[3.1.2] Some Changes...Few Static updates...

[Hawker]

I think they added the scan so they could get rid of evryone using that chineese fly/speedhack mining bot. Atleast that's what a friend said

I hope you are right...my poor toons are selling gold for $5 per 1000 this morning and its all down to the flood of gold from level 55s in Wintergrasp and the Cobalt Triangle Shield farmers.

[Hawker]

The Wintergrasp shit is really funny.

Kynox would say: "Amateur work ladies. Very unimpressed." but I wont blame them. It must be nearly impossible to catch lvl 60 hunters flying around with speedhack and mining like a maniac in a lvl 80 pvp zone. ; )

Agreed. It will take some kind of programming genius to come up with an algorithm that identifies these bots that appear to be perfectly normal players.

[Harko]

Agreed. It will take some kind of programming genius to come up with an algorithm that identifies these bots that appear to be perfectly normal players.

But those bots are perfect for GMs. A whole raid reported one farmer on my home server since he speedhacked around during a wintergrasp fight 10 feets above all normal players.

Perfect situation. They can send out standard messages after the people went offline and achieve the daily stint really fast.

Needles to say that the bot was still farming 2 weeks later (yesterday)

[numinis]

i've got a question, I have the sourcecode of a certain popular bot (which I won't name) written in autoit, I study programming but till now i've only seen java and script languages.

never used autoit tho, i'd like to update the bot for personal use, yet I don't know WHAT to change, the adresses are there, but I don't know which to change since it doesn't use the same names for them.

is it possible to do this with comparing the adresses from 3.1.1 bots to identify which need to be changed, or am I pretty much screwed? :s

thx in advance and sorry for my bad/terrible use of english and programming terms.

[LegacyAX]

i've got a question, I have the sourcecode of a certain popular bot (which I won't name) written in autoit, I study programming but till now i've only seen java and script languages.

never used autoit tho, i'd like to update the bot for personal use, yet I don't know WHAT to change, the adresses are there, but I don't know which to change since it doesn't use the same names for them.

is it possible to do this with comparing the adresses from 3.1.1 bots to identify which need to be changed, or am I pretty much screwed? :s

thx in advance and sorry for my bad/terrible use of english and programming terms.

Read the forum rules... and the title of this post...>_> This is to POST updated information for 3.1.2 not to ask for someone to hold your hand to update a stolen script...


BTW... More statics...

CastSpellByName:  0x004C4E90
LOOTWIND = 0x011E9AE4
GLobal Clip  :    0x010BD41C

[Travelformed]

combopoints : 0x11D4001 //3.1.1 0x11CCFD9

[numinis]

Read the forum rules... and the title of this post...>_> This is to POST updated information for 3.1.2 not to ask for someone to hold your hand to update a stolen script...

not what i'm asking tbh, I just need a starting point, i'm eager to learn myself yet unfortunately don't know where to begin :s well if it's against the rules don't bother, i'll keep on searching myself

thx for the reply anyway

[_duracell]

Both Sku and I just felt the wrath of the Banhammer for use of third party software. Lesson learned, be cautious everyone.

Some extra info:
We both used our own custom software (without proper Warden protection, I might add) which in my case was based on calling the 'standard' functions like GetObjectByGUID, GetTimeStamp, Lua_DoString and ClickTerrain. We both set the "End Of Text" address to -1 to allow our own lua/console functions to be registered. Could any Warden hero check if this address is watched?

3.1.2: 0x1070744

Sku wrote his own levelling tool, I used my pvp bot - we're both on 2 different servers... Because of this I very much doubt we both got reported by players at the same time. I suspect we got detected by changing something Warden watches.


EDIT: Continued to reverse stuff on my second account. Accidently loaded my framework and the darn static class patched the EndOfText address. Instaban DC THUNDER AND LIGHTING OUT OF WARDENS ARSE
This pretty much confirms my suspicions, Warden watches 0x1070744, hf boys and girls

Same thing happened to me yesterday. Custom app that I haven't released to anybody. I was editting the usual addresses like I normally do, player position, movement state, etc, and was slapped with a 72 hour ban, password reset, and an email from Blizz entitled "Final Warning."


hmm




EDIT: Also, I never touched 0x1070744. I'm not sure what triggered the ban.

[ramey]

Still going well with my private stuff.

[Cypher]

Bad luck @ everyone who got banned for the TextSegEnd modification. Then again, LOTS of people were using it afaik.

[_duracell]

I just tested on a trial account. I am getting banned for modifying one or more of the following playerbase offset addresses:


X=0x798
Y=0x79C
Z=0x7A0
Movestate=0x7CC


The thing is, the ban isn't instantaneous. I'm not sure if that's how it is normally done, but I can use my bot for about 5-6 minutes, then I get disconnected and banned.

[Hawker]

I just tested on a trial account. I am getting banned for modifying one or more of the following playerbase offset addresses:


X=0x798
Y=0x79C
Z=0x7A0
Movestate=0x7CC


The thing is, the ban isn't instantaneous. I'm not sure if that's how it is normally done, but I can use my bot for about 5-6 minutes, then I get disconnected and banned.

Aren't they read only?

[_duracell]

Aren't they read only?

Nope, I'm still able to fly through the sky, walk through walls, and all that. I just get disconnected and banned after doing it for a while.

[_duracell]

what exactly do change and in which zone

modifing z in the wrong place resulted always in an automated ban

I've been using my app for a while; going on about 5 months now. I've not gotten banned once until yesterday.

I modify the player Z, then render the change by jumping. I've been doing it the same.

[_duracell]

yes and this is and was detected since ~3 month.

do it in a highlevel outland instance (chest farmer anyone?) and you get banned within 1 hour.

thats why I asked where you did it.

So it is normal for blizz to take 3 months to temp ban me? It's coincidental that it happened right after I used the bot on patch 3.1.2 day?

I think it might be because there was a change in the new patch and warden is now scanning for new addresses.