Access violation on a gameserver program

[Kikaida]

I am trying to play a networked game and I have found that when someone uses a simple telnet command and telnets to my server instead of using the game client, the game server crashes. I only have the bins for the exe and not the source code, so I am attempting to fix it with Ollydbg and HexWorkshop.

I ran the program from within Ollydbg and then telnetted to it myself. It crashed and gave me "Access Violation when reading[A7738384] - use shift+F7 to pass exception to program". It highlighted the line 0047B20E . I copied and pasted here a sample of that area.

0047B1F8 |> 837D F4 00 /CMP DWORD PTR SS:[EBP-C],0
0047B1FC |. 0F85 A1000000 |JNZ GServer.0047B2A3
0047B202 |. 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4]
0047B205 |. 8B82 F0CC0E00 |MOV EAX,DWORD PTR DS:[EDX+ECCF0]
0047B20B |. 8B4D FC |MOV ECX,DWORD PTR SS :[EBP-4]
0047B20E |. 83BC81 9CCC0E0>|CMP DWORD PTR DS :[ECX+EAX*4+ECC9C],0
0047B216 |. 74 1F |JE SHORT GServer.0047B237

How do i find the exact value or instruction that is causing the crashing, by following this clue?

Thanks.

 

[JasonDeckard]

I would guess that [ECX+EAX*4+ECC9C] equals A7738384.

Try using Ethereal (or sniffer of your choice) to compare packets sent by the game client against the packets sent when telnet initially connects. Possibly, the game server is expecting a message length but does no input validation on the values it receives.