The Free Lunch Is Over - Obfuscation is Coming

[SerenityWOW]

Hmm, my AHK button smashing script is still working on 7.3 (like the one you posted)

[BlackRainBow]

Cant send keyboard input anymore.

maybe this? Raw Input (Windows)
even without hook and check LLKHF_INJECTED possible drop fake SendInput's, because they don't have device handle in RAWINPUTHEADER

Mouse SendInput, for example, simply detected via GetAsyncKeyState

var d = GetAsyncKeyState(mouseKey) & 1;
if (d == 0)
MessageBox("FAKE");
else
MessageBox("REAL");

[olilo1]

Hey guyes. Thanks for your suggestions.

I live in europe and patch didnt hit before today. But it works after all! But it did not work during PTR.
I started a thread asking if anyone else had the problem on PTR, so I assumed the worst:

[Question] AutoHotKey stopped in 7.3?

[noctural]

So, say I injected before. Now, is it a solid strategy to run wow, dump memory to disk, scan for disk image for offsets, then inject using those offsets?

[CatsNimo]

The Release build removed this obfuscation. The WoW binary is back to normal.

I assume this means they're still testing it and aren't ready for it to go Live yet.

[Torpedoes]

The Release build removed this obfuscation. The WoW binary is back to normal.

I assume this means they're still testing it and aren't ready for it to go Live yet.

Are you sure? it's still garbled for me (7.3.0.24931).

[CatsNimo]

Are you sure? it's still garbled for me (7.3.0.24931).

Ah, you're correct. My bad. I just saw the file size drop from PTR to Release and assumed it had gone away. It's the same as PTR though; Live Windows is obfuscated and Live Mac is not.

Interesting side note; Blizzard just released a 7.2.5 build on their Beta branch without the obfuscation, presumably since it's branched away.

[air999]

Live Windows is obfuscated and Live Mac is not.

Now is good time to move into Mac World

[Torpedoes]

Now is good time to move into Mac World

Shameless plug but both robot and (Writing Bots with Robot-js)robot-js support mac :-D

[Sariam1992]

maybe this? Raw Input (Windows)
even without hook and check LLKHF_INJECTED possible drop fake SendInput's, because they don't have device handle in RAWINPUTHEADER

Mouse SendInput, for example, simply detected via GetAsyncKeyState

var d = GetAsyncKeyState(mouseKey) & 1;
if (d == 0)
MessageBox("FAKE");
else
MessageBox("REAL");

Sorry, I've read the whole thread and I'm a bit confused by the virtual key imput, does that mean it could be detected now, making pixel bots like chimpeon a lot more likely to be hit?

[olilo1]

Sorry, I've read the whole thread and I'm a bit confused by the virtual key imput, does that mean it could be detected now, making pixel bots like chimpeon a lot more likely to be hit?

No. It's my fault for the confusion. Pixel bots are still good.

The PTR client didn't accept inputs from autohotkey, but retail client does. No idea why though.

[Sariam1992]

Thanks for the reply mate

[Stonerage]

It's interesting that they explicitly mention out of process now. Did they not look at out of process in the past?

So, from the previous it just checked for software running alongside the game which sounds logical and memory efficient. So I brainstormed and then came to the conclustion that I should deob and decrypt their android apps and see if it yields any interesting results in how they monitor memory on android.

But staying OT.
What are they referring to by out-of-process?
I can only assume they're referring to out of process as in out-of-process.

Seeing as they've renamed from "Game" to "The platform" for most of it, but not in that specific context. Are they referring to the battle.net app? Are they planning on monitoring in how programs run at the same time as the battle.net app? This sounds the most logical to me, would allow them to see if a piece of software is launched/exited along side any of their games and especially seeing as they've added "Mobile Device" to the list. Perhaps they're trying to target their entire branch? After all the only thing you could possibly do on the mobile app would be to bot follower missions.

[Torpedoes]

So, from the previous it just checked for software running alongside the game which sounds logical and memory efficient. So I brainstormed and then came to the conclustion that I should deob and decrypt their android apps and see if it yields any interesting results in how they monitor memory on android.

But staying OT.
What are they referring to by out-of-process?
I can only assume they're referring to out of process as in out-of-process.

Seeing as they've renamed from "Game" to "The platform" for most of it, but not in that specific context. Are they referring to the battle.net app? Are they planning on monitoring in how programs run at the same time as the battle.net app? This sounds the most logical to me, would allow them to see if a piece of software is launched/exited along side any of their games and especially seeing as they've added "Mobile Device" to the list. Perhaps they're trying to target their entire branch? After all the only thing you could possibly do on the mobile app would be to bot follower missions.

I have a prediction. Very soon (maybe even as soon as October as that's when they're planning on dropping XP), we'll see the Battle.net app include other components related to anti-cheating. I would go so far as to say they'll start doing what every other anti-cheat system has done for a while now, kernel hooks. So you wanna play Blizzard games? install an EAC style anti-cheat. Perhaps this is their response to Windows Containers coming in the future. So perhaps it's time to brush up on your kernel skills, or just get a Mac :-P

[WiNiFiX]

maybe even as soon as October as that's when they're planning on dropping XP

Where did you see this, I cant see dates specified anywhere?