Recent Topics

Ads

Network alert after new Patch

Problems installing or downloading the game? Check the Install Guide first.
Forum rules
READ THE INSTALL GUIDE BEFORE YOU POST IN THIS SUBFORUM.

The stickies exist to handle common queries. Save our time and yours by reading them first.

Thank you.
draklion
Posts: 3

Network alert after new Patch

Post#1 » Fri Apr 16, 2021 1:34 am

Hi,

I've been trying to download the new patch but have noticed that every time I do it gets stuck at 60-75% and isn't able to proceed and throwing the following error:
Disconnected from server. Error: System.Net.Sockets.SocketException (0x80004005): A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond
at System.Net.Sockets.Socket.EndReceive(IAsyncResult asyncResult)
at RoRLauncher.Client.Ge8xYjqQn4v3kHgSkAq(Object , Object )
at RoRLauncher.Client.Nimgt80cKi(Object )
Since this is fairly odd behaviour I decided to check my network security device to see if there was anything being blocked.
After checking I found that there's an inbound connection from France on IP/Port 46.105.54.77:8000 to my LAN each time I ran the launcher trying to execute some shellcode with the alert below being generated.
Threat Management Alert 1: Executable Code was Detected. Signature GPL SHELLCODE x86 0xEB0C NOOP. From: 46.105.54.77:8000, to: 192.168.1.102:51491, protocol: TCP
I wanted to know if anyone else is having issues patching recently and if they are seeing similar alerts if they are running any network security products.

Thanks
Draklion

Ads
Rekkerr
Posts: 22

Re: Network alert after new Patch

Post#2 » Fri Apr 16, 2021 2:05 am

Yes, I'm getting the same error. It triggers on the downloading 2/7 point of the patch

Rekkerr
Posts: 22

Re: Network alert after new Patch

Post#3 » Fri Apr 16, 2021 2:48 am

I had to allow it on my firewall to get patch to complete

Numeriku
Posts: 24

Re: Network alert after new Patch

Post#4 » Fri Apr 16, 2021 4:28 am

draklion wrote: Fri Apr 16, 2021 1:34 am Hi,

I've been trying to download the new patch but have noticed that every time I do it gets stuck at 60-75% and isn't able to proceed and throwing the following error:
Disconnected from server. Error: System.Net.Sockets.SocketException (0x80004005): A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond
at System.Net.Sockets.Socket.EndReceive(IAsyncResult asyncResult)
at RoRLauncher.Client.Ge8xYjqQn4v3kHgSkAq(Object , Object )
at RoRLauncher.Client.Nimgt80cKi(Object )
Since this is fairly odd behaviour I decided to check my network security device to see if there was anything being blocked.
After checking I found that there's an inbound connection from France on IP/Port 46.105.54.77:8000 to my LAN each time I ran the launcher trying to execute some shellcode with the alert below being generated.
Threat Management Alert 1: Executable Code was Detected. Signature GPL SHELLCODE x86 0xEB0C NOOP. From: 46.105.54.77:8000, to: 192.168.1.102:51491, protocol: TCP
I wanted to know if anyone else is having issues patching recently and if they are seeing similar alerts if they are running any network security products.

Thanks
Draklion
That is not a trojan, the server is located in france.

User avatar
warlover
Posts: 381

Re: Network alert after new Patch

Post#5 » Fri Apr 16, 2021 4:58 am

Turn off your virus protection while you update

draklion
Posts: 3

Re: Network alert after new Patch

Post#6 » Fri Apr 16, 2021 5:01 am

Numeriku wrote: Fri Apr 16, 2021 4:28 am
draklion wrote: Fri Apr 16, 2021 1:34 am Hi,

I've been trying to download the new patch but have noticed that every time I do it gets stuck at 60-75% and isn't able to proceed and throwing the following error:
Disconnected from server. Error: System.Net.Sockets.SocketException (0x80004005): A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond
at System.Net.Sockets.Socket.EndReceive(IAsyncResult asyncResult)
at RoRLauncher.Client.Ge8xYjqQn4v3kHgSkAq(Object , Object )
at RoRLauncher.Client.Nimgt80cKi(Object )
Since this is fairly odd behaviour I decided to check my network security device to see if there was anything being blocked.
After checking I found that there's an inbound connection from France on IP/Port 46.105.54.77:8000 to my LAN each time I ran the launcher trying to execute some shellcode with the alert below being generated.
Threat Management Alert 1: Executable Code was Detected. Signature GPL SHELLCODE x86 0xEB0C NOOP. From: 46.105.54.77:8000, to: 192.168.1.102:51491, protocol: TCP
I wanted to know if anyone else is having issues patching recently and if they are seeing similar alerts if they are running any network security products.

Thanks
Draklion
That is not a trojan, the server is located in france.
My main concern is that it's an inbound connection being initiated rather than an outbound connection from my PC. Regarding general networking security you don't allow inbound connections unless you're hosting content which the client is requesting, even then this is usually hosted in a walled off part of the network (DMZ) to prevent unauthorised connections into your private network.

In this case we are the client requesting data from the server in France, generally this operates using TCP outbound (from the client, i.e. the launcher) first to establish the connection which then uses the same channel to download/transfer the content to the local host.

There's likely something i'm not understanding correctly here so i'm just exercising caution as this isn't behaviour that I'd generally see.

draklion
Posts: 3

Re: Network alert after new Patch

Post#7 » Fri Apr 16, 2021 5:02 am

warlover wrote: Fri Apr 16, 2021 4:58 am Turn off your virus protection while you update
This isn't good advice for those of us who are security conscious.

Numeriku
Posts: 24

Re: Network alert after new Patch

Post#8 » Fri Apr 16, 2021 5:08 am

draklion wrote: Fri Apr 16, 2021 5:02 am
warlover wrote: Fri Apr 16, 2021 4:58 am Turn off your virus protection while you update
This isn't good advice for those of us who are security conscious.

Its that or don't play here. Here is a quote from one of the gm here.
Edit - I have played this game since 2017 and have not encountered some sort of stolen credit cards and malware issues on my pc.
Notes about Antivirus programs, Firewalls, Hardware Routers, and other security programs
Spoiler:
Some of these can be more aggressive than others, and in particular the RORLauncher has been flagged in the past. Partially because this is not a well known application in the wild, and partially because of how it works.
The Launcher manipulates objects in memory to make the game work with our server.
Some aggressive antiviruses automatically deem this to be virus-like behavior.
They check with their database of approved applications when they see this, and if they don't find our application in there, it gets a Generic flag and is sometimes blocked or damaged.

Because of this, we have to recommend that when you download with the Torrent, that you have your security disabled, and then whitelist the folder before turning it all back on.

We have repeatedly reached out to many AV companies and databases, any who responded accepted it as clean, and many others simply never responded leaving it with that Generic tag.

As you can see here VirusTotal which is a very common database, is showing the launcher as clean in the vast majority of AV's. However, old definitions even from a company that doesn't have us flagged, can still cause problems.

TL;DR - The RORLauncher is safe. The torrent is safe. Please disable your AV BEFORE downloading, and whitelist the folder BEFORE turning it back on to prevent any potential issues.

Ads
User avatar
warlover
Posts: 381

Re: Network alert after new Patch

Post#9 » Fri Apr 16, 2021 12:54 pm

draklion wrote: Fri Apr 16, 2021 5:02 am
warlover wrote: Fri Apr 16, 2021 4:58 am Turn off your virus protection while you update
This isn't good advice for those of us who are security conscious.
it works turn it back on after

User avatar
wargrimnir
Head Game Master
Posts: 8275
Contact:

Re: Network alert after new Patch

Post#10 » Fri Apr 16, 2021 12:57 pm

It's connecting to the server to check for patches. The server is in France.
Image
[email protected] for exploits and cheaters.
grimnir.me Some old WAR blog

Who is online

Users browsing this forum: No registered users and 4 guests