How a 69 KB Photo Made TF2 Unplayable for 5 Days

[@shounic]

yes video on the gordon freeman patch next

[@hreckward]

gordon freeman in the flesh, or rather in the 2fort

[@loopyslayer63]

what

[@scarletshadowzz]

the what

[@weaboo4444]

let’s goooo, I’m with the science team

[@awesomeman3750]

thank you

[@Arzene22]

The 20terabyte heavy photo is real..

[@igorka5]

warior is real

[@greenhead352]

warrior is real 1324

[@Stookinator]

the warrior

[@stresswaves01]

warrior dot png is real

[@ghostrider4109]

“Warrior”

[@GSFigure]

"What's that?" "its the unmatched power of the Conscientious Objector, officer"

[@TheBestPybro]

"WH-!" "AH-!" WARNING Connection problem auto disconnect in 10

[@johnarbuckle6775]

HL2.exe is not responding

[@the_not_real_bigboss]

"What's that?" "Pornography" *angelic light sfx*

[@JorgetePanete]

it's*

[@GunSpyEnthusiast]

" The Pornography has already breached our defenses. "

[@Treblaine]

"Listen up boy, or 200 petabytes of raw images of your mother will be the second worst thing to happen to you today"

[@someuser4166]

How am I going to stop some big mean mother hubbard from tearing me a structurally superfluous new behind? The answer? use his ram. And if that don't work, use more ram.

[@bagofchips3000]

⁠”Grass grows, birds fly, sun shines, and brotha? I crash people’s games.”

[@Beckwourth]

Pyro: (*Lagging noises*)

[@realdragon]

"One shudders to imagine what inhuman images lie behind those files…"

[@snospoken]

the phone number problem was such a good example

[@ktrn6713]

honestly shounic is great at explaining basic concepts just enough to get right context for the videos

[@TheFinnish1]

im totally stealing that whenever i need to explain data compression

[@hexakon]

@@ktrn6713this and the minecraft inventory slot analogy for RAM were mindblowing

[@WishMakers]

real, i always learn from the internet on new ways to explain complex concepts to people like how compression works

[@snospoken]

@@TheFinnish1 likewise

[@ИванЕфимчук-т7б]

>downloads 69 KB png >look inside >2 GB raw

[@Muhahahahaz]

> ItGetsBigger.PNG

[@rattle_me_bones]

> wires.bmp (2 GB)

[@theredlumas2]

>downloads 2 GB raw data >look inside >69 KB png

[@mrowlsss]

>downloads 69kb.png >looks inside >2.1gb.bmp

[@theredlumas2]

>downloads 69GB png >look inside >2 KB raw

[@Henrik0x7F]

So basically a zip bomb

[@starmaker75]

Basically a internet version of the blitz.

[@stucq]

yes! actually, PNGs and ZIP files both use DEFLATE, designed by Phil Katz, for compression, so this is literally the exact same thing lol

[@6lbs._onion]

Now i wonder what kind of old data exploits are applicable in this version of source

[@uncertaintytoworldpeace3650]

Valve sure are funny guys

[@bbrainstormer2036]

Huh I hadn't thought about it like that, but yeah, that's exactly right

[@Davtwan]

**Uncompresses image.** **It says “you’re stimky.”** **TF2 crashes.**

[@etherian2500]

Stimky

[@Bl0s]

How dare you call me *STIMKY*

[@MichaelYT23]

stinky

[@GunSpyEnthusiast]

Stimky

[@Fennecbutt]

But I'm noooot ;~;

[@nonsensicalhumanoid]

KZbin froze for me exactly when the sign was first pulled out. It took me a few seconds to realize it WASN'T part of a joke.

[@StickMaster500]

People laughed at me when I said the Conscientious Objector was the best weapon in game... _look who's laughing now._

[@HaxxorElite]

I love you StickMaster500

[@iriswav7379]

We will never doubt your words StickMaster500 😔 forgive us

[@richard_returns_IRL]

how are you still alive???

[@EeveeRealSenpai]

They should add a giant ass stick for a all class melee reskin. cuz funny

[@johnarbuckle6775]

What about the Crossing Guard

[@Jaie55]

The phone number explanation was amazing and so accurate

[@ngwoo]

Best layperson's explanation of file compression I've ever heard tbh

[@thespiral936]

2:24 The only thing deadlier than a full team of Sniper bots: Taking out a bugged sign.

[@somnvm37]

NGL, the ability of shounic to explain concepts so simply is insane. The 64bit vs 32bit difference and the phone number explanations are genius.

[@nutitoo]

"...it realizes it and dies" literally me

[@girres43]

What the hell is the context of the gabe clip at the end LOL?

[@papacofi34]

Can't remember 100% but the context was basically > 2011 > Half-Life 3 still not released > Me angry > Call my homie to protest at Valve HQ > 2manpeaceprotest.png > They call the police > ocrap.jpeg > Turns out police are a huge TF2 fan, so he joins the protest > Gabe appears > Gabe calls them to enter Valve HQ and let them play Dota 2 beta > Also, free pizza It was a happy ending story except we still didn't get Half-Life 3

[@riseoftheepicscout454]

please we need to know @shounic

[@Leymora]

@@manitoba-op4jx It's not.

[@ZoofyZoof]

@@manitoba-op4jx AI isn't that good

[@astroboy512]

@@ZoofyZoof I agree that shounic probably didn't use AI for this, but AI is actually good at cloning voices if you use the right tool. I've discovered how good AI is at cloning voices when listening to the episode 144 of Darknet Diaries (a security and privacy podcast). There you can see an example.

[@TheCurle]

Fun fact: until the release of Windows 10 21H2, all versions of Windows 8, 8.1 and 10 were susceptible to the exact same bug when copy-pasting an extremely horizontally large png from one place to another. It tries to unroll the png into a bitmap in memory to allow the destination to convert it into another format if it wants to, but if the image unrolls too large, it writes the clipboard buffer out-of-bounds. We even determined that you could interfere with other process memory that way, so it was given a CVE and patched in a week. Windows 8, 8.1 and 10 are no longer vulnerable to it. I discovered this after making a meme by stitching together large images of regional indicators (the white letters on a blue background) approximately 250k pixels wide and pasting it into Discord. Instant bluescreen, every time. We called the exploit "bluebomb", because blue was the dominant color in the program. There's a 10 line C file to reproduce the error, instantly crashing any vulnerable Windows system upon executon. Good times.

[@renakunisaki]

Used to be you could trigger BSOD for anyone who views a web page with: img src="lol.jpg" width="999999999" height="999999999"

[@stucq]

the phone number problem is such a good example because that's not too far from how DEFLATE works in actual PNGs

[@maskofthedragon]

RED: What's the next step in your master plan? BLU: Crashing this server, "Pulls out comically large decal", WITH NO SURVIVERS!!!

[@newt4050]

Erm you should've used asterisks instead of quotation marks ☝️🤓

[@iamworthy-b4k]

no

[@nkacey2000]

It's crazy it took almost 2 decades for this to be discovered

[@NicknineTheEagle]

This is basically a ZIP bomb and ZIP bombs are kind of a recent trend so it makes sense that this got found now. EDIT: I get it, ZIP bombs were a thing for a long time. It is still possible that the last time they were trending is what prompted someone to look into TF2.

[@klad2860]

One shudders to imagine whats behind those spaghetti codes...

[@NicknineTheEagle]

@@klad2860 "Every weird bug I don't understand is Source spaghetti".

[@charautreal]

​@@klad2860this isn't a bug or "source spaghetti" is simply an oversight since it wasn't known it could happen you goober

[@Piratederp]

@@NicknineTheEagle Bro zip bombs have been around since the fucking 90s.

[@qoombert]

ah yes, the reverse coconut

[@novaseer]

tunococ

[@Rev_Erser]

.ti seod taht woc nedoow eht s'ti ,oN

[@jakestaheli8532]

I cant believe this misinformation is still spreading. The coconut can be removed from tf2 just fine, this rumor originated from a reddit post. The 2fort cow, however, does contain files so important to tf2 that every map must have one somewhere to work at all. This would be the reverse cow, not reverse coconut.

[@ghostrider4109]

@@novaseer2 no cock?

[@Rainbro359]

@@jakestaheli8532 Now you have become the one to spread misinformation. The 2fort cow is nothing special, it just happens to be present within a 105MB file that TF2 needs - not for the cow, but likely some other critical info contained elsewhere within it. Please revise your shounic lore lest you fall victim to that which you swore to destroy.

[@justhere4637]

1:50 PFFT. DAM.

[@memetech-]

Compression :D

[@trieumiu7473]

beavers when they see a running water stream:

[@cadaverousRemains]

​@@trieumiu7473peak reply

[@dudical111]

I wonder what their reaction was to the second one-

[@bombwolf8919]

Honestly, its surprising that it took, what, basically a decade for this to be found? I mean, in principle its so simple, its honestly surprising it never was found even by accident before. Like some Timmy thinking it would be funny to put a massive black PNG on his objector or something.

[@LonelySpaceDetective]

I would guess the need for hacks to upload images larger than 128x128 was what made this take so long to be exploited. Kinda discourages experimentation for most people.

[@Miiiasm]

Sometimes simplicity is the recipe to make hard things to discover

[@electricportals3644]

Tf2 has a lot of nuances, so the fact that no one tried this before now is almost impossible. Source spaghetti must have just discouraged people from trying to find something like this, despite this being so simple and irrelevant to source spaghetti.

[@JorgetePanete]

it's*

[@Roxor128]

As soon as I heard the format in question was PNG, I thought "Ah! A ZIP bomb!" PNG and ZIP both use the same compression algorithm. PNG just applies some reversible filters to the image data first to make it compress better.

[@m2pt5]

It doesn't affect sprays because sprays have to be VTF in the first place, and they get converted locally when you import them. It's only the custom decal items that use the PNG->RAW pipeline.

[@usernametaken017]

beware the pipeline

[@apchistuz]

RGBA8888 would disagree

[@mmee123456789]

2:20 Trying to find a spot to put the milk in the fridge. Cant and dies.

[@scooterking136]

just wanted to say, the description you gave of the “ten ones” phone number for png vs. raw data is the best layman’s description of image compression I’ve ever heard. I’m gonna be using that. bravo

[@yugureyt]

I like how you idiot proof your explanations. Really good example with the ten 1's thing

[@valetc6479]

Nope I still didn't understand anything.

[@Artician]

@@valetc6479 The raw version is more elaborate than the png version, aka the data in the png version is condensed all into one simplified action rather than multiple actions that are performed in succession, that's how i think of it.

[@gamertypeawesome]

​@@valetc6479I take it as pngs thinking of multiple pixels of same colour as a single stretched pixel

[@tfx9223]

@@valetc6479they use an extremely compressible image, which the .png extension will compress, fitting it in Steam’s 69kb limit. TF2 ignores the image’s compressibility and just reads exactly what it is, which for these images that caused crashes might just be a really really big image, or something. The image is too big for the data TF2 is allowed to use on your computer, and the game crashes.

[@goldenhospitality8521]

I went to vocational college for a while where we had IT related subjects. When we had the topic of compression they used the same example and it conveys the principle behind compression in a really simple manner

[@justhere4637]

2:02 What. Just what. I had no idea compression saves so much space.

[@tfx9223]

TBF most of the time you aren’t using mono colored images.

[@cryo-maniac]

its an extreme example also compression doesn't "compress data" per say but rather decreses the ineficency of the unrefined version Example: in a photo alot of pixels next to other pixels will naturally be the same color so you can just say "the same as before" when compressing alot but if you were to basicly randomise all the pixel colours then that photo would reach maximum data usage , and would be imposible to further compress. its kinda like that whole trying to find infinite energy thing, every time you think you can compress more data to less you realise: the older data was inheritly inefficent or the action of compressing adds too much data to actually make the difference Edit: typo cam -> can (damn turkish outocorrect, cam=glass in turkish)

[@cryo-maniac]

What I ment in the last sentence was this: ımagine you can send a photo by each pixel having 15 diffrent colours So you have 15 things you can send. Now if you use a compressing algorithm then the 15 possiblities will become 16 with the "the same as before" command. if you are using a 4bit system you can either 1: use the extra space in the 4bits (2^4=16, 16-15=1) to carry extra data for an extra pixel (in this case. if you are efficent you can use 15×4bits to transmit 16 pixels or you can reserve one of those for the same as before thing. you cant do both since specifying which one you are doing for each pixel will cost valuable data, and if you do the math you will realise on avarage the refined version (assuming randomised data) will be of either the same or less efficency than the raw data one

[@cryo-maniac]

I know the comments were long im just tryna improve my English skills, This is what being turkish does to a mf

[@Mate_Antal_Zoltan]

it's not compression being a miracle, but .bmp being fucking a fucking awful file format it stores the data of every single pixel, whereas .png says "this one looks close enough to the one before, just make it the same color)

[@purplehaze2358]

The fact that the file size limit for the sign is The Funny Number just.. can't be a coincidence. I refuse to believe the Valve employee who did that didn't once think about that.

[@ultravioletcombat5933]

File sizes can be weird, due to the fact that binary doesn't go in 1000s like normal metric, but in 1024s. Maybe it's actually like 68,000 bytes and change, and is just rounded up as 69 KB for ease of reading. Honestly, I'm more interested as to why they can't just slap PNGs directly onto the signs instead of decompressing them.

[@OpenKeith]

​​@@ultravioletcombat5933 The image has to be decompressed in order for the GPU to use it as a texture. The GPU has to be able to "jump around" the image and read whatever pixels it wants in any arbitrary order, which would be far too complicated to do by seeking back and forth in a compressed data stream (you can't just jump a fixed number of bytes to get to the desired pixel), so it needs you to decompress the image beforehand and hand it the raw array of pixel values.

[@B.L.U.S]

It's just coincidence the dumb meme of the intercourse number is just a recent stupidity

[@Ashe1001]

@@B.L.U.S People have been making 69 jokes before you were a twinkle in your dad's eye

[@purplehaze2358]

@@B.L.U.S Nah, it's always been slang for a specific "position". It's just recently that it's been memeified.

[@Bendilin]

@3:50 My main spray was an animated image file, long since purged. I custom made a spinning finger animation of Rikka Takanashi with TF2 font saying, "WOOP WOOP, PULLOVER, DAT HAT IS TOO PHAT." Loved that spray.

[@Bendilin]

@4:05 They USED to show up animated, both sprays and custom pics on cosmetic items, but when they killed that they also purged my spray. ;_;

[@DoomSlayer-vu3nt]

​@@Bendilin you can still make sprays animated just search it up, theres a website that converts it, might have to use another website to split the animation into its frames first.

[@MVCuber]

They managed to fit caseoh's forehead in a Conscientious Objector

[@the_kovic]

Ironically, the old 32-bit build was a massive help for catching this bug since it turned a mundane oversight into a crash.

[@literallynull]

1:30 This is some nice explanation of the Run-Length Encoding(RLE)

[@akazinnia]

Such an interesting title as someone who’s just kind of been in the background in the TF community I’m gonna have to see this

[@ladisloved]

I am surprised this was not a thing until now. Sounds like the simplest way of crashing, that could have been though of since day one of custom signs addition.

[@itswilliamanimate]

your analogy on how compression works is actually pretty accurate. _its mine now_

[@josephanselm8301]

I want to say that, as someone with very limited knowledge on tech and how games work, I think your way of explaining stuff is so great! It makes it easy for someone like me to properly understand what has happened. Like the phone explanation I was like "ooooohhh that makes sense"

[@christoffer4862]

Actually Windows BMPs support compression but only for max 8 bit pixels. Furthermore with the release of Windows 10, the Memory Manager introduced a Compression Store to optimize UNUSED virtual memory pages. This does not apply at the allocation stage though...

[@kevincox]

Good thing TF2 shipped a 64bit build! Should be tons of memory available for that 2GiB now.

[@BierBart12]

This is awesome. Like an in-game zip bomb It's intresting that these are kind of a parallel to actual bombs. A compressed mass expands rapidly and causes some form of harm

[@NeopiaCentral]

fun fact someone paid 680 keys for an "animated objector"

[@AvastAntiPony9445]

What a scam considering in practice anyone can just make one.

[@Artician]

Why don't they just put an animated png on an objector, are they stupid?

[@RandomRebelSoldier]

Did they really? That's gotta be either world's smartest scammer or the world's dumbest trader

[@Wicked_Fox]

Typical brain dead tf2 player

[@Muhahahahaz]

How??

[@Kawa-oneechan]

To be precise, an animated PNG contains all the data chunks a regular PNG has (IDAT and such), but then follows it up with the other frames (fDAT). This means literally every PNG decoder can read *at least* the first frame of an animated PNG, which is what TF2 does.

[@Techhunter_Talon]

This issue was so bad that even Delfy was saying that Valve needed to fix it as soon as possible. XD

[@Legenducky]

The troll face not smiling..

[@johnarbuckle6775]

@@Legenduckymf said 👿

[@TheTdw2000]

Well yeah. Just crashing a server isn't funny.

[@Racc00nerning]

it's always fun when a tf2 exploit gets found on your birthday

[@koopdawhoop.]

happy birthday!

[@evanslegoanimation]

Of all the things to happen on Homestuck Day, the equivalent of the Sburb meteors in TF2 wasn’t something I was expecting.

[@BrazilianHomestuckian]

Well that happened

[@adamj1367]

this truly was the most notable event to ever happen on the 13th of april

[@Whomobile]

Long story short is we can't have nice customisible things because people will find ways to break the game and/or show graphic images of gore and porn

[@ipaqmaster]

This is a well known attack vector (there is also a tiny png with an absurd res in the SecLists repo) but the magic is trying to use it in tf2 and working around the various limitations. I love this stuff and it drives me.

[@Gol3a]

Having a whole servers breakdown issues because of a picture is so much a typically TF2 problem I'm not even surprised the slightest

[@regicider3505]

I like that for a time you could enter a server with a functional memetic hazard all ready to go. Go full Perseus.

[@dedusmuln820]

you can go even further by modifying the height and width data in header with a hex editing tool to trick the computer into thinking the image has much larger dimensions than it does you can go up to the 16bit limit and have it under a kilobyte. a 65536x65536 24bit image would take 12GB in ram (i dont remember how exactly it was for pngs but that's how it works for gifs and ive actually made some before)

[@CyberDruga]

the phone example is the best explanation about how compression works I've seen in my life

[@bend.n]

1:49 okay so i must state that bmp can be compressed with methods such as Run Length Encoding (literally the ten ones approach) and with "png compression" where you stick a png into it, and theres jpeg compression too.

[@grubo8884]

and your point is?

[@bend.n]

my point is that its incorrect

[@grubo8884]

@@bend.n are you that big of a nerd that you have to point out bmps technically can be compressed even though that has absolutely no relevance to the video? "erm ackshully..."

[@nacl4988]

"Whats that?" "A zip bomb" "Why" "Funny"

[@ais4185]

Loved your compression example!

[@ItsGamein]

I feel like shounic would be a really good teacher if that was his job

[@Aminsx_]

That is the best explanation i've ever heard for compression and how relational databases work in general.

[@beeking1792]

Delfy: It's free real estate

[@ApocalypseMoose]

Fun fact: TF2 doesnt register animated pngs or gifs, but CS2 actually will.

[@MrPoke]

I'm glad Valve didnt take the nuclear option and completely disable custom decals

[@MattBixler]

1:16 this is the most graceful explanation of compression i've ever heard

[@Josukegaming]

Not only is this incredibly well explained but the gabe bit at the end was absolutely hilarious and so fitting

[@ToxxicBurst476]

huh, I do remember my game randomly crashing on me 3 times in a single day with that exact reason of "out of memory space. texture settings may be set too high", and it might've been the 13th... good to know it wasn't my PC deciding to kick the bucket

[@dropdedd]

Yo that explanation between png and raw is so applicable across so many mediums I don't think you understand 😂 awesome video

[@MrsXuzi]

missed opportunity to use the middle finger or a grave drawing.

[@kleinerhalflife]

That was the best way of describing compression. Ever. Thank you.

[@Ang3lUki]

I met the guy who found the issue, he told me to add a string to my hosts file that would disable all signs and I watched him crash everyone multiple times.

[@MrDirt]

4:23 What the Fuck. Where is this conversation from? What's the context? Do you ever use AI Gaben to generate outros?

[@Artician]

He only sentence-mixes them, so this seems like an actually real conversation that gabe had with someone

[@green929392]

3:30 but what is the maximum size of RAW image data accepted by TF2 now? They must have set some arbitrary limit.

[@stan-bi3hl]

If the file is supposed to be 128x128 at most, it's that multiplied by whatever average texture color depth they use for the signs. For old RGB565 it would actually be 64 KiB.

[@fireflyhighh]

I think you might be my favorite tf2 content creator

[@littletweeter1327]

One of the best explanations of raw vs compressed I’ve seen

[@Vexcenot]

No gaben don't let him pull out the sign!

[@Dr_LanMan]

Thank you Shou I love Shounic videos

[@touhoutrash2436]

That exploit is really really really cruel my Bois!

[@StupitVoltMain]

"Realizes it can't and dies" Yup, that's spirit of tf2

[@zeryanbek]

1:16 shounic wtf????? this is the best way you described something for non-techy people. wow.

[@jsuhtea]

This is now the official TF2 Wiki and the visuals, just so neat and I can understand quickly

[@CauseOfBSOD]

1:50 BMP files can be compressed with various methods (source: did a computer science project on parsing them)

[@tharxis3803]

Me when my hungry objector eats all of my ram.

[@maxresdefault_]

Amazing that it took so long to work this out

[@dntfrthreapr]

Im an avid 6502 programmer and the Apple IIe is my machine of choice to program for. A bitmap of the hires graphics screen takes 8kb. I wanted a splashscreen on my version of Breakout (called Jakeout) that I wrote from scratch. The whole game takes up 4.6kb so using 8kb for just a splashscreen was unacceptable. My compression solution was to create the splashscreen graphics using a utility I created to record a script of all the steps used to create the image. Information like the endpoints of lines and the current color were written to a file. To display the image, the script was read and the lines and colors were drawn from the script. With this approach I was able to reduce the image size to a few hundred bytes including the data reading algorithm.

[@8stormy5]

Great, I had an un-decaled conscientious objector for the memes and now I can't use it or else people will think I'm trying to crash the server. 10/10

[@rachelslur8729]

valve conscientiously objected to the bug

[@PnchBagTF2]

We could have had 256x256 or even 512x512 pictures if someone hadn't decided to spoil all the fun

[@Vitaliuz]

It's the oldest trick in the book. Like compressing petabytes of filler data into miniscule archives.

[@Jose-w6i4b]

That spray is the best thing ever.

[@georgehelyar]

If you know what you're doing you can make it 16gib quite easily, maybe more with other pixel formats (72gib might be possible with 144bpp)

[@Travisgaminglol]

for 5 days in a game with flamethrowers and rocket launchers the most powerful weapon was a literal piece of wood with a weird image on it sounds fitting for TF2

[@notlark650]

My takeaway from this is that we need 64bit tf2

[@moosekababs]

software is so funny. i love when i realize i dont have enough hands to carry every thing in from the car so i just shit my pants and die

[@metalac8363]

I like how shounic uses understandable metaphors for us mere mortals to comprehend

[@nevoh4940]

"realizes it can't, and dies" damn that sounded sad

[@TheColdestSnowmam]

Me when try to download an image of caseoh

[@LiquidWater91]

I'm honestly a bit surprised steam developers didnt already have safeguards on the upload server to defend against these sort of attacks. A compression bomb is something thats been known about for quite awhile.

[@CreatorofSecks]

warrior

[@nuherbleath461]

I think it came before April 13, as it happened to me on the 10th, I have screenshots of a disrupted (god forbid) 2fort match.

[@master45345]

1:20 "You wouldn't say one, ten times." Yes I very much would. I would be insufferable.

[@stan-bi3hl]

The weird thing is many English speakers do the "compression" thing even when there's no compression factor, e.g. double-oh-seven for 007 instead of oh-oh-seven. Meanwhile, service announcements in English in Europe will read 0000 as zero-zero-zero-zero.

[@PixelSubstream]

"The file is F&ckin RAW!"

[@DrHundTF2]

The sight of sprays gave me an idea: what if we added workshop-made sprays that were allowed by valve on any server?

[@Rhettroizms]

So this is why my game randomly crashed once while playing. I thought it was my storage lmao