Was HB Detection Method Determined?

Was the HB detection method used by Blizzard ever determined or has it been left to speculation?

Speculations:
1) Blizz scanned process for HB (most people think this, a few think they did not due to invasion of privacy laws). If processes were scanned why has no one posted this info or have I missed it. This HB forum is filled with so called experts that surely would have proof if Blizz scanned their machines. So, if some one has proof of this please post it.

2) Some are inclined to believe Blizz did memory injection similar to what Runescape did with project "ClusterFlutterer". For example Blizz sent a packet that your toon was under attack when in reality it was not. HB detected your toon was under attack and responded accordingly. Blizz captured your packet back to the server and determined your were botting. Blizz probably ran this at least 2 to 3 times (just 2 to 3 packets) to confirm the toon was botting. Then your account was flagged and you got the suspension. Why didn't any HB users see this in their log files? One reason is when Blizz sent the packet that your bot was being attacked, they also turned off logging.

3) We really don't know the details of what happened outside of court which is far more interesting that what happened in court. What did Blizz and HB talk about in private an what deal was struck.

4) Other ideas?

 

Number 2 sounds way too complicated and time consuming also very unlikely. There are people here who only used CR and still got banned. How can they let your toon be "attacked" and register this as botting while you are using your toon at that same moment to run a CR in a raid fro example? Doesn't make sense.

Also, there is an option in HB "Defend when being attacked" I doubt anyone has that option selected. I know I did. But it's not default. So even if a toon would be attacked and that option is not turned on, then I don't think Blizzard could register it as "bot".

 

Personally I think blizzard hired a psychic called Dave who also worked as a part time builder. Dave read everyone's mind and banned them accordingly.

What ever happened was after February as I didn't get banned on accounts that didn't use HB before that date. Pretty sure what ever blizzard did was a detection method and I doubt it was a scanning of your process list as warden doesn't scan outside the WoW client. But I'm no security expert do take my input as wrong.

HB runs on 32-bit client. HB uses click to move. HB combat routines are the same perfect cycle to the second. I'm sure more security minded teams could go further into this but those 3 alone single out a good percentage of the WoW player base.