Highly Performant & Scalable Ultima Online Server Emulator
https://www.modernuo.com
c-sharpcsharpcsharp-coredotnetdotnet-coreemulatorgplgplv3mmommo-enginemmorpgmmorpg-serveronlinerpgrunuoserverservuoultimaultima-onlineuo
dce677b8c3
The repair retried a failed verify against username + plainPassword, and
nothing in a stored hash distinguishes "this is H(username + password)
because SetPassword was buggy" from "this password merely begins with the
username". With repairMigratedPasswords on, that is a cheap targeted attack
against every account on the shard:
Account 'bob', real password 'bob123', stored correctly as argon2("bob123").
Someone submits '123'. The primary verify against "123" fails. The repair
verifies "bob" + "123" == "bob123" and succeeds, forceRehash rewrites the
credential to argon2("123"), and the real owner can never log in again --
their password has been silently replaced by the attacker's guess.
Passwords that start with the username are common enough that this is worth
doing at scale, and it is silent: the victim only finds out later.
Add a second gate on top of the shard-wide switch. The account must also
carry a RepairMigratedPassword tag, which an operator sets from the admin
gump (Account Details -> Tags -> Add Tag) for someone who has actually
reported being locked out. That reduces exposure from every account on the
shard to one an operator deliberately marked, and in the real workflow the
collision cannot arise at all: a colliding account still logs in fine, so
nobody would ever mark it. The tag is removed on a successful repair, so the
window closes for that account immediately.
Also repair the other corruption shape. The old guard short-circuited on
UsesUsernamePhrase(_passwordAlgorithm), so SHA1/SHA2 accounts were never
repaired -- but SetPassword also runs from the Account(string, string)
constructor before _passwordAlgorithm is assigned, so an account created
while CurrentAlgorithm was SHA1 or SHA2 holds H(bare password) tagged
SHA1/SHA2, whose rule adds the username. Those accounts could never log in
at all and the repair declined to rescue them. RepairPhrase now tries
whichever rule the stored algorithm does not use, covering both directions.
That direction has no truncation collision -- exploiting it would need the
attacker to already know the real password -- but it stays behind both gates.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
||
|---|---|---|
| .config | ||
| .github | ||
| branding | ||
| dev-docs | ||
| Distribution/Data | ||
| Projects | ||
| tools | ||
| .cursorrules | ||
| .editorconfig | ||
| .gitattributes | ||
| .gitignore | ||
| AGENTS.md | ||
| azure-pipelines.yml | ||
| CLAUDE.md | ||
| CODE_OF_CONDUCT.md | ||
| CONTRIBUTING.md | ||
| Directory.Build.props | ||
| FAQ.md | ||
| GEMINI.md | ||
| global.json | ||
| LICENSE | ||
| ModernUO.slnx | ||
| publish.cmd | ||
| publish.ps1 | ||
| publish.sh | ||
| README.md | ||
| rider-settings.zip | ||
| Rules.ruleset | ||
| SPONSORS.md | ||
| stylecop.json | ||
| THIRD-PARTY-NOTICES | ||
| version.json | ||
ModernUO 
Ultima Online Server Emulator for the modern era!
Requirements
Supported Operating Systems
Required Frameworks
All Operating Systems
Windows
Development
Supported IDEs
Getting Started
- Install prerequisite requirements
- Clone this repository (or download the latest):
git clone https://github.com/modernuo/ModernUO.git
- Open
ModernUO.slnto start developing
Building/Publishing
Interactive Mode (Recommended for new users)
Run ./publish.cmd (Windows) or ./publish.sh (Linux/macOS) with no arguments to launch the guided build tool. It will:
- Check prerequisites (.NET SDK, native libraries)
- Walk you through configuration and platform selection
- Build and publish the server to the
Distributiondirectory - Show deployment instructions for cross-compiled builds
Command Line
./publish.cmd [release|debug] [os] [arch]
os- Supported operating systemsarchx64- Intel/AMD 64-bitarm64- ARM 64-bit
Linux Prerequisites
Fedora, CentOS, RHEL, AlmaLinux, Rocky, etc
dnf upgrade --refresh -y
# RHEL-family distributions (CentOS Stream, AlmaLinux, Rocky, RHEL) need CRB and EPEL enabled.
# Fedora skips this block.
dnf install -y dnf-plugins-core
dnf config-manager --set-enabled crb
dnf install -y epel-release
# Prerequisites
dnf install -y findutils libicu libdeflate libargon2 tzdata
Ubuntu, Debian, etc
apt-get update -y
# The ICU runtime package carries the ABI version in its name (libicu74, libicu76, …) and has no
# stable alias, so match it by pattern rather than pinning a release-specific name.
apt-get install -y '^libicu[0-9]+$' libdeflate0 libargon2-1 tzdata
Only the runtime libraries are needed — the -dev/-devel packages are not. Run
./build-tool --check-prereqs to check the current machine and print the exact packages your
release needs.
zstd is not listed because ZstdNet bundles libzstd for every platform, and liburing is not
listed because IORingGroup issues io_uring syscalls directly.
If the shard's configured time zone is a legacy alias such as US/Eastern, Debian 12 and Ubuntu
24.04 also need tzdata-legacy. See Platform Prerequisites
for what each dependency is for and what breaks without it.
OSX Requirements
brew install icu4c libdeflate argon2
Running the Server
- Follow the publish instructions
- The
Distributiondirectory is portable — copy it to your production server for deployment - Run
ModernUO.exeordotnet ModernUO.dllfrom theDistributiondirectory - On first run, the server will prompt you to configure game data file locations
Troubleshooting / FAQ
- See FAQ
Want to sponsor?
Thank you for supporting us! You can find out how by visiting the sponsors page.
Collaborators
Thanks
- RunUO Team & Community
- Voxpire, the ServUO Team & Community
- Karasho, Jaedan and the ClassicUO Community
Development Tools & Plugins provided with ♥ by
Code Signing Policy
Free code signing provided by SignPath.io, certificate by SignPath Foundation.
This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it
Teams & Roles
Approvers & Committers: Development Team