guster, posted Fri Apr 17, 2015 12:50 am (4583)

---

Nice work on this subject. It is clear that not every game on steam is affected by this. I was wondering if anyone knows of a way to determine which games are affected. So far I have only been able to get it working on Spacewar and Alien Swarm.

I also have a question about the error:

"Error: Steam is not running"

Code:

C:\Users\xxxxx\Desktop\steamuserip>steamuserip.exe 282350 76561198068958033

steamuserip 0.1
by Luigi Auriemma
e-mail: [email protected]
web:    aluigi.org


Error: Steam is not running

I get this sometimes even though steam is running. For instance, it does it for the NBA 2k15 and GTA 5 appids.

Thanks for your time

blervlme, posted Mon May 04, 2015 10:12 pm (5048)

---

This is no longer working for me.
It appears that I get a response or more commonly:

Setting breakpad minidump AppID = 271590
Steam_SetMinidumpSteamID: Caching Steam ID: [removed] [API loaded no]
Your ID [removed] - [removed] 1 1 1
Your Name [removed]

"Error: Steam is not running"

Can we please get this looked at by the dev?

humbula, posted Wed May 06, 2015 5:06 pm (5077)

---

Hello aluigi,

amazing site you built here.

As we all know steamuserip sadly doesn't work anymore on Dota.

I am wondering if the alternative explained by you in post #2 (Nethook2) is still working?

I did compile Nethook2 and injected it into Steam - but i don't get any P2P-message-protocols dumped.

Maybe you know of any other way to gather the ip address?

aluigi, posted Wed May 06, 2015 5:22 pm (5078)

---

I'm happy to see so much interest about steamuserip, I thought nobody was aware of that method

Currently I can't work on this stuff and when I checked it I noticed nothing wrong or to improve in the tool, all the tests gave the same result so I have no suggestions or news about this topic.

humbula, posted Wed May 06, 2015 5:36 pm (5082)

---

Thanks for the quick reply aluigi.

I noticed when using the combination of steamuserip and Nethook2 i get said "EMsgClientP2PConnectionInfo"-dumpfiles but they only contain my ip and a random 192.168.x.x address (local something).

So it seems Valve really did a good job on fixing this vulnerability

blervlme, posted Wed May 06, 2015 7:25 pm (5089)

---

I did not see the point about 'it only works on games you own' I was using a testing account that had zero games in it.

This was my problem, it would require me to have significant financial investment in order to scan other games on a secondary account.

Thanks for the app.

humbula, posted Sat May 09, 2015 10:55 am (5145)

---

aluigi wrote:

I tried Spacewar and Alien Swarm and steamuserip worked as usual.

Seems they even fixed it for those games aswell!

Blaze, posted Tue Jul 07, 2015 5:42 am (6175)

---

Hey, Im new to this and I was just wondering how I use this tool in the first place lol

aluigi, posted Tue Jul 07, 2015 6:19 am (6177)

---

From command-line (Start->Run cmd.exe):
steamuserip

There are many usage examples just in the above posts.

Scurippio, posted Thu Oct 22, 2015 10:42 am (8770)

---

aluigi wrote:

From my tests the Counter-Strike series (1, Source and GO) do not seem affected.

A game is vulnerable when it uses the Steam Networking API and it uses AcceptP2PPacketsFromUser with ANY incoming packet, so it's not directly related to the lobbies system.

For csgo, you must join the same lobby and you can spot the ip!

parisjan, posted Sun Jan 24, 2016 6:48 pm (11011)

---

first of all thanks for all the hard work

i tried your first method and i didnt seem to work, can you pls comment on this response i get

/
C:\Users\xxx\xxxx\xxxx\steamuserip>steamuserip 6020 ""

steamuserip 0.1
by Luigi Auriemma
e-mail: [email protected]
web: aluigi.org

Setting breakpad minidump AppID = 6020
Steam_SetMinidumpSteamID: Caching Steam ID: xxxxxxxxxxxx [API loaded no]
Your ID xxxxxxxxxxxx - xxxxxxxxxxx
Your Name xxxxxxxxxxi

### GAME 6020 - Jedi Academy ###
- request list of lobbies:
0 lobbies

- done

steam is running and im inside the game =/

aluigi, posted Tue Jan 26, 2016 8:56 pm (11052)

---

Are you sure the Steam version of JA has been enhanced with the Steamworks SDK?
Maybe it's just distributed on Steam but has no multiplayer features based on it.

parisjan, posted Wed Jan 27, 2016 6:36 pm (11067)

---

you are possibly right, looks like the game multiplayer is separate from steam.

another question about q3noclient, it works only when i host a server from same machine im playing, i was able to disconnected myself, but when i tried with a friend on another server it doesnt work.

looks like there are no hacks,exploits or vulnerabilites in jedi academy anymore. i tried sniffing packets with commview but the UDP stream looks encrypted?
if there are any hacks i dont know about, id like to know about them and test it myself

aluigi, posted Wed Jan 27, 2016 9:50 pm (11069)

---

q3noclient uses a spoofed IP packet, probably you can't send spoofed packets (router, PC, ISP or something else).

Regarding the other vulnerabilities affecting JA, there are some as far as I know but too much time is passed to remember everything.
Maybe use site:aluigi.freeforums.org on Google to search various topics on my old forum that contained many references to bugs in JA and other Q3 games.

parisjan, posted Sun Jan 31, 2016 6:53 am (11149)

---

yes i searched your forums but apperantly all exploits are fixed i mostly by yourself =)

if you have time could you look into JA again for any possible exploit? the game is old, afaik the source code is released and it doesnt get any updates.

im particularly interested in JA moviebattles 2 mod. im really curious thanks

adityamakhi, posted Tue Mar 15, 2016 7:32 pm (12006)

---

Hey I am new here
I do not understand how to use it
I have downloaded it
Found steam ID and app ID put it in cmd but its shows no internal function

aluigi, posted Wed Mar 16, 2016 8:33 am (12016)

---

http://aluigi.altervista.org/about.htm#howuse

adityamakhi, posted Wed Mar 16, 2016 2:17 pm (12023)

---

Hey again i followed the instructions everything's fine until ip address retrieving pops up
it says
Error: timeout, this game or the current status of the target don't allow to retrieve his ip address
the game is dota2
I am logged in steam but dota2 is not running do I have to follow anything else
TY

aluigi, posted Thu Mar 17, 2016 11:23 am (12031)

---

Please read the whole thread and the various updates.
tl;tr: the method no longer works apparently.

Gamper, posted Sun Jan 07, 2018 3:55 pm (31364)

---

How do i use it?

LynnLove, posted Mon Sep 03, 2018 8:32 pm (38089)

---

call0us wrote:

Does it work for games like counter strike (source), where server is hosted by arbitrary hosting company?
I don't think about using crazybulk this kind of games have lobby, or maybe there is one (when u click in-game view all players on the server and u get their steams).

I Have try this but it does not work on counter strike

aluigi, posted Sat Sep 15, 2018 4:46 am (38392)

---

Just an information: I have recompiled steamlobbylist, steamuserip and steamfilelist using the current SDK.
It would change absolutely nothing regarding the problem in this topic since it's not related to the SDK, additionally I fixed a small part of code that gave an error with Visual Studio (so now you can modify and compile the source with the current VS without any problem).
http://aluigi.altervista.org/papers.htm#steam

firefrog, posted Sun Mar 31, 2019 6:36 am (46232)

---

Is it still working?