Stop using Toshinou ASAP

Page 2 of 2

09/14/2018 20:11 Sή�wy#16

Yeah, so it looks like they started adding more of those as expected after the first changes to the movement packet. Who is working to keep "updated" packets for thoshi I think he has no idea about this at all.

10/30/2018 15:58 mmo123mmo#17

Quote:
Originally Posted by Freshek
Hey guys u.u

if you are advnaced...
Spoiler
Let's take a look at one of DarkOrbit sub SWFs. It has a class named PandorasBox. Cool, right? No, not cool (at least not for Toshinou users). So what is PandorasBox? It is a class which DarkOrbit uses for encrypting/decrypting packets. What you want to take a look at is the toString() method.
Code:
      override public function toString() : String
      {
         var _loc1_:String = new Error().getStackTrace();
         if(_loc1_)
         {
            if(this._caller && _loc1_.indexOf(":ExternalInterface$/_callIn()") != -1)
            {
               this._caller(_loc1_);
            }
            return null;
         }
         return null;
      }
Okay, okay. It's just a toString method. But this code
Code:
            if(this._caller && _loc1_.indexOf(":ExternalInterface$/_callIn()") != -1)
            {
               this._caller(_loc1_);
            }
doesn't look good, right? So what is _caller? _caller is a function which is passed to PandorasBox during handshake (one of the first packets). How does it look like? It's located in main.swf and it looks like this
Code:
function(param1:String):void
{
    sendRequest(new �_-53r�(param1));
}
It sends a request containing the dirty stacktrace from Toshinou! But hey, maybe toString is never called, right? Unfortunately, it's being called quite often. Let's come back to our PandorasBox.
Code:
      public function encode(param1:ByteArray) : ByteArray
      {
         param1.position = 2;
         var _loc2_:int = param1.readShort();
         if(_loc2_ == ID)
         {
            this.toString();
         }
      }
This is a fragment of the encode function which encodes packets. The suspicious fragment is obviously
Code:
         if(_loc2_ == ID)
         {
            this.toString();
         }
It simply checks if the command's ID (_loc2_) equals to some ID. But what ID is it? It's the Movement Command ID. Yes, you are right. It sends a request like "hi, darkorbit, I'm using toshinou ban me asap" every time you move.
However, if you aren't, an easier scheme:
you move -> packet is being encoded -> swf notices that you are using toshinou -> swf sends packet containing dirty toshinou stacktrace to the server

Can't this be solved? Can't we use Toshinou anymore?

11/25/2018 21:16 decoy5200#18

Well no bans yet...

11/25/2018 23:27 ItsTequila#19

Look, all of you using toshi are signed as bot users. end.
Darkorbit can decide to push a banwave but it will be too costy for them to do one because last wave of players is YOU.

11/26/2018 02:38 jakubr21#20

Quote:

Originally Posted by decoy5200

Well no bans yet...

Because there wasnt banwave? :facepalm:

11/26/2018 20:57 Lmono#21

Quote:

Originally Posted by ItsTequila

Look, all of you using toshi are signed as bot users. end.
Darkorbit can decide to push a banwave but it will be too costy for them to do one because last wave of players is YOU.

exactly what i think also. but i dont think toshinous users are the most paying users haha so maybe they will ban them sometime

11/26/2018 23:29 PNTX#22

Quote:

Originally Posted by jakubr21

Because there wasnt banwave? :facepalm:

you know that their antibot script is running 24/7?
these called "ban waves" are only in "waves" because when a bot is detected, every single user who is using that bot is detected.
they ban their users about 2 times a month. so theoretically toshinou isnt detected yet :thinking: :kappa:

Page 2 of 2