[Question][Networking] Bot Detection

[dook123]

My question pertains to this:
4D8610 Send_CMSG_BOT_DETECTED2

I believe this message would be sent from client to server if the client(warden) detected a bot.

I'm wondering if its possible to drop these messages if they are ever sent?

I know wow used to send unencrypted data and now it encrypts some of it. I would guess this is encrypted so figuring out if it was sent would be challenging.

On that topic, anyone know what type of encryption is used?

Thanks for your help

[BoogieManTM]

RC4 encryption.

In all of my years of wow protocol reversing/analysis (since beta), I've never seen those opcodes being used. If they want to get you like that.. they're not going to be that obvious.

[dook123]

Thanks for the reply.

I suppose it wouldnt be that easy would it

Im happy to hear its RC4, higher potential to decrypt, hopefully a small key as well. Im sure they were going for speed and to deter simple plain text reading.

/closed

[XTZGZoReX]

According to Ralek, those (and some related opcodes) were used to catch InnterSpace and Glider. They're no longer in use, I don't think.

[andy012345]

Yeh theres a bunch of client checks for glider and innerspace, seperate from warden. I believe in the PTR builds you can see the client even crashes with the assertion "glider" for example.

These opcodes have nothing to do with warden.

[BoogieManTM]

According to Ralek, those (and some related opcodes) were used to catch InnterSpace and Glider. They're no longer in use, I don't think.

Hmmm. I was under the impression that that detection method hijacked other packets (I know for sure it was trigged by SMSG_FRIENDS_LIST). I'm pretty sure those opcodes are from beta and were never really used. If they did use that.. lolll. funneh

[XTZGZoReX]

They did use them.

BTW: https://bitbucket.org/XTZGZoReX/wowp...dler.cs#cl-123

(Yes, I know it's not part of Warden, I just put it there anyway.)

[BoogieManTM]

Ahh.. interesting. I wonder if sending that packet would still get ya banned :P