08-11-2005, 05:10 PM
Quote by Richie, administrator and hack security guy at RPGForums.com:
...and a quote by me, spare time reverse engineer and also a member of RPGForums.com:
Richie Wrote:Stop to think for a second. How many people lost accounts ALL OF A SUDDEN. Lots? Ok, now think, how much time does it take to sort through a keylog, find psaswords/account (btw, accounts don't show up in keylogs if they're not typed, ever think of that?), figure out which realm they're on, and change their psaswords one account at a time?
Being a former evil guy, I can say that sorting through a log takes at least 3 minutes, maybe less once you know what you're looking for. Checking for the realm will take about 20 seconds to switch between each. Changing the password will take about 10-30 seconds, depending on how fast battle.net responds. That's around 4 minutes per account.
Hundreds or possibly THOUSANDS of accounts lost in a few hours...and you think netter is capable of doing that by himself, or even with 10 friends, in a matter of hours? 4 minutes times 10,000 accounts (approximated based off nothing :p) is about 666 hours. Seem plausible to you?
There were no keyloggers or trojans, just blizzard catching the users and banning them. Don't blame netter, blame blizzard, and blame ourselves for not remembering the way the old hacks used to work: use at your own risk.
...and a quote by me, spare time reverse engineer and also a member of RPGForums.com:
Cauhtemoc Wrote:Time for yet another of my little statements I think.
Diablo and the Battle.net server communicates with eachother by the use of so called 'packets'. A maphack is a small program that resides in Diablo's memory, which reads all incoming packets from the Battle.net server, modifying or otherwise changing the packets that has to do with the automap (this is client side only by the way), which in terms tricks Diablo into showing the entire map.
With the arrival of the new patch, Blizzard compeletely changed or otherwise modified practically every memory address there is, and as such, all older hacks stopped working.
Updating all the memory offsets and such is not only a shed load of work, but requires equally as much knowledge about assembly, the Windows API, as well as being a very skilled reverse engineer (and it's safe to say that there aren't too many of these people around in the Diablo community anymore).
On top of this, when Blizzard said they were upgrading the anti-hack detection in Diablo, they sure as hell weren't kidding. I knew this, as did Netter, and he did what he thought was enough, but it obviously wasn't. We knew that Blizzard's new anti-detection system was good, just not this good. My respect for Blizzard has now increased tenfold.
It will take time to get around this detection. I'd be surprised if we see any truly undetectable maphacks for the next few weeks. Our hopes now lie with Mousepad.