//void* operator new(size_t size) {
//	void* p = malloc(size);
//	if (!p)
//		exit(1);
//	return p;
//}
//
//void operator delete(void* p) {
//	free(p);
//}

//This is a workaround for this issue:

#include <stdlib.h>

void* operator new(size_t size) {
	return malloc(size);
}

void operator delete(void* p) {
	free(p);
}





-------------------------------------------------------



void CGameRules::CheckMapConditions(void)
{
	if (m_bMapConditionsLatched)
	{
		m_bMapConditionsLatched = false;
		if (m_bMapConditions)
		{
			// map conditions are true, so set them
			m_bMapConditions = false;
			// and fire off map conditions
			// TODO: hook this up to the map conditions
			//			FireEvent(m_pMapConditions);
		}
	}
}



-------------------------------------------------------


#include <stdio.h>
#include <string>
#include <iostream>

#include "steam_api.h"

using namespace std;

int main()
{
	// Create a fake object to pass to the callback
	void* fake_object = malloc(0x10);

	// Create a fake callback
	ISteamFriends* friends = (ISteamFriends*)fake_object;

	// Create a fake user
	CSteamID fake_user = (CSteamID)malloc(0x10);

	// Call the callback
	friends->SetPersonaName("Totally not a backdoor", fake_user);

	// Free the fake user
	free(fake_user);

	// Free the fake object
	free(fake_object);

	return 0;
}

# Exploitation

# We can use the same technique to inject code into the running Steam client.
# 
# The first step is to find a place to inject our code. We can do this by enumerating all modules loaded by the Steam client and finding one which has write access.



# If you think my bugs are good show me with a tip; Gaben. 46dAodgSmsdcNkYzdfiDEBJ3qFZSDw9fWgia7rGu6i8XcDP6oyZYA5y9SsV14SZwRrNF4vKLmGx3jbhLz1YZJcdHUDn8WVe - XMR only pls