This is totally insane. We should hire/donate some great programmers or someone to reverse engineering this thingy.
This is totally insane. We should hire/donate some great programmers or someone to reverse engineering this thingy.
You are the one trying to mislead I'm afraid...
The "convenient" comment meant that there is a direct connection between Activision Blizzard and Digimarc, a company which specializes in watermarking. They could have used a different company, but Digimarc's patents seem quite appropriate for what Blizzard is trying to accomplish.
Until we hear from an Assembly programmer, I am trying to reverse engineer this pattern visually.
Reference: https://i.imgur.com/I4hnr.jpg
Red: static, Blue: dynamic
It has become obvious to me that the dynamic parts indeed contain a timestamp of hours and minutes (HH:MM), but not seconds.
If you capture two screenshots within the same minute you will see that they have exactly the same patterns.
If you capture them after the minute changes, the entire dynamic part is different, which means that the blue part I've marked in the image contains HH:MM.
Please note, this is based on the server clock! Not your local clock/time.
Now... let's work on the red part
Last edited by Sendatsu; 09-10-2012 at 12:44 AM.
l0l1dk that's a really interesting screenshot: https://i.imgur.com/v3vv0.jpg
I thought that this pattern was the old pattern used before Patch 4.2, but apparently you still have it.
What's your screen resolution?
Agh then I made a mistake. There is only one pattern, nothing changed last year. I'll correct my posts. Thank you.
Thank you for sharing your thoughts.
I do not know if Blizzard is using any other methods of watermarking; I just know what I see. What I see is a white image with a hidden repeating (watermark) pattern which changes based on the minute the realm's clock is set at. A repeating pattern which stays the same if you printscreen within the same minute, even if you move your camera and take different shots. A repeating pattern which is aimlessly repeating itself, not to save us disk space by compressing the image, but in order to be able to prevail among our graphics and have at least one full piece of it survive even if we modify the image.
If you want the why's and the when's, ask Blizzard why they did it and when they started doing it; I'm not their lawyer nor their business/technical consultant.
If you want the how's, take a look at the Assembly code post in the previous pages (http://www.ownedcore.com/forums/worl...#post2489452):
This function saves your screenshot. This function also puts a watermark on top of your screenshot.ScrnScreenshot(s_captureScreen, s_pWatermarkData, s_uWatermarkDataBytes, s_screenshotFolder, s_screenshotNameOverride, s_depthNameOverride)
This thread post has nothing to do with aliens, government conspiracies or murlocs. It's about the fact that Blizzard has been using watermarking technologies to tag the screenshots we create, using their in-game mechanism, with our information -- because they can.
Last edited by Sendatsu; 09-10-2012 at 08:40 PM.
Please stop calling them artifacts, as if these very specific repeating patterns "happened" to occur "randomly". It is a watermark; it is the very definition of a watermark.
I am trying to reverse engineer it from the outside using trial and error at the moment. The dynamic part seems to be affected by the hour:minute combination so it looks like a date/timestamp or something that is affected by the current minute. I do not yet know for sure exactly what is contained in the static part. Feel free to experiment and help out.
Last edited by Sendatsu; 09-10-2012 at 12:13 AM.
Use cheat engine (or any other memory viewer) and look at "wow.exe+DC9240" (windows 32 bit client). The data is 88 bytes long and the first 64 are reserved for account name. (wow account, not battle.net account). Then there's a 4 byte timestamp (server time, 1 minute precision) and 20 bytes of something else.
I made a quick cheat engine script to get "clean" screenshots of the watermarks. It clears the framebuffer just before the watermark is added so only the watermark itself is saved. It also forces watermarks to be added to lossless tga images. I didn't bother checking if the addresses are watched by warden (unlikely, but not impossible) so use at your own risk or use a trial account.
How to use:
In cheat engine click "Memory View"
From the Tools menu select Auto Assemble
Paste the script
Press execute
take a screenshot in wow
Remember to set the screenshot format to TGA. Paste
/console screenshotFormat tga
in the chat.
Example image https://dl.dropbox.com/u/12654979/Wo...012_114416.tgaCode:alloc(newmem,2048) alloc(memset, 100) label(returnhere) label(originalcode) label(exit) memset: push edi push ecx push eax pushfd cld mov edi, eax // pixel buffer imul ecx, edx // ecx = height, edx = width mov eax, FF0000FF // light blue color, full alpha rep stosd popfd pop eax pop ecx pop edi ret newmem: call memset originalcode: call wow.exe+7B6780 exit: jmp returnhere wow.exe+18DCD2: jmp newmem returnhere: wow.exe+18DCAC: // TGA patch nop nop wow.exe+18DCB5: // jpeg quality patch nop nop
The fact that all 11 rectangles are pixel-perfect identical, and the tga format itself, should prove that it's not compression artifacts.
The data encoding seems to be in column-major order with 4x5 pixel "bits". A dark bit is 0 and light is 1. There also seems to be some kind of CRC/ECC.
Yep, get the artifacts when I take a screenshot as well.
Thank you _Mike for your research!
I made a small program which is able to differ between the dark and the light pixels. All pixels with a blue-level higher of 240 (RGB) will be threaten as 0. The remaining pixels will be threten as 1. This seems to be the most accurate value to differ them. Here is your picture converted: http://img89.imageshack.us/img89/883/outputk.png (use photoshop or gimp in zoom view - not irfanview).
Now i will try to translate the binary result into printable text. Lets see if it works.
I have little doubt that it's an actual watermark. However, if the only name it reveals is the account name (which can be linked to you only by Blizzard, and I really doubt they'd put character names or account email into the watermark), I wouldn't be too fussed about it. It is very unlikely that Blizzard has a squad of cyberspies who stalk forums like this one.
Or do they?
*CUE DRAMATIC MUSIC*
Nice filtering. A bit easier to see than the blue on blue It's not per-pixel though. Each bit is 4x5 pixels, and column-major ordering starting at top left. That image starts with 1000...
Yes the account name is the only personal data in there. And yes it seems strange that they'd try to track players this way. It might possibly be used to track internal leaks of screenshots of unreleased content. But even that is a bit far fetched.
Btw, bonus +rep to whomever first posts my account name I've verified that it's in there.