint error.

Yes.  Hex code = c00000005, I can do this every time and it produces this error.

Another thought kXander - our server was fine for years, D2GS shouldn't crash much at all.  Maybe once every 1-2 weeks and generally it used to be a soft crash, aka the D2GS process is still there, it just gets stuck.  Although I am interested in using a default patch file and seeing if the crashes are still the same, something for me to investigate further.

Tonight I will test the redvex over the head 'birthday' crash and see what error that produces.

Correct I know your method works well.  Just trying to figure out this BREAKPOINT error next

Sorry - saw your post edit just now.  c00000005 isn't the HEX, its the error code that appears once it crashes.

I did not, sorry mate

Niceee ;D
Do you have a list of the modifications you made to avoid failures/crashes ?