Honorbuddy may not be detected, at all.

A thought I had on Blizzard's latest Ban Wave. Honorbuddy may not be detected, at all.

I haven't used Honorbuddy in a while, and some may be able to counter what I'm about to suggest by simply saying the following Tripwire mechanics don't take place.

If the current and/or past Tripwire mechanic is to close WoW and stop/close Honorbuddy, here's my pretty simple suggestion as to how the Ban Wave gathered a target list.

Here goes:

Take a random day - Tripwire activates, WoW closes, Honorbuddy closes. To Blizzard your account just got recorded as going offline at the same time as they intentionally trigger Tripwire with a Warden pulse.

The list of accounts disconnecting will be HUGE. And will include THOUSANDS of legit accounts which coincidentally logged off.

Take another random day - The same Warden pulse occurs and Blizzard creates a new list.

The two lists are now cross-checked and removes all of the accounts from the first list which are currently online but didn't disconnect this time around.

Blizzard is left with a list which includes 2 occurrences of accounts which have been online and disconnected at the same time as Warden doing it's thaang.

The previous steps continue - Blizzard continues their sweep, collecting a strong target list of accounts effected by Tripwire activity.

Secondary data checks available to Blizzard can then be automated on the target list, for example:

• 64-bit operating systems running 32-bit compatibility WoW applications.
• Accounts on the target list from the same IP Address, MAC Address, Customer Payment and/or Personal details.
• Similar activity; PVE & PVP Farming, Auction House & Bank Utility.
• Social Circle Links; targeted accounts which communicate with each other, in the same guilds, same realms, on Battle.net friend lists.

With enough time and enough sweep parses, a solid Ban Wave list can be created and Honorbuddy may not even be detected.

Why hasn't other bots been as effected? They don't have the Tripwire which Honorbuddy has, that Blizzard may KNOW how to trigger. Honorbuddy may not be detected, just the Warden counter mechanics 'bateable'.

 

There are 64Bit bots für WoW.
And your logic has one mistake. There hasn't been a tripwire activasion before. Accounts where banned who never have seen any tripwire activation. Okay this doesnt say you have another way to detect bots but in this cas this couldnt be the reason for the ban

 

Of course not using 64-bit would ever be the reason for ban, did you seriously just take a minute talking point to debunk the theory? Holy shit. The point is disconnected accounts being used to compile a list.

 

Well I didn´t was online due to the last tripwire events this year and they hit me. I caught someone last year. After the last patch in april/may I got lots of crashes when switching the tasks. Switch out of wow it freezes or closed. Don´t think this happens to all players. Would have been noticed.

 

Whoah, holy $h!t ! Devs, are you read this? Just turn on auth server again! *sarcasm*

but, i'm personally got no bans, cos i dont played 3 weeks before wave, really.

 

Never been online during a tripwire event. EVER. 6 accounts banned. Logic flaw.

 

well i am banned and Tripwire has never gone off while i have been online i only used to lvl chars with kicks 1-100 and enyo with a cr for raids never used to farm and have always been with the bot 100% of the time while watching films i also stopped playing wow for a few months and started playing again about a week before the baning

 

Please cease with the uninformed, uneducated speculation about what caused the banwave.

I suggest watching the following video:

[video=youtube;hABj_mrP-no]https://www.youtube.com/watch?v=hABj_mrP-no[/video]

A bot can be detected with a few lines of code or assembly instructions, if the code is well targeted. There is no need to invent these convoluted hypotheses to explain something that is likely quite simple, Honorbuddy got detected via software and will continue to operate once they fix the vulnerability and take any measures necessary to mitigate future risk.

 

i lost an account where i boted on and there was no tripewire event since i bot on it
(do accs really dc on tripewire or do they just go afk)

100k for 7200k accs got banned this is less then 2%. chance would be to high that someone get banned who did not used hb

64 bit--> a lot of ppl do not have money for a good pc and play with 32 bit

 

Well, as you all know this was triggered just after the court decision in Germany. I am very sure that Blizzard has bought the Buddy team because i have only heard of ppl getting banned that uses their bot. I use another bot on my other account and its still active and im still botting
So my guess is that this Honorbuddy and all other bots they have now are dead. Saw thousands of Diablo botters also where banned same day.
So thanks for the botting with Honorbuddy as long as it was active but now i will not be apart of this anymore.
Bye all.

 

not alot....the only 64 bit is not really a bot, just a CR (So......Box)

 

Actually they shutted 100k+ accounts on EU/US, but CN realms reported the same 6 month suspensions hits around 16-20hours later.

So the real numbers are definitely higher!

 

150k then maybe still around 2%

 

1 accounts botted on a VMware with windows 32 bit used it for like 1 week to test some shit still bannend
1 account that I just used for creating profiles also got bannend and never AFKed profile and never runed a profile longer then minutes

 

I were not once online using HB when the tripwire was activated and still got banned.

 

I sincerely hope that ain't the case and even though I reserve the thought that you're just a troll I too have only seen such huge banwaves occur when a company has been bought out by Blizzard. The lack of further information from Bossland is kind of worrisome too. But oh well, whichever way it goes it does not matter to me.

 

A bit off-topic maybe. But let's say a player reports you for botting with HB, and a GM looks into it. Can he then see that Honorbuddy was used during the time of the report? I mean I never understood that whole "Honorbuddy hasn't been detected yet". How can it not be detected while GM's can see that you're using a bot? (Talking about before the massive banwave).

 

18 of 19 accounts suspended, 17 HC botting 20 hrs a day sometimes more. 1 of those is still good, the other 16 accounts are suspended I used these to farm herbs fish meats 665 items and anything else I became in need of all accounts were 100 and ilvl 660 with 690 rings doing lfr in groups of 4 all at the same time properly gemed and enchanted ranging from dk's paladins shamans hunters priests. 2 main accounts on same btag, used acct1 as main acct hand played also had an toon in bot guild that was officer with max bank control every tab. Used to withdraw deposit gold potions flasks food gems and other materials then mailed to main. Acct2 was only 2 toons a 100 in a random raiding guild and a 94 toon gm of the bot guild that i posted auctions with (manually with Auctionator add-on) Havent ran HB on these accounts since i got a ban in 5.2 (it was going to happen toon named honorbuddy and Ifrmwthhb) suspended for 6 months. Most the time when I was playing main account I still had at least 9 bots online going.

 

Honestly, their really is no way of finding out how blizzards client bans the dirty. My guess it Prob scans ram process's and gpu/cpu process and literally checks everything for a WoW attached 3rd party program. So yes even renaming the .exe wouldn't keep you ban free. Its just like VAC and steam games. They require you to disable DEP settings in bios and require the .exe on a flash drive and they say to clear your PC journels even doing all of that it keeps you safe for like a month but they always catch you :/

 

I personally thonk it was a strait out process scan.........i had an account suspended that never botted EVER. But i would open up the client while my main account was doing botting activities to post to ah a few times a day. Both accounts 6 month. That leads me to believe they snooped running processes as a whole on each account suspended during the sweep.