What's new
By:
  • Visit Rebornbuddy
  • Visit Panda Profiles
  • Visit LLamamMagic
  • Visit Resources
  • Visit Downloads
  • Visit Portal
RebornBuddy Forums

Register a free account today to become a member! Once signed in, you'll be able to participate on this site by adding your own topics and posts, as well as connect with other members through your own private inbox!

Friendly reminder

Status
Not open for further replies.
D

deknarf

Member
Joined
Mar 24, 2014
Messages
103
A week before the most recent tripwire event, it was already known that blizzard had updated their bot-detection methods for the x86 (32-bit) client.

Just saying.

(yes I can provide a source for that information, yes I know what I am talking about, yes I know how detection works)

I'll explain how you are getting detected:

Warden - blizzards anti-ch3at - checks for HB at specific moments, being:
  • Account Login
  • Character Login
  • Character Logout
  • Account Logout
  • Client Closing

For semi-non-nerds: Imagine the wow client's code being made up in layers, like a folder structure on your computer.

So... for a long time, Warden searched as deep as (for example) 4 layers -- No problem, HB team knows this, so they inject on the 6th layer...

TripWire was designed to check for any changes in the first 4 layers.... because in the past, that's how deep they could go and not be detected, until warden was upgraded. (cat and mouse game)
What HB/TripWire does NOT know is that blizzard upgraded warden, to go (for example) 6 layers deep or even further...

At that point, TripWire is outdated & Everybody got detected.

See what I'm getting at here?

TripWire was either turned on manually, or it detected the changes A WEEK LATER.
 
Last edited:
How many years after the fact and we're still making ourselves targets by using outdated clients? lol. I give up.
 
Thanks for this valuable bit of information, I'm sure the developers never thought about that. /sarcasm
 
me to i just got a 6 month suspension on my main account 11-100s all 715+ ilvl maxxed rep and professions but hey if you play you pay so im back to my other account with 1 level 90 and starting over it is either wow or i will end up devoriced
 
What really makes me sick is i used the bot for like 2 minutes before on tripwire to check something on my full mythic 21k achivement points main account , and i still have 3 crappy accounts running at this time and they are fine this pisses me off ....what a luck
 
Omg thanks so much for sharing! I'll skype raphus right away to let him know that warden was updated and I'll explain to him how his tripwire works!
 
@pookthetook Mr. Buddy Store Developer, I'm not here to explain call stacks.
I'm not here to explain hbdetectionlualoadhook. I'm here to explain the vast majority of users - that simply click the hb executable and log into wow - what's what.
 
Last edited:
deknarf said:
A week before the most recent tripwire event, it was already known that blizzard had updated their bot-detection methods for the x86 (32-bit) client.

Just saying.

(yes I can provide a source for that information, yes I know what I am talking about, yes I know how detection works)

I'll explain how you are getting detected:

Warden - blizzards anti-ch3at - checks for HB at specific moments, being:
  • Account Login
  • Character Login
  • Character Logout
  • Account Logout
  • Client Closing

For semi-non-nerds: Imagine the wow client's code being made up in layers, like a folder structure on your computer.

So... for a long time, Warden searched as deep as (for example) 4 layers -- No problem, HB team knows this, so they inject on the 6th layer... TripWire is designed to check for any changes in the first 4 layers....
What HB/TripWire does NOT know is that blizzard upgraded warden, to go (for example) 6 layers deep or even further...

At that point, TripWire is outdated & Everybody got detected.

See what I'm getting at here?

TripWire was either turned on manually, or it detected the changes A WEEK LATER.
Click to expand...


What's your point? The HB team already admitted the problem. I don't know how you think providing this information is ground-breaking or even new at this point...

And you should just stop talking about 32-bit. There's absolutely zero proof anywhere that HB being 64 bit would protect HB users any more, nor is there any proof anywhere that Warden is different between 32 and 64 bit...As a matter of fact, you could basically guarantee that they are the same. If tripwire isn't effective, being 64 bit will not protect any one any more than it already is. At least you have a different argument than the usual users saying that 64 bit will protect us more...Albeit a once again false argument for x64.

If you can provide a single piece of evidence that warden is different between the x86 and x64 clients, I'd love for you to actually provide it...My guess is you can't.

If you think a 64-bit bot is going to protect you, please go and use that bot and stop posting completely useless information about systems you know nothing about.
 
The answer to the question about the usage of x64 is partly in the first post, where I sketch how detection/protection works.

As to what I personally think of the matter?
1: They don't change to x64 because they lose x32 VMs/wXP multi-multi botter customers
2: It's a lot more difficult

---------------
@ryftobuddy
Just don't talk to me. Ever.
 
deknarf said:
@ryftobuddy
Just don't talk to me. Ever.
Click to expand...

And what exactly are you going to do about me posting facts in your thread? I see you can't provide any evidence that they are different, so I believe my point still stands.
 
ye honorbuddy is stil banneble i had a new account i questbotted for a few days and im banned i wil not touch hb anymore im now botting in diablo witch is fine
 
@ryftobuddy
If you are so determined to prove me wrong, why don't you prove me wrong by showing me that the 2 clients are the same?
That's the only thing you seem capable of doing anyway. Claiming other people are wrong and expect them to provide you with proof of how your accusation is invalid, instead of being an adult and not speak before YOU are actively contributing to the discussion (with said proof)
 
wow blizzard does care alot about wow botting not so mutch about diablo thats why there arent mutch bans in diablo and there are in wow its just that its to mutch money buying evry week a new account
 
deknarf said:
@ryftobuddy
If you are so determined to prove me wrong, why don't you prove me wrong by showing me that the 2 clients are the same?
That's the only thing you seem capable of doing anyway. Claiming other people are wrong and expect them to provide you with proof of how your accusation is invalid, instead of being an adult and not speak before YOU are actively contributing to the discussion (with said proof)
Click to expand...

I don't need to prove you wrong...All you are is another user coming to these forums claiming they know something that noone else does and making absolutely false arguments for a change that can in no way guarantee anyone's safety.

And I'm still curious what you think you can do to keep me or anyone else on these forums from responding to you? I'm not one of those people that reads things on these forums and blindly assumes that the person making claims knows what they are talking about...There's absolutely nothing you've posted that anyone should take as fact. There's nothing I've posted that anyone should take as fact either...The difference is I can admit that I could be wrong. Until you can prove otherwise, I'll continue to assume I'm right though.
 
You first statement about different detection stacks is wrong.


You can do an Assembly edit very easily with quite a few programs out there and just like with most unprotected injection methods will be flag within an hour normally for a ban.


Especially things that flag for sever alteration such as movement speed changes etc. So that whole thing about login charter screen is pointless and 100% incorrect.


Delayed protect from Tripwire is the norm. Blizzard can slowly code sub projects together over weeks if they want and make it look harmless piece by piece... then very easily tie it all together into a new HB detection method at the last minute.


Just like there is always a new creative way to inject a hack without being detected there are a million other creative ways to catch it.


PS. I've missed that last two tripwires and I am unbanned on 3 accounts. I PVP all the time on all 3 of them. Though that doesn't mean much compared to the sear volume of users.
 
Last edited:
Goshinki said:
You first statement about different detection stacks is wrong.


You can do an Assembly edit very easily with quite a few programs out there and just like with most unprotected injection methods will be flag within an hour normally for a ban.


Especially things that flag for sever alteration such as movement speed changes etc. So that whole thing about login charter screen is pointless and 100% incorrect.


Delayed protect from Tripwire is the norm. Blizzard can slowly code sub projects together over weeks if they want and make it look harmless piece by piece... then very easily tie it all together into a new HB detection method at the last minute.
Click to expand...

Please don't look at my examples as a coder, but from an end-user point of view. I know.
The moments (such as "character login") I stated are not about the screen itself, but the changing of the state.

Goshinki said:
Just like there is always a new creative way to inject a hack without being detected there are a million other creative ways to catch it.
Click to expand...

Yes! Exactly that.
 
Well then this thread is pointless because that's a terrible metaphor.

You might as well have compared it to hide and seek... or shoplifting in a mall with loss prevention always on the look out.


By the time you get caught it's already too late. All you can do is warn your friends...
 
Last edited:
Sneeds44 said:
ye honorbuddy is stil banneble i had a new account i questbotted for a few days and im banned i wil not touch hb anymore im now botting in diablo witch is fine
Click to expand...

u have received any report? ppl while wisp u and notice,, ahhh u are an fucking bot???... if u dont have received any report.. the only thing that comes to mind , and you were running these accounts with others who have already received reports... i have 18 account.. but only 13 received 6 month ban....
 
The OP is sheer speculation (and completely wrong).

[post=2150519][Official] Announcement regarding recent bans[/post]

cheers,
chinajade
 
Status
Not open for further replies.
Back
Top