Both Proxy and Memory Based are Detectable now!!

Quote:

Originally Posted by { Angelius } Speed hacking/jumping/walking seems to work just fine but once i start hunting with the speed hack on it waits until the KO counter is around 1k kills and then it disconnects me and restricts the account :| Sounds like they are monitoring the incoming data such as melee/magic attack packets.

Quote:

Originally Posted by IAmHawtness I heard some of the public bots also had problems with restrictions. I don't know whether it was because of the "hooking" they used in the client to re-direct the client to the proxy, disable the signout website, allow multi-clients, etc., or if it was because of the proxy itself, but I'm guessing they have probably fixed it by now.

Quote:

Originally Posted by Zeroxelli Interesting... But why 1k kills? A bot could simply disconnect before it got there to reset the counters in the server.

Quote:

Originally Posted by Zeroxelli If it uses hooking it's probably a memory based proxy.

Public Function connect2IP(ByVal PID As Integer, ByVal IPAdd As String) As Integer
        Dim ws2Handle As IntPtr = LoadLibrary("WS2_32.dll")
        If ws2Handle = vbNull Then
            FreeLibrary(ws2Handle)
            Return 1
        End If
        Dim cHandle As IntPtr = OpenProcess(ProcessAccessFlags.VMOperation Or ProcessAccessFlags.VMRead Or ProcessAccessFlags.VMWrite Or _
                                            ProcessAccessFlags.All, True, PID)
        If cHandle = vbNull Then
            FreeLibrary(ws2Handle)
            Return 2
        End If
        Dim inet_addr As IntPtr = GetProcAddress(GetModuleHandle("WS2_32.dll"), "inet_addr")
        If inet_addr = vbNull Then
            FreeLibrary(ws2Handle)
            Return 3
        End If
        Dim buffer() As Byte = {&HB8, &H0, &H0, &H0, &H0, &HC2, &H4, &H0, &H90, &H90}
        Dim byteIPaddress() As Byte = IPAddress.Parse(IPAdd).GetAddressBytes()
        System.Buffer.BlockCopy(byteIPaddress, 0, buffer, 1, byteIPaddress.Length)
        Dim bytesWritten As Integer = 0
        If Not WriteProcessMemory(cHandle, inet_addr, buffer, buffer.Length, bytesWritten) Then
            FreeLibrary(ws2Handle)
            Return 4
        End If
        CloseHandle(cHandle)
        FreeLibrary(ws2Handle)
        Return 0
    End Function

Quote:

Originally Posted by xmen01235 What I mean is I hook on inet_addr to by pass the client to my localhost(127.0.0.1)... This was also based on nullable tutorial last time when he posted how to bypass the client. Code: Public Function connect2IP(ByVal PID As Integer, ByVal IPAdd As String) As Integer Dim ws2Handle As IntPtr = LoadLibrary("WS2_32.dll") If ws2Handle = vbNull Then FreeLibrary(ws2Handle) Return 1 End If Dim cHandle As IntPtr = OpenProcess(ProcessAccessFlags.VMOperation Or ProcessAccessFlags.VMRead Or ProcessAccessFlags.VMWrite Or _ ProcessAccessFlags.All, True, PID) If cHandle = vbNull Then FreeLibrary(ws2Handle) Return 2 End If Dim inet_addr As IntPtr = GetProcAddress(GetModuleHandle("WS2_32.dll"), "inet_addr") If inet_addr = vbNull Then FreeLibrary(ws2Handle) Return 3 End If Dim buffer() As Byte = {&HB8, &H0, &H0, &H0, &H0, &HC2, &H4, &H0, &H90, &H90} Dim byteIPaddress() As Byte = IPAddress.Parse(IPAdd).GetAddressBytes() System.Buffer.BlockCopy(byteIPaddress, 0, buffer, 1, byteIPaddress.Length) Dim bytesWritten As Integer = 0 If Not WriteProcessMemory(cHandle, inet_addr, buffer, buffer.Length, bytesWritten) Then FreeLibrary(ws2Handle) Return 4 End If CloseHandle(cHandle) FreeLibrary(ws2Handle) Return 0 End Function Probably this is the reason why proxy is detectable now.

Quote:

Originally Posted by { Angelius } I don't do that :P I leave them until something stupid happens and disconnects them and i really like to watch them hunt/pick gold and items but.... TQ ruined the whole thing for me when the reduced the gold/items drop :| 8400 kills and all i got is 16 meteor/around 1kk silver/few refined items... LMFAO

Quote:

Originally Posted by xmen01235 What I mean is I hook on inet_addr to by pass the client to my localhost(127.0.0.1)... This was also based on nullable tutorial last time when he posted how to bypass the client. Code: Public Function connect2IP(ByVal PID As Integer, ByVal IPAdd As String) As Integer Dim ws2Handle As IntPtr = LoadLibrary("WS2_32.dll") If ws2Handle = vbNull Then FreeLibrary(ws2Handle) Return 1 End If Dim cHandle As IntPtr = OpenProcess(ProcessAccessFlags.VMOperation Or ProcessAccessFlags.VMRead Or ProcessAccessFlags.VMWrite Or _ ProcessAccessFlags.All, True, PID) If cHandle = vbNull Then FreeLibrary(ws2Handle) Return 2 End If Dim inet_addr As IntPtr = GetProcAddress(GetModuleHandle("WS2_32.dll"), "inet_addr") If inet_addr = vbNull Then FreeLibrary(ws2Handle) Return 3 End If Dim buffer() As Byte = {&HB8, &H0, &H0, &H0, &H0, &HC2, &H4, &H0, &H90, &H90} Dim byteIPaddress() As Byte = IPAddress.Parse(IPAdd).GetAddressBytes() System.Buffer.BlockCopy(byteIPaddress, 0, buffer, 1, byteIPaddress.Length) Dim bytesWritten As Integer = 0 If Not WriteProcessMemory(cHandle, inet_addr, buffer, buffer.Length, bytesWritten) Then FreeLibrary(ws2Handle) Return 4 End If CloseHandle(cHandle) FreeLibrary(ws2Handle) Return 0 End Function Probably this is the reason why proxy is detectable now.

Quote:

Originally Posted by { Angelius } I'm like 99% sure that the detection process is server sided and has nothing to do with the client because i'm not debugging the process i am only injecting a dll into it and nothing that i have done so far got me banned cept for the super fast massive killing part like ninjas shifting for example :P

Quote:

Originally Posted by Zeroxelli Yeah.. Don't redirect the socket. Use [Only registered and activated users can see links. Click Here To Register...] to connect to a Hamachi IP (that your proxy is listening on), or if not Hamachi, me and Fang discussed two different options in this thread: [Only registered and activated users can see links. Click Here To Register...]

Quote:

Originally Posted by xmen01235 lemme try that thanks.

Quote:

Originally Posted by { Angelius } I don't do that :P I leave them until something stupid happens and disconnects them and i really like to watch them hunt/pick gold and items but.... TQ ruined the whole thing for me when the reduced the gold/items drop :| 8400 kills and all i got is 16 meteor/around 1kk silver/few refined items... LMFAO

Quote:

Originally Posted by xmen01235 I think you are correct ..Also I noticed something, they check every packet now , for example I played around with my packet for action and I put a zero value on x & y then bang 1day banned on my noob.