Against bots

[poltomb]

Ok, to repeat and reiterate again and again, there is NO fool-proof, 100% accurate computer way to determine if someone is botting or not. NONE. Yes, there are numerous ways to keep the laziest of the botters out. First, there is gameguard, that is NCZ0ft's way, but does it stop them? No. Many admins here have postulated ideas that may be promising to catch ones that are maybe a bit more determined than the laziest. But no matter how advanced your anti-bot system is, you will still not catch the most determined botters. It is not that difficult, especially if you have an advanced bot (say, one that notifies you when your bot gets a message. This is especially true when the bots emulate the L2 client (minus the graphics, of course). Even having a group of well trained, active admins will not catch all the bots, but it is the best policy. Having been an admin on a few servers, and botting on many servers (yes, I have botted, mostly to see how the bots work and learn little things that make a bot easy to notice) I have learned, if you are a determined enough botter, you will not get caught.

[denser]

call this method - captcha )

so you can ask a simple question, make an a array of them, randomize with simple math like 1+3, ask what kind of color(not exact color code)) but supposed: color #118800 not exact green i.e.), a little enigmas etc )

also we can use l2day letters for some captchas )) hehe

2Lee, pls can you share a initiated code? i will try to modify it as well

[savormix]

call this method - captcha )
randomize with simple math like 1+3,
ask what kind of color(not exact color code)) but supposed: color #118800 not exact green i.e.), a little enigmas etc )

also we can use l2day letters for some captchas )) hehe

2Lee, pls can you share a initiated code? i will try to modify it as well

Simple math can help a little.
If the codes are randomly generated (which means server must derive the answer from the color code), we can stop the bots for as long as they will take to find out the actual scheme used (if the color codes are defined, then it wont take long until botters will know all of them), plus, if the server decides that a cyan color is bluer than cyan and should be blue instead, you might be banning innocent people. Not to mention those who don't memorize exact names of frequently used colors or even colorblind people.

L2Day wont make a captcha. Bot would be like: uhm, it's an item picture... Let's see, ID XXXX is L2Day - L. That must be letter A (don't even think about it) L!

[ZaKaX]

Ok, to repeat and reiterate again and again, there is NO fool-proof, 100% accurate computer way to determine if someone is botting or not. NONE.

I'm sorry, but... this is not true. I found 6 ways to detect bots, including two upon log-in and yes, 100% accurate. Nothing's impossible =)

[pokiokio]

Ok, to repeat and reiterate again and again, there is NO fool-proof, 100% accurate computer way to determine if someone is botting or not. NONE.

I'm sorry, but... this is not true. I found 6 ways to detect bots, including two upon log-in and yes, 100% accurate. Nothing's impossible =)

;O Share

[Probe]

if he shares bot developers will find a workaround, the good stuff is always kept private

[savormix]

Ok, to repeat and reiterate again and again, there is NO fool-proof, 100% accurate computer way to determine if someone is botting or not. NONE.

I'm sorry, but... this is not true. I found 6 ways to detect bots, including two upon log-in and yes, 100% accurate. Nothing's impossible =)

;O Share

So you could create a workaround? Anti-bot measures are always kept private, even when explaining why a player got banned.

[Lee]

Ok, to repeat and reiterate again and again, there is NO fool-proof, 100% accurate computer way to determine if someone is botting or not. NONE.

I'm sorry, but... this is not true. I found 6 ways to detect bots, including two upon log-in and yes, 100% accurate. Nothing's impossible =)

How does it work?

[ZaKaX]

All I can say is that it's not impossible, it's even far to be impossible based on all the ways I found in few hours search...

There's no point publishing a way to detect them It'll only get it fixed...

P.S: 69th post in this thread! Sweeet!

[Aikimaniac]

P.S: 69th post in this thread! Sweeet!

pervert

[poltomb]

Ok, to repeat and reiterate again and again, there is NO fool-proof, 100% accurate computer way to determine if someone is botting or not. NONE.

I'm sorry, but... this is not true. I found 6 ways to detect bots, including two upon log-in and yes, 100% accurate. Nothing's impossible =)

Not to be mean, but you are only partially right. You have found a way to detect bots that do not completely imitate the client. If a bot is created that completely imitates the client (just as L2J imitates the retail L2 servers) then there is no way for you to detect if it is a bot or not. Like I said, there is no 100% way to detect ALL bots. The bots you are detecting are crappy bots (as in my other post, the lazy botters). If these botters weren't just lazy kids and adults, if they actually cared if they got caught or not, you would not catch them.

Imagine this, is there a difference between me pressing the number 1 and transmitting to you over the internet and me programming my computer to do the same? Would you be able to tell if the number 1 was me or just my program? Absolutely not! There is no difference in the bits that are sent along the wires that make up the internet. If there was a bot, that did exactly what the client did, then there is no way to tell if it is a bot or a human (by using a computer program to detect, other than some more advanced AI).

All I am saying is what you are detecting, ZaKaX, is not what I described. You are detecting a 'lazy' bot, one that does not entirely emulate the L2 client. You are detecting what the bot does do that the client doesn't, or what the bot doesn't do that the client does. I am not saying that you haven't found a good or even a great method of detecting lazy botters, you still have yet to be able to detect ALL bots with 100% accuracy.

If you still disagree, you may send me in a PM your method of catching bots (I know you wouldn't want to just give your code to all these leechers). I would like to see these so called "100% accurate" methods of detecting bots.

[poltomb]

All I can say is that it's not impossible, it's even far to be impossible based on all the ways I found in few hours search...

There's no point publishing a way to detect them It'll only get it fixed...

P.S: 69th post in this thread! Sweeet!

I know this is a double post, but I didn't read this far down right away, lol. As I said in my post above, you found ways the bot does not emulate the client, not all bots are the same, though.

[Szponiasty]

I do not agree. There is always a way, even for most advanced ones like L2.NET. How successfull protection will be depends on popularity of the server its used on and how easy its for bot devs to get protection sources or description how it works. Maybe that why noone posted good antibot yet, so I've started thinking to become a first one to do so (ofc as an working example, that should be modified further by every admin themself)

Here's my post about it:
viewtopic.php?f=81&t=16142

[poltomb]

I do not agree. There is always a way, even for most advanced ones like L2.NET. How successfull protection will be depends on popularity of the server its used on and how easy its for bot devs to get protection sources or description how it works. Maybe that why noone posted good antibot yet, so I've started thinking to become a first one to do so (ofc as an working example, that should be modified further by every admin themself)

Here's my post about it:
viewtopic.php?f=81&t=16142

If there was a feasible, 100% successful anti-bot system, I am damn positive that NCZ0ft would have implemented it years ago and there would not be such a botting problem on retail servers. The fact is, if a bot can emulate EVERYTHING about the client, then there is no way to tell if it is a bot (from across the network). If a bot sends exactly the same responses a client sends, then you will not be able to tell if it is a client or a bot.

Your game guard emulation idea will keep many botters out, but not all. This is how the game world works, in my honest opinion (and in basic ):

Code: Select all

100 Game creators make a 'bot-proof' server200 Bot makers make a bot, that emulates everything that the client does300 Game makers create a new feature of the client that makes the server 'bot-proof' once more400 Bot makers add this new feature into their botsGOTO 300

There is a somewhat famous quote about the world in general that relates to this process:

Every time you make something foolproof, the world makes a better fool

If you know anything about the Turing Test, then you will know why my argument is what it is. All people who are disagreeing with my statements, I understand your frustration. I am NOT saying that there are no good, great, or even excellent or perfect methods of detecting today's bots. I am saying that there will be no end to this war with botters and botting. It is a bit pessimistic, but it's true. I do, though, admire and enjoy reading about the ideas that everyone has had on how to prevent/detect bots. Some have looked very promising.

[Aikimaniac]

If there was a feasible, 100% successful anti-bot system, I am damn positive that NCZ0ft would have implemented it years ago and there would not be such a botting problem on retail servers. The fact is, if a bot can emulate EVERYTHING about the client, then there is no way to tell if it is a bot (from across the network). If a bot sends exactly the same responses a client sends, then you will not be able to tell if it is a client or a bot.

Have you ever considered that walker builders = NCZ0ft team members to get more money ? And on C4 if i remember was kinda antibot system....NCZ0ft was able to ban all OOG botters..they send some packet which cause client crash and everybody who stayed after this ingame have been bots...i remember once on Hindemith kinda massive banning...but it was on C4 and since then, nothing (proly walker builders just disabled this in client to be safe)