Valhalla Legends Archive

Wouldn't it be most efficient (as in acual work done by the processor) to randomly generate a checksum formula and have the server hash the expected result on-the-spot then compare it with the client? Unless, ofcourse Blizzard is just cycling through a list of checksum formulas which was randomized after being initally created. (which would explain why Ante never got a repeated checksum formula until now)

Quote from: iCe on February 03, 2007, 10:22 PM
Brew: 0x4A seems to make the client respond with 0x4B. I am not "savior"

Yes you are. And Pro_Tech@Europe is Ringo. Why do you even attempt to play this off...?
And @ the packet. I don't even have starcraft anymore, so I can't packetlog the client's repsonse to battle.net. Perhaps it is a response to battle.net whether or not Client will install the .dll. Among other problems with that, there are no optional work .mpqs being put into effect by blizzard at this time. How did you manage to even GET an 0x4a packet? Was this during It would be nice if you could post your findings here

Haha, did anyone notice half of squeak's posts have been deleted? It makes me look like I'm talking to myself now. *sigh*

I'm sure most of you believe this patch is targeted to disable hacks for starcraft/broodwar, but consider the fact that x40 - x50 times as many possible checksum formulas were added to blizzard's database only two days after Ante's CRDB was released.

@ Mystical, you acually go on the game "starcraft"? I wouldn't know very much about hacks since I don't play it, but from what I hear they are getting worse. Still, none are worse then the crash hack (sends a character below a space in game) which had been patched long ago. In general, hacks are becoming less dangerous thanks to Blizzard's wealth of anti hacking systems and occasional warden patches. If blizzard really wants to stop hacks, the only way they can do it is by updating starcraft.exe itself, and not use some .mpq workaround. Also, why would they care about starcraft? what about Starcraft 2? It's been confirmed, it is being released late 2007.

nothing i thought you were gonna go back to your old self where you constantly hate on me for no reason

rob dont start plz. also quit posing on bnetweb?
and he really, should have specified it's for a d2gs server. because I, for one, was completely confused at what he ment and took it an entirely different way.
Sorry about that, but nice contribution, ShadowDancer.

ice is savior. savior is ice. Those two names are interchangable. Maybe you might not have caught on yet

Quote from: iCe on February 01, 2007, 11:39 PM
Is there even any reply for 0x4C or is it just sent to make sure it is run locally with no response from the client?

@Savior, there is no reply for the 0x4C or 0x4A. It is simply a packet that tells client what the filename is of the file of which it is to request a download from Battle.net's FTP, which upon the finished download it then extracts the .dll from it and includes it in broodat.mpq, or stardat.mpq, whichever is installed.

what??

Interesting. I'm assuming this is a Starcraft packet it sends/receives in game. We need more people like you, please post this in the bnetdocs section of the forum because your help is much needed. We have next to nothing bout what goes on in game

I have the source code to BNCSUtil, its a bit outdated though. And someone, please ban topaz. All she does is troll.

**edit i just realized i have the source to bnetauth, not bncsutil lol

Quote from: Ripple on February 03, 2007, 07:23 PM
Of course they will. The day after lockdown came out, I asked a blizzard rep about it in Blizzard Tech Support. After badgering him and being kicked out twice, he finally admitted it was an anti-bot measure.

First, you go on battle.net? And also, what rep did you ask? How would he know? They are just tech support, after all. The blizzard dev team is the only one who should know about these countermeasures anyways.

Can you fuck off, Melissa Ye***?
Keep going, I might have to ctrl+v your contact info.

Anyways @ Ripple, true. He (may) still be using the old window hook method. And haha, the blizzard dev team is probably bored out of their minds and wait for us to say something that sounds like a good idea to smash up battle.net connection emulators again, then we say to ourselves "d'oh shouldn'tve said that" because they used our ideas. And by this, I'm saying it's definate that they have been updating the server for countermeasures against not only hacks, but bots too.

1). I ment to also state this, but forgot. Yes, I know it would need to be re-fixed every patch, but that's what we had to do with what we called hash files in the past also, except this is "different" in some ways. In time, we will be able to find an easier way to retrieve this value. And yes, it may be varible length but don't forget some debuggers have advanced options to find values such as that. For now, I'm assuming it is 32 bits.
2). If Blizzard does enforce complete emulation, it wouldn't matter. All bots would have to evolve, along with the rest of Battle.net itself. And please, don't forget they hound these forums like dogs and you certainly don't want to give blizzard any new ideas, do you :]

My point is, we can't use BNLS for everything. Skywing should indeed release his way of formulating the checksum. There is no harm in it. And as for "massload" bots, they have been getting around fine using BNLS so far. Releasing the solution won't effect much but make bot development as a whole much easier.

hey guys, i'm back ;]
and no, topaz im not deleting my account again sorry

Okay, we know even if we do "collect" all the possible checksums we need, blizzard is just one click away from screwing it up on us again. This is a very, bad temporary solution seeing how they added a much larger amount of possible checksum "formulas". This was obviously directed torwards bots, because it was patched literally 2 days after all these checkrevision database .dlls or .ocxes started popping up. It seems the only (semi) permanent solution for the lockdown mpqs is to acually solve it. I just came up with this idea, a little while ago. Probably someone more experienced in reverse engineering can get the specifics.... But, the checkrevision is a function. And some value must be passed to it, such as a hash of the memory. This memory hash MUST be the exact same for every call of the checkrevision function (must be confirmed because of blizzard's new required work mpqs) since the bits of memory taken in account for are the same for every patch, and this value is passed to the mpq specific function which is then hashed with the checksum formula and then creates a viable value for the checksum, which blizzard's server calculates then compares your reported checksum with it's value. If it is the same, you pass. Different, you phail. So what I'm basically trying to say, is that someone with much experience with reverse engineering should be able to pull a value out, namely the one being passed to checkrevision then use the mpq's formula to calculate it then send to bnet. Correct me if I'm wrong with any of this.

Also please note, this ever growing collection of the checkrevision data is what Ante previously referred to as "brute forcing" the checkrevision, and had received bad publicity from vL-types in the past. I have no clue why you people are supporting it in lieu of a permanent and certainly more intelligable solution.