Issue register
Every problem found while unpacking and decompiling FlandersMod, with evidence and a fix. Grouped by component. IDs are stable so you can refer to them elsewhere.
Severity is about impact if the thing goes wrong. Confidence is how sure I am the
issue is real (see README). A string address like 0044c108 is a literal you can find in
that binary's strings.txt; an FUN_… is a function in global/*.c.
Launcher — FlandersMod.exe (LAUNCH-*)
| ID | Sev | Conf | Issue |
|---|---|---|---|
| LAUNCH-1 | Med | Confirmed | In-memory process patching of Simpsons.exe. Imports OpenProcess/WriteProcessMemory/VirtualProtectEx/ResumeThread. Fragile across game builds and the kind of thing AV flags as injection. No code-signing on the exe. |
| LAUNCH-2 | Med | Likely | PowerShell self-delete on exit (Wait-Process -Id {0} … Remove-Item -LiteralPath … -Recurse -Force). -Recurse -Force against a path built from runtime strings is dangerous if the base path is ever wrong or attacker-influenced — it deletes whatever it resolves to, silently (-ErrorAction SilentlyContinue). Verify the path is always the intended data folder. |
| LAUNCH-3 | Low | Confirmed | Public-IP lookup to a third party (api.ipify.org) when hosting. Minor privacy/availability coupling; fails closed if ipify is down. |
| LAUNCH-4 | Low | Confirmed | Full C# not in the repo. Only metadata/strings were extracted. Decompile with ILSpy/dnSpyEx for review of the launcher logic itself. |
DLL — FlandersMP.dll (DLL-*)
| ID | Sev | Conf | Issue |
|---|---|---|---|
| DLL-1 | High | Confirmed | d3d8.dll hijack. The DLL exports the real Direct3D 8 entry points so the game loads it as d3d8.dll. Legitimate for a graphics mod, but it's a classic DLL-search-order hijack pattern: anything dropped as d3d8.dll next to the game runs in-process. Users must trust the source. No integrity check on the DLL itself. |
| DLL-2 | High | Confirmed | Version-locked byte patching. It patches the game at hard-coded signature offsets and bails with hook site bytes mismatch (%02X…) - unsupported Simpsons.exe on any build it doesn't recognise (Game version: %s (sig %08X)). Any patched/localised/re-release EXE breaks it, and a wrong match would corrupt the game's code. Brittle by design. |
| DLL-3 | High | Confirmed | Debug memory-poke console left in the build (FUN_… in functions_000.c). Env FLANDERSMP_WWDEBUG + a debug_cmd.txt / debug_cmd_%ls.txt file enable commands incl. poke %c %s+%X = %f and poke %c %63s %f — i.e. write an arbitrary float to an arbitrary module+offset in the live game. Also fakepad, probe, texdump, markers. It's gated (off unless the env var and file exist), but shipping a write-anywhere debug hook in a release is a footgun. Strip it from release builds or compile it out. |
| DLL-4 | Med | Confirmed | Heavy unchecked-buffer surface. In the DLL: memcpy ×112, strncpy ×27, strcpy ×3, strcat ×1, plus sprintf-family via the hooks. strcpy/strcat have no bounds; strncpy doesn't null-terminate. Combined with network input (DLL-5) these are the spots to audit for overflow. Needs per-site review. |
| DLL-5 | Med | Needs verification | Parses UDP packets from the server/peers (sendto, HUD/chat/scoreboard update paths). I did not trace the receive/parse path end-to-end. Any fixed-size copy of a length/field taken from a packet is a remote memory-safety risk. Audit the packet handlers before exposing a client to untrusted servers. |
| DLL-6 | Low | Confirmed | Many silent feature-failure paths. Strings show hook FAILED, Wheel disabled: assets failed to load, CreateTexture(atlas) failed, CopyRects … blur disabled, spawn failed … blacklisting model, DirectSound … one sound at a time. Individually fine (graceful degradation), but there's no user-facing surfacing — failures only hit a debug/log path, so a broken install looks "half working" with no explanation. |
| DLL-7 | Low | Likely | DirectInput hook assumes layout when load order is unlucky (format assumed standard (SetDataFormat came before the hook), guessed from its objects). Mouse-aim can silently not work (FAILED (keys still work, no mouse aim)). Order-dependent, hard to reproduce. |
Server — FlandersMP_Server.exe (SRV-*)
| ID | Sev | Conf | Issue |
|---|---|---|---|
| SRV-1 | High | Needs verification | Announce URL built with raw %s for player-controlled fields. /announce?port=%d&name=%s&players=%d&max=%d&pw=%d&ip=%s&owner=%s — name and owner come from --name/--owner and are formatted straight into the query string. No percent-encoding is visible. A name containing &/=/spaces corrupts the query at best; at worst it's parameter injection into the master worker. Percent-encode every field. |
| SRV-2 | Med | Confirmed | Server password is weak by construction. --password plaintext on the command line; master JSON exposes a "password":%s field and the announce carries pw=%d (a boolean "has password" flag). Rejection is a plain wrong password string compare. Assume the password is advisory, not security. |
| SRV-3 | Med | Confirmed | Hand-rolled HTTP/1.0 master server, CORS *. HTTP/1.0 200 OK … Access-Control-Allow-Origin: *. A bespoke HTTP server reachable over TCP is attack surface; * CORS means any web page can read the list. Request parsing wasn't fully traced — audit the request reader for the usual hand-rolled-HTTP bugs (unbounded read, missing length checks). |
| SRV-4 | Med | Needs verification | UDP game protocol trust. The server tracks cash/kills/deaths/busted per player from UDP input. I didn't confirm server-side validation, so score/state spoofing by a crafted client is plausible until the handlers are checked. UDP is also trivially source-spoofable (no handshake seen). |
| SRV-5 | Low | Confirmed | Master URL is hard-coded (flandersmod-master.flandersmodcanadaservers.workers.dev). Single point of failure, not configurable without a rebuild; master … unreachable warnings are the only fallback. |
| SRV-6 | Low | Confirmed | Port-in-use handling is fatal and terse (ERROR: cannot bind UDP port %d (in use?), same for the master TCP port). No auto-retry / next-port logic. |
Cross-cutting (X-*)
| ID | Sev | Conf | Issue |
|---|---|---|---|
| X-1 | Med | Confirmed | No integrity/signing anywhere. The launcher, DLL, server and the auto-updating master are all unsigned and unverified. The DLL-hijack design (DLL-1) plus the code-carrying .lmlm mods (X-2) means the whole trust model is "run binaries from a stranger." Fine for a hobby mod you built; worth stating loudly for anyone else. |
| X-2 | Med | Confirmed | .lmlm mods can carry code (README, since 0.0.2: "a .lmlm can add whole new features"). Ticking a downloaded mod runs its code in the game process. There's no sandbox mentioned. Treat third-party .lmlm as executables. |
| X-3 | Low | Confirmed | Everything is x86 / 32-bit and tied to a specific Simpsons.exe build. Portability and longevity are limited; a game re-release breaks DLL-2. |
| X-4 | Low | Confirmed | Telemetry to the master (/event?kind=…&name=…) fires on events. Benign, but it's undisclosed network traffic tied to a player name. |
Suggested triage order
- DLL-3 (strip the debug memory-poke from release) — cheap, removes a write-anywhere hook.
- SRV-1 (percent-encode announce fields) — small fix, closes an injection path.
- DLL-5 / SRV-3 / SRV-4 (audit the packet and HTTP parsers) — the real remote surface.
- Everything else is robustness/quality — fix opportunistically.