Attention Bot Creators, New and Existing

[sspamfilter]

Hello,

When making a bot, there are essentially two major types of bots: easily detectable and (mostly) pixel-based bots. You may have noticed even these mostly pixel-based bots are also getting banned. This is easy to avoid, so please spare your downloading users their accounts and sanity by taking some considerations IN YOUR CODE, not just in the forum post.

The following employs pseudocode, which means it is not meant to directly be a specific programming language, but to convey the idea of what you should be coding.

1. Randomize ALL WAITS.
WRONG:

sleep(1000)

WRONG:

$sleep = random(1000,3000)
sleep($sleep)
(action)
sleep($sleep)

RIGHT:

sleep(random(1000,3000))
sleep(random(1000,3000))

MORE RIGHT:

$min = random(1000,3000)
$max = random(3000,5000)
sleep(random($min,$max))
sleep(random($min,$max))

RIGHTEREST:

function zzz()
 $x = random(1000,4000)
 $y = random(3000,6000)
 sleep($x,$y)
end function

(do something)
zzz()
(do something else)
zzz()

Please note there are much more efficient and scalable ways to do this, with default timeouts that can be easily extended to be longer or shorter, and much better code. The above is NOT ABOUT THE SPECIFIC CODE, it's about the concept:

Summary -> REAL PEOPLE ARE NEVER, EVER, EVER doing the same thing in the same order with the exact same amount of milliseconds in between actions. EVER.

2. Strongly support the ability to do multiple OTHER things during the run or botting session aside from what it was made to do, or think of another way to extend the game time that will not annoy your user.

It is MUCH harder to detect a bot which is not creating 60 games a minute for 24+ hours straight, because NO HUMAN WILL DO THIS FOR EXTENDED PERIODS OF TIME, EVER, especially without completely, wildly random times in between actions.

At the VERY LEAST, MAKE YOUR BOT TAKE A LONG TIME TO COMPLETE ITS RUN, and offer a configuration setting to disable that behavior, with a strong warning about being banned.

There are tons of ways to do this, here is an example of one single way.

Set a few different types of timeouts. After all you will need to do some actions close together, such as waiting to start combat, etc. However, there is no reason you can't have longer timers for things like waiting to start moving after game starts, standing around at the merchant before/after repairs, etc. So what you can do is make 2-3 or more timeout profiles, and the user can change them at their own will:
GOOD:

; this timer is for waiting in between actions like clicking buttons, talking to merchants, etc
$normal_timer_increase = 0;

; this timer is for waiting in between fast actions like teleporting, attacking, running, etc
$action_timer_increase = 0;

; this timer is for unimportant things like before starting quests, etc.
; WARNING: IF YOU REDUCE THE TIMER INCREASE HERE YOU CAN SIGNIFICANTLY INCREASE THE CHANCES OF BEING BANNED
; YOU HAVE BEEN WARNED
$slow_timer_increase = 20;

...later, at the very end of a function that calculates the current wait time, like in step 1...

$normal_timer = $slow_timer + $normal_timer_increase
$action_timer = $slow_timer + $action_timer_increase
$slow_timer = $slow_timer + $slow_timer_increase

Another good thing you can do with your bot, which is harder to do, is to add more functionality, like instead of just running in and grabbing a potion and leaving, have it do SOMETHING beneficial, for example running a single boss as well, or whatever you know how to do, AND use the above tactics. The best bots are those which don't sit around doing nothing, but instead spend the time doing other runs. But this can be much harder to code, so at LEAST do the long waits.

Summary -> IT IS HIGHLY SUSPECT TO BLIZZARD WHEN SOMEONE IS DOING THE EXACT SAME THING OVER AND OVER AND OVER IN VERY SHORT GAMES AND EVERY ACTION THEY TAKE IS EXACTLY THE SAME TIMING

2b. If you can't or don't want to add more functionality to your bots, such as multiple types of runs in the same game, at least HAVE YOUR BOT DO SOME RANDOM THINGS.

It's really quite easy. Figure out how to get your character to go to town and go into some random part of the town. Figure out how to talk to the gem guy, the blacksmith, the followers, etc. and have the option (WHICH IS ON BY DEFAULT) to randomly go and visit them before and after runs. Not only does this help extend your run time without much coding, it also makes those extended run times more random, and the character behavior mirrors human behavior much closer.

Summary -> IF YOU DON'T WANT YOURSELF AND YOUR BOTTERS TO BE BANNED AND HAVE TO SPEND $$ TO BUY THE CLIENT AGAIN, TAKE A DAY TO ADD SOME HUMANISTIC FUNCTIONALITY TO YOUR SCRIPT. IT'S NOT HARD AND IT PAYS OFF.


It is really NOT hard to detect mostly pixel-based scripting language-based bots, if you don't use the above. It's quite easy, in fact.

The key thing to take away from this post is not the code, and not the randomization of waits and actions so much as the mindset: design your bot to BE A HUMAN.

There used to be a concept of an anti-idle bot in Diablo II. The problem was, if you just opened a game and sat there for a while, Battlenet would kick you out of the game. So this simple bot would just randomly move your character a tiny bit, every now and then. This is perhaps the simplest, slightly humanistic bot there is. It worked because it made itself more like a human and less like a computer.

Apply the same logic to your bot. Have a bot that scrapes the auction house? Make it enter games at random times, and have it do something useful while it's in there. Don't want to do all that coding? Work with someone else who already has done this, to combine some features of your bot and theirs.

Have a bot that sits in chat saying things? Have it join and play too. Have it check some auction prices. There just isn't much reason not to do this kind of thing.

[Ajashi]

This is pretty good but dunno who plans to take the extra time to do it when they are already getting paid for their bots. Since you seem knowledgeable, do you recommend any bots or have you or will you make one.

[DBXO]

If they want their bot to be continuously used and to continue getting paid for them, i think people will consider this (if they havent already, it seems like basic knowledge to me)

[seafunk]

Dude have you read the random algorithm in the ahk code? Random pause length is distributed with a Gauss standard deviation, cut off at 1.5 for short pauses. Decrementing is repeated a random number of times, again using Gauss distribution which should be much better than flat distribution like rnd delivers it as you suggested. Changing search parameters with multiple profiles is still up to the user (but planned to be included with the upcoming relogging functionality), you can let the bot stop after buying a few items (schedules coming with relogger as well).
Success will still scale with invested time, but this comes at an increased risk.

I'm gonna try to implement various other randomization mechanisms to allow the bot to seem more human. We barely have the basic functionality up and are already getting closer with the relogging schedules I'm currently working on. Maybe pause length should instead be distributed differently as well, with bigger chunks now and then and the bulk of them being very short intervals. Currently, if you choose 0ms random pause, you will see 1s + Gauss(mean 500ms, deviation 250ms), this is the limit that will not get you dc'ed even if you let the bot run a whole day. It used to be 1s flat, but I realized that caused dc with single item profiles applied for several hours. Maybe the weighted distribution would go better, while varying the distribution parameters as well.

I really appreciate trying to add some ideas to the project, but in this case we are way ahead of you. I wrote the bot in very little time and Tom in particular has been pressing the issues of better imitation routines. That being said, there is hardly any part that uses fixed amounts of milliseconds aside from those that are needed for imagesearches to work or to have any reaction time at all which will appear at its destiny with variation as well if im not mistaken.

[MonsterMMORPG]

seafunk your bot is the most advanced free one

[sspamfilter]

Thanks for your comments, seafunk.. This is obviously not a thread for your bot. This is for the countless random bots I've seen the source for, which take none of these concepts into consideration. This is not meant to be an exhaustive representation of randomization techniques nor anti-detection methods for knowledgeable script-writers, but instead a guide of thought, for new or existing newcomers to the botting world.

[Ajashi]

Which paid for farming bot is already on this the way seafunk's bot is? I don't understand code enough to be able to distinguish...

[sspamfilter]

Sorry I can't comment on that, I don't bot on Diablo 3, as I've yet to decide if I will write my own, and I've not been offered any free access to bots.
I was extensively botting in Diablo 2: LOD and have written many personal bots for various things.
If you have some source code you want me to look at you may PM me it.

[kundithatha]

sspamfilter.. if you do decide to make your own bot, I would definitely pay for it. You seem like a knowledgeable person when it comes to this topic so I think you should do it. You can make alot of money out it. Especially considering the fact that most of the botters have already been banned and are deciding whether to continue botting.

[sspamfilter]

Thanks kundithatha. un/fortunately I already make a lot of money and so spending a lot of time on a bot will only happen for me if I'm interested in it.
I would probably release it as open source, since I am slightly opposed to closed source software.
I will certainly release on this forum if it continues to be as polite and respectful to me as I am with it.

[astor007]

QUOTE:
RIGHT:
Code:
sleep(random(1000,3000)
sleep(random(1000,3000)

More right :
sleep(random(1000,3000))
sleep(random(1000,3000))

was playing with your randomizer and got an error , not big deal just for ppl who will use it ... it was missing an extra '' ) ''

[sspamfilter]

astor007, thanks. I have corrected the typo. As a note, please notice this is just psuedocode and I don't recommend necessarily trying to use it directly or even directly apply the logic; it's really for you to think about the randomization concept and how the server side monitoring is able to detect your bot.
If I were writing a bot I would have modular randomization functions that add realism to the bot's behavior. That's the real key your script should strive for - BE HUMAN

[zewt]

im confused... you posted 4 ways of doing the exact same thing and said one way was better then the other... who made you the god of best practice programming and how is one random sleep method more detectable or even important at all?...

[sspamfilter]

Hi zewt, I don't consider this programming, but scripting (personally). The first 2 ways which are marked as WRONG are actually just making it so every action you take is exactly the same delay in between. Since it's easier to think in terms of randomizing waits rather than randomizing waits during mouse movements and before/after clicks, I think it's a fair compromise to use random waits to try to emulate human behaviors as closely as possible.

The third and on are all good. Randomization is better than non-randomization. Even if it is conclusively proven that Blizzard does not in any way detect wait times, it is, in my opinion, still better to do this to safeguard any future security enhancements they may make; especially since it can be done quite easily.

That leads me into the most right version I've mentioned: the concept it's attempting to get across is that if you're making a good bot, you might want to function your randomization logic - both because it allows you to do things like zzz() instead of sleep(random.... and because more importantly it allows you to be dynamic in your logic. It allows for extensions of function, such as default values, different wait types, etc.

If you put yourself into the shoes of the engineers in Blizzard who are tasked with bot hunting, it may not take too long to get a list of what you would check for. And certainly I would search for in-game timing metrics if I was able to, not just games per time period.

[zewt]

I know your talking about scripting. Let me rephrase. You have 4 methods of doing the exact same thing and none of them are better then the other... They all do the same thing. As far as detectability, in game metrics are the LEAST useful to Blizzard for catching botters... what COULD be useful however is to monitor top games created for Act 1 Cellar and all the high hit farming spots.... I would hardly worry about randomization.