• Visit Rebornbuddy
  • Visit Panda Profiles
  • Visit LLamamMagic
  • Friendly reminder

    Discussion in 'Discussions (no Ban Reports here)' started by deknarf, Feb 4, 2016.

    Thread Status:
    Not open for further replies.
    1. deknarf

      deknarf Member

      Joined:
      Mar 24, 2014
      Messages:
      103
      Likes Received:
      3
      Trophy Points:
      18
      A week before the most recent tripwire event, it was already known that blizzard had updated their bot-detection methods for the x86 (32-bit) client.

      Just saying.

      (yes I can provide a source for that information, yes I know what I am talking about, yes I know how detection works)

      I'll explain how you are getting detected:

      Warden - blizzards anti-ch3at - checks for HB at specific moments, being:
      • Account Login
      • Character Login
      • Character Logout
      • Account Logout
      • Client Closing

      For semi-non-nerds: Imagine the wow client's code being made up in layers, like a folder structure on your computer.

      So... for a long time, Warden searched as deep as (for example) 4 layers -- No problem, HB team knows this, so they inject on the 6th layer...

      TripWire was designed to check for any changes in the first 4 layers.... because in the past, that's how deep they could go and not be detected, until warden was upgraded. (cat and mouse game)
      What HB/TripWire does NOT know is that blizzard upgraded warden, to go (for example) 6 layers deep or even further...

      At that point, TripWire is outdated & Everybody got detected.

      See what I'm getting at here?

      TripWire was either turned on manually, or it detected the changes A WEEK LATER.
       
      Last edited: Feb 4, 2016
    2. Tranquil

      Tranquil Member

      Joined:
      Oct 25, 2012
      Messages:
      48
      Likes Received:
      2
      Trophy Points:
      8
      How many years after the fact and we're still making ourselves targets by using outdated clients? lol. I give up.
       
    3. Tarathiel2

      Tarathiel2 New Member

      Joined:
      Nov 12, 2013
      Messages:
      289
      Likes Received:
      7
      Trophy Points:
      0
      Thanks for this valuable bit of information, I'm sure the developers never thought about that. /sarcasm
       
    4. shorty8769

      shorty8769 New Member

      Joined:
      Jan 14, 2012
      Messages:
      43
      Likes Received:
      0
      Trophy Points:
      0
      me to i just got a 6 month suspension on my main account 11-100s all 715+ ilvl maxxed rep and professions but hey if you play you pay so im back to my other account with 1 level 90 and starting over it is either wow or i will end up devoriced
       
    5. wizardpt

      wizardpt Member

      Joined:
      Sep 26, 2012
      Messages:
      414
      Likes Received:
      0
      Trophy Points:
      16
      What really makes me sick is i used the bot for like 2 minutes before on tripwire to check something on my full mythic 21k achivement points main account , and i still have 3 crappy accounts running at this time and they are fine this pisses me off ....what a luck
       
    6. pookthetook

      pookthetook Member Buddy Store Developer

      Joined:
      Jan 28, 2012
      Messages:
      214
      Likes Received:
      21
      Trophy Points:
      18
      Omg thanks so much for sharing! I'll skype raphus right away to let him know that warden was updated and I'll explain to him how his tripwire works!
       
      Frayman likes this.
    7. deknarf

      deknarf Member

      Joined:
      Mar 24, 2014
      Messages:
      103
      Likes Received:
      3
      Trophy Points:
      18
      @pookthetook Mr. Buddy Store Developer, I'm not here to explain call stacks.
      I'm not here to explain hbdetectionlualoadhook. I'm here to explain the vast majority of users - that simply click the hb executable and log into wow - what's what.
       
      Last edited: Feb 4, 2016
    8. ryftobuddy

      ryftobuddy Banned

      Joined:
      Aug 19, 2011
      Messages:
      2,291
      Likes Received:
      34
      Trophy Points:
      0

      What's your point? The HB team already admitted the problem. I don't know how you think providing this information is ground-breaking or even new at this point...

      And you should just stop talking about 32-bit. There's absolutely zero proof anywhere that HB being 64 bit would protect HB users any more, nor is there any proof anywhere that Warden is different between 32 and 64 bit...As a matter of fact, you could basically guarantee that they are the same. If tripwire isn't effective, being 64 bit will not protect any one any more than it already is. At least you have a different argument than the usual users saying that 64 bit will protect us more...Albeit a once again false argument for x64.

      If you can provide a single piece of evidence that warden is different between the x86 and x64 clients, I'd love for you to actually provide it...My guess is you can't.

      If you think a 64-bit bot is going to protect you, please go and use that bot and stop posting completely useless information about systems you know nothing about.
       
      pookthetook likes this.
    9. deknarf

      deknarf Member

      Joined:
      Mar 24, 2014
      Messages:
      103
      Likes Received:
      3
      Trophy Points:
      18
      The answer to the question about the usage of x64 is partly in the first post, where I sketch how detection/protection works.

      As to what I personally think of the matter?
      1: They don't change to x64 because they lose x32 VMs/wXP multi-multi botter customers
      2: It's a lot more difficult

      ---------------
      @ryftobuddy
      Just don't talk to me. Ever.
       
    10. ryftobuddy

      ryftobuddy Banned

      Joined:
      Aug 19, 2011
      Messages:
      2,291
      Likes Received:
      34
      Trophy Points:
      0
      And what exactly are you going to do about me posting facts in your thread? I see you can't provide any evidence that they are different, so I believe my point still stands.
       
    11. Sneeds44

      Sneeds44 Banned

      Joined:
      Jan 22, 2016
      Messages:
      416
      Likes Received:
      1
      Trophy Points:
      0
      ye honorbuddy is stil banneble i had a new account i questbotted for a few days and im banned i wil not touch hb anymore im now botting in diablo witch is fine
       
    12. deknarf

      deknarf Member

      Joined:
      Mar 24, 2014
      Messages:
      103
      Likes Received:
      3
      Trophy Points:
      18
      @ryftobuddy
      If you are so determined to prove me wrong, why don't you prove me wrong by showing me that the 2 clients are the same?
      That's the only thing you seem capable of doing anyway. Claiming other people are wrong and expect them to provide you with proof of how your accusation is invalid, instead of being an adult and not speak before YOU are actively contributing to the discussion (with said proof)
       
    13. ryftobuddy

      ryftobuddy Banned

      Joined:
      Aug 19, 2011
      Messages:
      2,291
      Likes Received:
      34
      Trophy Points:
      0
      HB will ALWAYS be bannable. Not a single person here has ever said otherwise. If you didn't know that, you've never paid attention to a single thread on these forums.
       
    14. Sneeds44

      Sneeds44 Banned

      Joined:
      Jan 22, 2016
      Messages:
      416
      Likes Received:
      1
      Trophy Points:
      0
      wow blizzard does care alot about wow botting not so mutch about diablo thats why there arent mutch bans in diablo and there are in wow its just that its to mutch money buying evry week a new account
       
    15. ryftobuddy

      ryftobuddy Banned

      Joined:
      Aug 19, 2011
      Messages:
      2,291
      Likes Received:
      34
      Trophy Points:
      0
      I don't need to prove you wrong...All you are is another user coming to these forums claiming they know something that noone else does and making absolutely false arguments for a change that can in no way guarantee anyone's safety.

      And I'm still curious what you think you can do to keep me or anyone else on these forums from responding to you? I'm not one of those people that reads things on these forums and blindly assumes that the person making claims knows what they are talking about...There's absolutely nothing you've posted that anyone should take as fact. There's nothing I've posted that anyone should take as fact either...The difference is I can admit that I could be wrong. Until you can prove otherwise, I'll continue to assume I'm right though.
       
    16. Goshinki

      Goshinki Member Legendary

      Joined:
      Sep 9, 2011
      Messages:
      500
      Likes Received:
      12
      Trophy Points:
      18
      You first statement about different detection stacks is wrong.


      You can do an Assembly edit very easily with quite a few programs out there and just like with most unprotected injection methods will be flag within an hour normally for a ban.


      Especially things that flag for sever alteration such as movement speed changes etc. So that whole thing about login charter screen is pointless and 100% incorrect.


      Delayed protect from Tripwire is the norm. Blizzard can slowly code sub projects together over weeks if they want and make it look harmless piece by piece... then very easily tie it all together into a new HB detection method at the last minute.


      Just like there is always a new creative way to inject a hack without being detected there are a million other creative ways to catch it.


      PS. I've missed that last two tripwires and I am unbanned on 3 accounts. I PVP all the time on all 3 of them. Though that doesn't mean much compared to the sear volume of users.
       
      Last edited: Feb 4, 2016
    17. deknarf

      deknarf Member

      Joined:
      Mar 24, 2014
      Messages:
      103
      Likes Received:
      3
      Trophy Points:
      18
      Please don't look at my examples as a coder, but from an end-user point of view. I know.
      The moments (such as "character login") I stated are not about the screen itself, but the changing of the state.

      Yes! Exactly that.
       
    18. Goshinki

      Goshinki Member Legendary

      Joined:
      Sep 9, 2011
      Messages:
      500
      Likes Received:
      12
      Trophy Points:
      18
      Well then this thread is pointless because that's a terrible metaphor.

      You might as well have compared it to hide and seek... or shoplifting in a mall with loss prevention always on the look out.


      By the time you get caught it's already too late. All you can do is warn your friends...
       
      Last edited: Feb 4, 2016
    19. perons88

      perons88 New Member

      Joined:
      Sep 9, 2014
      Messages:
      100
      Likes Received:
      1
      Trophy Points:
      0
      u have received any report? ppl while wisp u and notice,, ahhh u are an fucking bot???... if u dont have received any report.. the only thing that comes to mind , and you were running these accounts with others who have already received reports... i have 18 account.. but only 13 received 6 month ban....
       
    20. chinajade

      chinajade Well-Known Member Moderator Buddy Core Dev

      Joined:
      Jul 20, 2010
      Messages:
      17,540
      Likes Received:
      172
      Trophy Points:
      63
    Thread Status:
    Not open for further replies.

    Share This Page