What's new
By:
  • Visit Rebornbuddy
  • Visit Panda Profiles
  • Visit LLamamMagic
  • Visit Resources
  • Visit Downloads
  • Visit Portal

kicking everyone offline at the same time.

Status
Not open for further replies.
Caliboy said:
Everyone understands Warden, the question is why shut down wow and not just HB. Mass kicks offline seems like something Warden looks for. Its a fact that Warden and his band of marry men also use HB to help spot bots.
Click to expand...

Yes, another tripwire went off.

There are protected Lua functions inside WoW that are locked, HB injects its self as "unlocker" and allows you to run the bot that is executing protected code. This changes offsets in WoW memory, which is Warden designed to read/check for changes. When warden starts its scan trough the WoW memory, HB simply shuts down WoW as a security reason.
If HB only closes, but WoW left active THERE MIGHT BE A CHANCE that some third-party HB leftover can be found in WoW memory. Stuff like addons, combat routines, quest patterns and some more.
Look at it like two evils:
1. Bigger evil, is that HB was shut down, but WoW left active and Warden finds residue of HB injections. Easily proved that you botted.
2. Lesser evil, WoW shuts down completely together with HB interrupting Warden scan. That way you would be safe from Warden scan as theres nothing for him to scan, you just shut down the game. Yea, Blizz might see that you closed your WoW in exact same time together with x number of people when warden started his scan, and find it suspicious, but this proves nothing as you might just be logging out.

Both options are dangerous, as boting it self, Bossland team choose to take less dangerous solution, that is to shut down wow completely and protect you from possible detection.

Similar stuff is already written in the guide that was posted on page one, you havent even took the time to read it trough, as if you did you wouldnt ask question repetitively, question that is answered few months ago.

"So why does Honorbuddy close the WoWclient?"
There is a small chance that third-party offerings (plugins, quest behaviors, combat routines, etc) may have left artifacts in the WoWclient that are detectable by the Warden update. The Tripwire design takes the "lesser of two evils" approach—it chooses to close the WoWclient (leaving only circumstantial evidence), rather than leaving artifacts in the WoWclient that would allow an affirmative detection.
Click to expand...

Ill post link to complete statement again so please took a little time to read it, everything is there:

BosslandGmbH:HelpDesk:What is Tripwire? - The Buddy Wiki
 
Caliboy said:
Everyone understands Warden, the question is why shut down wow and not just HB. Mass kicks offline seems like something Warden looks for. Its a fact that Warden and his band of marry men also use HB to help spot bots.
Click to expand...
Tripwire is activated when a live change is made to the warden. The warden is like a club bouncer, and has generally been pretty terrible at its job for years now. The difference between patches and these live updates is that Honorbuddy is active during these updates, and if the warden was given some new capability to find information from Honorbuddy in your client you'd definitely be banned, as opposed to looking suspicious when a thousand or so accounts go offline at once.

Warden definitely doesn't look for all of the accounts that shutdown. The tripwire will send a signal to all of the different Honorbuddy's to close, but that is going to be delayed depending on your internet quality, location relative to the auth servers, ...etc. Blizzard has no real way of figuring us all out within this varied timeframe without banning lots of retail players. This has been mentioned many times over, and the search function should prove useful next time.
 
gorunn said:
Yea, Blizz might see that you closed your WoW in exact same time together with x number of people when warden started his scan, and find it suspicious, but this proves nothing as you might just be logging out.
Click to expand...

What would Evil Leo do:

Update Warden. Save list #1 of everyone who logged off.
Update Wargen. Save list #2 of everyone who logged off.
Update Warden. Save list #3 of everyone who logged off.
...
...
Update Warden. Save list #30 of everyone who logged off.

Compare lists. Everyone on x% of the lists is banned.

Even if you're not botting and were unlucky to be logging off with every HB user, you won't be unlucky 10+ times.

But that's just what Evil Leo would do... Sometimes I'm scared of myself.
 
Caliboy said:
Traces of HB in the game instance? I don't understand that at all. Either the bot is working or its not, how can there be traces of it when its shut down? Don't see the reason to close wow.
Click to expand...

You couldn't be more wrong... If you have no idea how programs work, then please don't pretend like your'e the all knowing and all seeing... Just because HB isn't running at the moment, it doesn't mean that Warden can't detect the fact that it was in fact running once before... HB Leaves behind traces of it being there, let me explain it like this... Lets say it "Reads" and "Rewrites" Code, now when HB Closes out of WoW & WoW is still running, the code that was "Rewritten" is still "Rewritten". So warden can see the code is now different than it is supposed to be. So for you leaving WoW running, and leaving the "Rewritten" Code still lingering,(Because you didn't restart wow, like the devs suggested) your'e account receives a ban. Now that you've been banned your'e pissed and complain to the devs of HB for not protecting your'e account by simply shutting down WoW(Hiding the "Rewritten" code). Now do you understand? Now that its been explained to you multiple times?
 
Im not a genius in programming.
I'm tho a mastermind when it comes to people.
How to fake people without letting em know.

Im going free mind here. Dont be a hater....

All of us who is the unlocky onse.

1. keep login in to wow. Even through the bot dossent work.. Keep a routine.
2. stay online as u would. maby level a new carrektor or more.
-----
3. Developers. If u exit a store with some stolen cloth. you trip the alarm and attract the guard.
If 900 people steal som cloth in the same store and exit at the same time. You'll hit CNN News.


I have a question for the staff member(s)

1. You'll inject the game. Why not make a UI and use that as a "shild".
2. is this a starting war ?
 
First, do not speculate or post false information during these events as it causes non savy users to file reports and questions that the dev tem and mods to have to look into when they have much more important jobs on their desks.

Second, when tripwire is activated either due to a warden push or some other unknown cause, there are two options:

1. Shut down honor buddy and leave wow functioning
2. Shut down wow, and honorbuddy as there is no need to run honorbuddy if wow is closed

The first one may seem like the easiest and most logical to avoid the mass dc that ensues from online bots, but take a moment to consider the following. Lets say on average during a trip event there are 2500 to 10 000 bots running world wide, and when a warden push is issued all of those accounts stop functioning. Blizzard now has the ability to search for all accounts that stopped the millisecond the push occurred and can run a diagnostic on the accounts (that are currently idling) to find a common denominator. This common denominator would be what ever injection lingers after the HB shutdown and they would be able to reverse engineer HB processes, flag accounts to ban that are using the injection method, and update warden for future injections.

The second option may seem like a more obvious detection method for blizzard but consider the following. If there are 8 million players worldwide, and we average that out over a 24 hour cycle, and further average that over the 60 minutes to an hour, we get that ~6000 accounts log on and off each minute. This means that during a tripwire event, the average minute in the wow log on / log off database may have an irregular influx of a few thousand. In this situation blizzard might see an influx of accounts logging off surrounding their secret push of a warden update, but still need to process the data surrounding the cause. Keep in mind that prior to the event HB was functioning properly and evading warden detection. If they search through the data for a common denominator, whatever they find will not be the injection method used by HB.
 
verigan said:
Im not a genius in programming.
I'm tho a mastermind when it comes to people.
How to fake people without letting em know.

Im going free mind here. Dont be a hater....

All of us who is the unlocky onse.

1. keep login in to wow. Even through the bot dossent work.. Keep a routine.
2. stay online as u would. maby level a new carrektor or more.
-----
3. Developers. If u exit a store with some stolen cloth. you trip the alarm and attract the guard.
If 900 people steal som cloth in the same store and exit at the same time. You'll hit CNN News.


I have a question for the staff member(s)

1. You'll inject the game. Why not make a UI and use that as a "shild".
2. is this a starting war ?
Click to expand...
I just lost 5 seconds of my life I can never get back...

edit: Allow me to put this into perspective. If I were a Blizz GM I could come onto this site and DL a "Public Gathering profile" open it with Notepad and pick any x,y,z coordinate listed and fly there. <Insert one button ban macro> because business is about to be booming. Likely catch as many Botters with as much accuracy as Banning every account that logged of during a Tripwire Event
 
Last edited:
leoff said:
But that's just what Evil Leo would do... Sometimes I'm scared of myself.
Click to expand...

Actually thats the first thing that crossed my mind way back after second tripwire
 
Last edited:
Maybe they look at the player patterns like all the players that stay offline for hours when they usually should be on playing when tripwire activates and then blizzard flag those accounts.
 
This is all speculation......how easy would it be to get legit players caught up in this batch. This reminds me of the IP address arguement that has waged on. I really find it hard for them to ban based on logging off at same time because well not even the bot goes down at the exact second for all of us. We don't all shut down at 3:01 and 36 seconds. I am sure others can tell you their shut down was 5 to 10 minutes apart. Now imagine them trying to do this across 7 million accounts.
 
If a detection of HB were to take place, if wow is closed immediately, it can't report back anything that was detected. So closing WoW would save your account.
 
Status
Not open for further replies.
Back
Top