Speed Hacks

[Tanaris4]

So I see a lot of programs that have been released that enable speed hacks, and it seems they're done a few different ways:

• Changing an offset
• Actually intercepting messages sent to the game server + changing them slightly to move quicker

This is all I've really seen thus far. So I wanted to ask HOW people achieve the first method? And do you actually receive a ban from a server-side calculation? Or warden only?

And yes, I'm thinking of how Warden doesn't check any offsets (that I'm aware of) on mac. Just wanted to play around a bit since I realized wall walking works

Thanks!

[Cypher]

So I see a lot of programs that have been released that enable speed hacks, and it seems they're done a few different ways:

• Changing an offset
• Actually intercepting messages sent to the game server + changing them slightly to move quicker

This is all I've really seen thus far. So I wanted to ask HOW people achieve the first method? And do you actually receive a ban from a server-side calculation? Or warden only?

And yes, I'm thinking of how Warden doesn't check any offsets (that I'm aware of) on mac. Just wanted to play around a bit since I realized wall walking works

Thanks!

It's still possible to use the old and trivial method of just hooking the timing APIs (GetTickCount, QueryPerformanceCounter, etc) and spoofing the return values. Yes, this method is currently 'detected', but it's relatively easy to bypass the check.

Most of the 'changing an offset' hacks work by doing the same thing afaik (or at least, the ones I've reverse engineered do), they simply do it by hooking the engine and modifying the return value of the engine functions that are responsible for timing, rather than the timing APIs themselves. Basically it's 'same shit, different smell'.

The two methods above will give you the effect of speeding up the entire game, which is kinda annoying, but still, you're moving around at warp speed, so it's a concession most people are willing to make. :P

There were also a couple of hacks that were hooking the engine to implement a 'true' speed hack (i.e. only speeding up the player's movement), but this is harder to do, as there are server-side checks in place to stop this (unlike the method above, for some retarded reason -- if anyone remembers, they started detecting it serverside in the PTR ages ago then pulled it, what the **** is up with that?). Still very possible though.

Lastly, there were some a while back that used packet spoofing with no hooks, though I'm not aware of any that still do this (then again, I haven't really been doing WoW shit for some time now, so take that with a grain of salt).

Cliff notes version:
* If you want an easy to implement but slightly buggy speedhack, then just hook the timing APIs or the engine function(s) responsible for calling the timing APIs.
* If you want a 'proper' speedhack, then get to work reversing all of WoW's movement related code, and be prepared for quite a bit of trial and error.

[Robske]

The 3 speeding techniques Cypher discussed are still working as of today (their detected state is another story). Either way, you won't get around the timing API's one way or another, if you opt to send a flurry of movement packets (and hence go out of sync) you still need to fix your TickCount in some way.

[namreeb]

Lastly, there were some a while back that used packet spoofing with no hooks, though I'm not aware of any that still do this (then again, I haven't really been doing WoW shit for some time now, so take that with a grain of salt).

This method 'works' but you have to clean up after yourself when you're done. If you're only spoofing the packets then the client will not know about your new position when the movement is over, so you must either update it as you go or once you've finished. Same thing with time, I believe. That is that presumably in the sped up packets you're fast-forwarding the current time reported to the server by the client, as heartbeat packets are always sent every ~500ms by their time parameter. You'd have to fast-forward the internal clock, as well.

Edit: Oh, Robske already said most of this.