Elsword's security system by Adrian

[Kuroba Kaito]

nice finding...this sure helps a lot for some modder...u deserve ma "thank's"
.
.
.
.
PS: U no "***"...u anonymous... ( ' 3 ')

[Adrian420]

Bump.
---------------------------------------------

Update

Changes:
-The main list has been updated
-Another screenshot added
-Skill cooldown assumption rejected: admins don't know how often you use skills nor the used quantity of MP.

[Otes]

Bump and look my last video about farming SD and the IC set in Elsword/Ara:

[FireDemon3346]

that server its not server sided kom yep?

[Otes]

is not about server-sided lol !
YOU CAN'T MOD NEW KOMS WITHOUT NEW TOOLS.

[wise01]

They log PM too, I got banned cause a friend said me "are you using autokill atm?" (I've been using autokill for low level dungeons for 3 months). And next day after that PM i got banned.

[Rozelux]

They know how many accounts you have by tracking your IP. Every account you have ever accesed with your IP(even once) is counted as " one of your accounts". This is how many innocents get banned when a hacker gets banned on IP.

I call bullshit. They did ban my alt account due to hacking but my other accounts are still perfectly fine. Even though i did login with them on the same IP.
Any explanation for this?

[Adrian420]

I call bullshit. They did ban my alt account due to hacking but my other accounts are still perfectly fine. Even though i did login with them on the same IP.
Any explanation for this?

First of all it depends on when you took the ban. If it was before Flux left GF then the single account ban shouldn't surprise you.
Second is that nobody is forced to IP ban all your accounts. Most of the times the decision is left "at GM's discretion". I say you were lucky, that's all.
3rd, quit the trash talk.
4th, that thing is tested by me, but, if you really need an official evidence then look :

§10 Multiple accounts
A player is allowed to own and operate multiple accounts. If an account is banned permanently, all other accounts belonging to the affected user IP address may also be banned.

Originally Posted by wise01

They log PM too, I got banned cause a friend said me "are you using autokill atm?" (I've been using autokill for low level dungeons for 3 months). And next day after that PM i got banned.

To be honest with you similar events happend to me too, but, in order to avoid angry/revolted individuals like the one above I need solid evidence before accepting the theory as being correct.
Though nothing is impossible nowadays, the PM logging theory might be just a coincidence after all.

[Gazathug12]

Originally Posted by Adrian420

Good evening,
As some people may have heard by now on this game a secret logging system represents the most powerful weapon against hackers.
The main issue I hope to cover here is how logs look like and what's being logged.


What's being logged:

• The level of your character as well as the dungeon you're playing in. For example: you can’t access x-2 secret dungeon at lv 6 unless you are a hacker.
• Drops of all kind: ED and items acquired.
• All dungeon results: for example how much ED/ Exp you have acquired, clear time, etc.
• How many mobs you have killed during the respective run.
• What stages you clear during the run.
• How much damage you deal. By knowing this we can assume that they also know how much dmg you receive or if you receive anything at all.
• Based on the value and particularities of the damage you have dealt or received they might be able to guess about how much: phy/mag attack/defence, add.dmg, crit, red.dmg and evasion, you have. What I can say for sure is that when you kill a mob they know exactly how much damage you have dealt and if it was a critical hit or not.
• Since they know if mobs receive damage or not they also know by what means dies a mob.
  
• They know how many accounts you have by tracking your IP. Every account you have ever accesed with your IP(even once) is counted as " one of your accounts". This is how many innocents get banned when a hacker gets banned on IP.
  
• They log trades of all kind: mail, direct, board. They know what item you trade.
• They know from which account to which account goes the item you have send. They recognize accounts not only by IP but also by name. As simple as: account "x" is trading with account "y".
• They know the exact date of all logs. Year,month,week,day,hour,minute. Logs have a length in time of 5 or more months which makes me believe that logs never get deleted.
• Logs are stored in your account's history. In other words your account is "the main villain" not your characters - deleting or renaming a character is pointles since logs remain on your account's history.
• Mods are detectable and bannable.
• They have a list of all items you have on your account and their effects/particularities. They know which items[gear, costumes, accessories] you have used during a run and their characteristics[enhancement, effects & sockets].

Secret KOMCheck algorithm:
Exactly as the name suggests the client runs a secret, hidden KOMCheck method/algorithm that checks KOM files.
This KOMCheck method/algorithm:
-Is incorporated in the game's client,
-Does not need files from the internet (non-bypassable),
-Only reports when the normal KOMCheck and this second method give different results (i.e. when the normal KOMCheck has been bypassed),
-Does not close the client but each time it detects a modified KOM file an entry in the login packet is sent to the server.

This is how admins can find out if you have a modded client and since the alteration of the client is strictly forbidden by T&C you can legitly get banned even if you don't have any abnormal logs.
Example: bans took for voice mods follow this system.

Solution:
Basically, you don't have to edit KOM files.
Programs like , ELX or Cheatengine can alterate the in-game experience without making modifications in the structure of the KOM.

Special thanks to Joni-St who analised the client binary and made this descovery.


Safe way to hack based on IP change:

 Spoiler

The most easyest way of them all:
You need 2 PC's and two different IP's on each PC. What you want to do is to grind "one big load" on your hacking account(s). Like 4 absolute sets for example.
What you must do when you transfer these is to make everything look like a every day trade.
Go in the market and put the item(s) you want to trade at a ridiculously low price(1000 ED or so). With your safe account rapidly buy, using the board, 2/3 of the amount. The rest you let there to be taken by other players or by friends of yours. Repeat the process until everything you wanted is on your safe account.
Remember that you can only do this whole trick once or twice because even if they don't recognize you by IP they will surely recognize you if you're constantly buying items with only one account.

I'm a hacker and I'm in big trouble, what should I do?

 Spoiler

You should make a new account, because you risk a ban, but NOT BEFORE asking your internet provider for a new IP. Why? Because if you get IP banned without changing the IP your new account will also get banned even though you did not used any hacks on it.


The safest way to do this while keeping your items:
Ask a friend who isn't a hacker to make you a new account. You trade your items to him via direct trade. After the transfer is complete you can change your IP and play on your new account.
This is a bit risky, but in the same time you "should" be safe because it only looks like you're giving things away.
If you have a dynamic IP things are a lot more easier since you can do the whole process by yourself via mail trade. Don't forget to change IP when you relog.

What I want to add:
These are only my ideas on how to evade security. Based on the presented info about logs you may come up with better solutions. Do whatever you decide to do and keep in mind that variety will save your ass.

Prints:
I had more but I've lost them when my old hard-disk broke. Some info here can be confirmed not only by me but also by any hacker who made a ticket after getting banned.

 Spoiler

---------------------------------------------

---------------------------------------------

---------------------------------------------

---------------------------------------------

That's all, I hope this topic helps people understand how things work. Also feel free to update my list with anything useful that's not already been told.

what i am saying all of this if you are ban and you change your ip adress can you log back in that account?

[Adrian420]

what i am saying all of this if you are ban and you change your ip adress can you log back in that account?

No.
Your IP is only used to identify all your accounts. Every account you have accessed with your IP address is considered yours and might get banned. In other words your accounts are the ones getting banned not your IP.

Also, related to this subject I will quote this:

OHH.. U KNOW? IVE BEEN BANNED FOR 2 MONTH.. THEN I TRY TO LOGIN WITH VPN AND USING THE FIDDLER TO SHUT THE ELSWORD SERVER IP THAT SENDING TO MY IP AND WAITING FOR RESPONDS. THEN I SUDDENTLY CAN LOGIN WITH THAT BANNED ACCOUNT.
^^
AWESOME RIGHT?

The source of this is a comment from my other similar thread on G@m3K1ll3r.
As far as it goes this might work for Elsword NA if hasn't already been patched.
I did not tested this theory on either NA/GF servers. I've quit Elsword a long time ago.