What's changed since I've been gone?

[»jD«]

Hey guys,

I realized just the other week that has been almost 6 months since my last post on ePvPers. I've recently had my interest in the DarkOrbit community reignited by a few of my friends getting back into the game so I thought I'd take a look at where things have gotten to.

I know the first question for a lot of you will be "Is the private server still being developed?". Over the last six months it hasn't been but I plan to change all that. Those who know me understand that I am in my final year of schooling (final semester actually, YAY!) so I am under the pump to do well at school. Due to that I have tried to stay away from anything that will "distract" me too much from my studies. In three months or so exams will be over and I will finally have the free time a lot of the people around here wish for! This means that in roughly three months the private server will be under full time development! The plans for it haven't changed at all so you can all still expect big things

Whilst I've been away I've actually been working on a few other open source projects. Those following the news may have seen my name (jduncanator) pop up in a few articles here and there so you'll know what I'm talking about. I've decided to invest my time elsewhere as I didn't agree with the direction those projects were taking!

So thats really it, the last 6 months have really been involved in the aforementioned projects along with a few other little hobbies like writing a Javascript port of Diffie Hellman (which I have a nice experience with considering its the negotiation protocol Bigpoint use to handshake their encryption keys in DarkOrbit! )

So what has changed since I've been gone? How are you all? Who's who? Any new awesome developers gotten into the DarkOrbit scene?

I'm investigating changes to the DarkOrbit code base at the moment. Thankfully my version tracker software worked flawlessly (more or less) for the last 6 months so I have a copy of every single main.swf file out there What have I found? Well, in case there IS anyone out there still developing things for DarkOrbit:

• They now pay attention to the hashes of three resources loaded from resources.xml. They are replacementCollectables.swf, box2.swf and ore_palladium.swf. All three of those are understandable as they have had anti-bot code in them for over 6 months (it was there before I left). It also houses parts of their anti-reverse protection (houses code used to decrypt the code that is used to decrypt the "obfuscation" algorithms used to encrypt game packets after they are RC4 encrypted. Yes, Bigpoint wasted a lot of time encrypting everything... and then writing thousands of lines of code decrypting it)
• This leads me onto the next change. New anti-pixelbot code. They now verify VISUALLY that the resources for bonus boxes, palladium and other collectables hasn't been modified. They now sample three to four pixels in the graphics used for the above collectables and verify they are correct. They then forward these up to the big man himself, Bigpoint in their "encrypted" event stream with event code flash.bd.crc. I'm not sure if anyone is actually using this method for pixel bots but if you are and you haven't nulled this protection, watch out!
  UPDATE: Turns out they also send a JPEG Encoded version of the "replaced" SWF file in the event stream too. Dunno what they will be using this for but they could probably use the data for further anti-bot code updates or possibly for identifying individual bots.
• And onwards it is! They also now randomly tint boxes/collectables at runtime. They tint it by a factor of 0.3 (as of 8.3.1) and the tint change range is between 0 and 16777215. Just be careful if you are using a crappy pixel find algorithm! (Or even worst a image lookup algorithm!)
  UPDATE: See post.
• Now, if they detect that the hashes of those files don't match, they will set two variables that are used in even further anti-bot code. This anti-bot code has been around for almost a year now (was already implemented in PBDO-Bot) that modifies X and Y coord values in the game. I'm not exactly sure what will happen but it is evident that they are modifying the values of X and Y sent to the server. The server could (and probably does) use this to detect a bot. THIS ONE AFFECTS BOTH PACKET AND PIXEL BOTS!

I will keep updating this as I find more stuffz but as you can see, in the 5 minutes I went looking, its pretty obvious they are still adding more and more anti-bot code. To be honest, that second and third point above is the first time I have seen them actively combat pixel bots, BE CAREFUL!

-jD

[fuso98]

Hi »jD«, thank you for these informations
Can i talk with you on PM or via Skype? I want to ask you something

[»jD«]

Originally Posted by fuso98

Hi »jD«, thank you for these informations
Can i talk with you on PM or via Skype? I want to ask you something

Go for it! I'll PM you my Skype incase you don't have it!

[fuso98]

Originally Posted by »jD«

Go for it! I'll PM you my Skype incase you don't have it!

Perfect and thanks I'm waiting for your PM

[»jD«]

Originally Posted by fuso98

Perfect and thanks I'm waiting for your PM

I sent you a request on Skype!

-jD

[Staspytel]

Welcome back jD! And thanks for your info. Are you planning some new stuff for DO? :3

[»jD«]

Originally Posted by Staspytel

Welcome back jD! And thanks for your info. Are you planning some new stuff for DO? :3

Maybe, you'll have to wait and see!

-jD

[H.A.Z.E]

We were all waiting for you!
Welcome back and have fun here!

[»jD«]

Originally Posted by H.A.Z.E

We were all waiting for you!
Welcome back and have fun here!

Thanks. I've certainly missed you guys and hope to be around for as long as DarkOrbit is!

-jD

[Peshо]

Welcome back. :3

How are you?

[dasti555]

^^ Maybe annoying question ....
What about PBDO? ^^ As I read your post (and I don't understand everything) I think it's now impossible make again packet bot? (And pretty safe)

Because as you can see. Merkava is still updated but as everyone of us know it's not very safe. I mean use = insta ban.

So .. I just want know your answer what you think about BP Detection and packet bots like complete dead or chance for "safe" bot is still here.

[»jD«]

Originally Posted by dasti555

^^ Maybe annoying question ....
What about PBDO? ^^ As I read your post (and I don't understand everything) I think it's now impossible make again packet bot? (And pretty safe)

Because as you can see. Merkava is still updated but as everyone of us know it's not very safe. I mean use = insta ban.

So .. I just want know your answer what you think about BP Detection and packet bots like complete dead or chance for "safe" bot is still here.

The limitation of packet bots isn't that they are easy to detect, more so that they are hard to keep upto date. I'm currently working on something that may change this but for now its not ready. You will first see SH-IT back before you see PBDO back!

Note: I've updated my original post with even more anti-bot findings!

-jD

[death rain]

Hey, nice to hear from you again... I hope you continue to do a great job, you'll always have my support

[Diаmonds]

Hi,
As you left epvp when I created my account, you never saw me here, I guess.
But speaking about me is not the point

Originally Posted by »jD«

• This leads me onto the next change. New anti-pixelbot code. They now verify VISUALLY that the resources for bonus boxes, palladium and other collectables hasn't been modified. They now sample three to four pixels in the graphics used for the above collectables and verify they are correct. They then forward these up to the big man himself, Bigpoint in their "encrypted" event stream with event code flash.bd.crc. I'm not sure if anyone is actually using this method for pixel bots but if you are and you haven't nulled this protection, watch out!

This is a bad thing for us, pixel-bot users. Since BP deleted the option to change the boxes to "low", all the resources are moving, and we can't stop them, except by modifying their .swf.
I know that VBot uses Fuso's tool to change swf to a red square, which is easier to detect than a moving box, and I use it too, as some of my friends, with Palavia, to change the palladium to a pink square. Palavia can work without it, but then the collect is slower...
If what you say is right (and I'm sure it is), using this kind of thing to change the .swf of the ores => easy ban?

When you say "you haven't nulled this protection", does it mean that YOU found a way to bypass it? If yes, half of my friends and all VBot and BoxyBotPB users would be interested in your method

Thanks, and welcome back !

[»jD«]

Originally Posted by TheDarkDiamonds

Hi,
As you left epvp when I created my account, you never saw me here, I guess.
But speaking about me is not the point



This is a bad thing for us, pixel-bot users. Since BP deleted the option to change the boxes to "low", all the resources are moving, and we can't stop them, except by modifying their .swf.
I know that VBot uses Fuso's tool to change swf to a red square, which is easier to detect than a moving box, and I use it too, as some of my friends, with Palavia, to change the palladium to a pink square. Palavia can work without it, but then the collect is slower...
If what you say is right (and I'm sure it is), using this kind of thing to change the .swf of the ores => easy ban?

Yes. Anything that modifies the SWF files of either palladium, bonus boxes or ores will be caught without a bypass. This means if you proxy any resources that the game client uses (out of the three above) then you will be caught. This is a double wammy as it not only reports it to bigpoint in a fairly obvious "EventStream" event, it also modifies in game variables directly linked to anti-packetbot code. I would certainly avoid using anything that modifies any ingame resources.

Originally Posted by TheDarkDiamonds

When you say "you haven't nulled this protection", does it mean that YOU found a way to bypass it? If yes, half of my friends and all VBot and BoxyBotPB users would be interested by your method

Thanks, and welcome back !

Of course. Over the years of working on PBDO I have become a pretty pro reverse engineer. Ever since SH-ITv2 was around I had ways of nulling practically every single protection in the game. How do you think I was able to do it all without modifying any packets? Using a custom Flash player has its benefits!

On another note, running a full Flash VM is slow and breaks everywhere. I'm currently working on extending Armory (which I've posted about and wrote for PBDO-Bot Originally. Armory is a SWF editor library).

-jD