Quote:
Originally Posted by mariusyo2008
Before the patch notes we would like to do an announcement. Today we were debugging the called "PHBot" the known silkroad automade bot, we found that the bot is collecting every information about your account no matter what server it is (RIGID, PRIVATE SERVERS, ISRO, ISROR, CSRO, etc.), and send it to an andress connected to projecthax domain "http://passcode.projecthax.com/?passcode=%0&local=%1" . This address send to the bot owner your second passcode of your account and the client local content id. Therefore we have banned phbot from rigid forever for your own saftey and for the matter of our players security. And it looks like its not we are the only people knew that
|
Joymax changed the plaintext passcode a year ago to a hash and I don't know which algorithm they used. I was able to brute force every single passcode from 000000 to 99999999 (6-8 digits) and store the hashes in a file - by hooking a function in the client and iterating through each passcode. If you do not send the correct result you cannot login to the game.
If you remember back there was a period where the second passcode was not working with the bot but was if you used the client. That is why.
Passcode's are not stored. I generated a list from 000000 to 99999999 and got the result from the client itself and stored the result. The bot makes an HTTP query in order to get the valid hash that was generated by the client at one point.