Looking inside your screenshots

[Sendatsu]

I found a pretty good solution to "check" normal screenshots, for that pattern.
go here: Free Online Image Error Level Analysis using HTML5 - 29a.ch
drag and drop your screenshot in there and play around with the sliders.
This is an example from my screenshot. I just marked the pattern with paint.

https://i.imgur.com/r7DiL.jpg
https://i.imgur.com/ojPZ5.jpg
https://i.imgur.com/j7rVr.jpg
https://i.imgur.com/oUKaY.jpg
https://i.imgur.com/vsffK.jpg


Found them again and again and again inside my screenshots. I feel kinda naked now...
I know that there is no sensible Data inside them, but i feel really naked against that company now. I knew every chat-log was saved before, but that's some kind of freaky cause it was secretly hidden all the time right in front of our eyes.

Edit: A big german gaming magazine wrote already about it. World of Warcraft - Screenshots werden mit Spionage-Watermark versehen - News - GameStar.de
And also a big german "IT Online Newssite" WoW-Screenshots: Setzt Blizzard Wasserzeichen? - WinFuture.de

That's a really cool tool DeXoY! Gotta love HTML5! Thanks for sharing!

[DeXoY]

No problem. That little tool allows all the none believers to simply check their own screenshots without any knowledge.

[filuta]

Found a screenshot from 2.1.0 PTR with a visible pattern. original pattern

[Fayntic]

Can you post it so they can check the timestamp?

[FattyXP]

Is it possible that these "barcodes" could contain process/memory information? Such as the values of certain commonly hacked variables? Or do we definitively know everything that these codes say?
Or perhaps just something like the readout you get when you crash and then the report to blizzard window comes up, lists all of the loaded modules inside of wow (including things like OHack, anything that is injected comes up in this list AFAIK, at least the hacks I've used) Would be a really good way for them to detect people since anyone with a brain doesn't send in crash reports when they are hacking.

[Sendatsu]

Is it possible that these "barcodes" could contain process/memory information? Such as the values of certain commonly hacked variables? Or do we definitively know everything that these codes say?
Or perhaps just something like the readout you get when you crash and then the report to blizzard window comes up, lists all of the loaded modules inside of wow (including things like OHack, anything that is injected comes up in this list AFAIK, at least the hacks I've used) Would be a really good way for them to detect people since anyone with a brain doesn't send in crash reports when they are hacking.

Hello FattyXP

We now know exactly what is stored inside the watermarks so no need for guessing Please see this post: http://www.ownedcore.com/forums/worl...ml#post2493603 (Looking inside your screenshots)

[ukilliheal]

My theory is that the current watermark could be used to figure out if a screencap submitted with a bug report has been edited, which would explain why its taking up so much space. However that is not to say that the watermark doesn't serve some other purposes such as tracking down private servers and catching people doing stuff that blizzard would disagree with.

[Sendatsu]

My theory is that the current watermark could be used to figure out if a screencap submitted with a bug report has been edited, which would explain why its taking up so much space. However that is not to say that the watermark doesn't serve some other purposes such as tracking down private servers and catching people doing stuff that blizzard would disagree with.

If they only wanted it for authenticity reasons, they could have just watermarked a unique version of their logo or perhaps an encrypted key. But we found account and realm info which means that its original aim was to secretly track the users, in addition to the known tracking methods that we agree to in the ToS.

Bear in mind that when this started, back in 2007, we were using our account name to login so, before the battle.net conversion in 2009, the watermarks actually had really sensitive information. Between May 22, 2007 and November 11, 2009, any malicious hacker who knew about this could use a screenshot of a lucrative character to find their actual username & active realm and then either try to scam them out of their password, or just brute-force it.

[FattyXP]

Hello FattyXP

We now know exactly what is stored inside the watermarks so no need for guessing Please see this post: http://www.ownedcore.com/forums/worl...ml#post2493603 (Looking inside your screenshots)

Ahh thank you, that post was rather buried lol.

[g1zm0]

Can clearly see the pattern in screenshots from December 2007. Never really noticed it until now so it was well hidden. On the right of the moon.

[Thundathigh]

Looking at one of _Mike's earlier pictures, it seemed that the watermark was applied to SS's by adding a little more blue. But using a SS from inside of the tree in Crystalsong Forest, I made a program in Java to check the RGB value of each Pixel, and found that where the watermark was applied, it changed ALL of the RBG values (253 or 254 instead of 255).

Watermark - Imgur (All from the Crystalsong Forest picture, Shadowmoon Valley not shown.)

Since I had trouble doing the same with an almost black SS from the Nether in Shadowmoon Valley, it seems to imply that the watermark is subtracting some of the RBG value, rather than adding any one color ontop. Does anyone know how the watermark is applied?

[Sendatsu]

Looking at one of _Mike's earlier pictures, it seemed that the watermark was applied to SS's by adding a little more blue. But using a SS from inside of the tree in Crystalsong Forest, I made a program in Java to check the RGB value of each Pixel, and found that where the watermark was applied, it changed ALL of the RBG values (253 or 254 instead of 255).

Watermark - Imgur (All from the Crystalsong Forest picture, Shadowmoon Valley not shown.)

Since I had trouble doing the same with an almost black SS from the Nether in Shadowmoon Valley, it seems to imply that the watermark is subtracting some of the RBG value, rather than adding any one color ontop. Does anyone know how the watermark is applied?

Looks like progress! Nicely done I believe it may have something to do with luminance hiding, like steganography does. You may want to check out Digimarc's patents to learn more: http://www.ownedcore.com/forums/worl...ml#post2490910 (Looking inside your screenshots)


EDIT:

I'll help some more. Start with a normal un-cropped and un-blurred screenshot that you just captured from WoW. Let's say it's 1680 x 1028 so the first appearance of the pattern would start at 121 x 151. The next 352 x 240 pixels is a full version of the pattern hidden among the graphics. Retrieve those pixels only and split them in 4x5 parts to end up with a total of 4224 items (88 bits per row, 48 per column). Mess with the luminance, or any other thing you may think of, in order to figure out which one is a full black item and which one has a space invader inside :P Then you'll have the pattern ready for conversion into 0s and 1s


EDIT#2:

I also updated my Java code to make the pattern => bits conversion faster, check it out: http://www.ownedcore.com/forums/worl...ml#post2492716

[Thundathigh]

...
the first appearance of the pattern would start at 121 x 151.
...

That's what I'm having trouble with, where are you finding that number from?

I was trying to do x = imageWidth/2 - patternWidth, (where patternWidth is 352), but that gets me no where near the right amount. I realize that a SS taken with resolution like _Mike's would require me to subtract the pattern width twice, but that still doesn't get me 121 (it gets me 136). How are you coming up with those numbers?

[Sendatsu]

That's what I'm having trouble with, where are you finding that number from?

I was trying to do x = imageWidth/2 - patternWidth, (where patternWidth is 352), but that gets me no where near the right amount. I realize that a SS taken with resolution like _Mike's would require me to subtract the pattern width twice, but that still doesn't get me 121 (it gets me 136). How are you coming up with those numbers?

If you look closely, you'll see that the same pattern repeats 4-3-4. Horizontally they have +[8,12,8] pixels in-between and vertically +[4,4] pixels. So we have:

Horizontal axis: 352+8+352+12+352+8+352=1408+28=1436 pixels
Vertical axis: 240+4+240+4+240=720+8=728 pixels

So now you have to center a 1436 x 728 watermark inside a 1680 x 1028 image.

Width: 1680 - 1436 = 244 / 2 = 122
Height: 1028 - 728 = 300 / 2 = 150

And you are right, the centering is not correct, it's -2 to the left. Interesting. I wonder if that is because of our conversion or their code.

It should have been 122+1x150+1 but now its 120+1x150+1 and the extra 2 pixels are to the right of the watermark, so it leans a bit to the left.

[Aegean]

I approve of this thread +rep