MMORPG Bot Reverse Engineering and Tracking

A friend told me that a GW2 trading bot implemented a dumb API. We are going to find and use it to track the bot.
Play Guild Wars 2:
account.arena.net/register
Fiddler: www.telerik.com/fiddler
.NET Reflector: www.red-gate.com/products/dot...
HxD: mh-nexus.de/en/hxd/
IDA Free: www.hex-rays.com/products/ida...
Windows VM: developer.microsoft.com/en-us...
=[ ❤️ Support ]=
→ per Video: / liveoverflow
→ per Month: / @liveoverflow
=[ 🐕 Social ]=
→ Twitter: / liveoverflow
→ Website: liveoverflow.com/
→ Subreddit: / liveoverflow
→ Facebook: / liveoverflow
=[ 📄 P.S. ]=
All links with "*" are affiliate links.
LiveOverflow / Security Flag GmbH is part of the Amazon Affiliate Partner Programm.
#ReverseEngineering

[@LiveOverflow]

Bonus video with the analysis of the collected data will come within the next 24h. TL;DR summary: If you are a Guild Wars 2 player, don't worry about bots like that. It's child's play. Don't request ArenaNet to waste any resources on it.

[@planktonfun1]

great work

[@LiveOverflow]

you mean: "learn how to speak English properly"?

[@GRBtutorials]

What's wrong with his way of speaking? He (and most Germans) speaks English better than many people in the world, including me. And I'm pretty good!

[@LiveOverflow]

As bad as yours?

[@planktonfun1]

We all understand the video in English, you need global awareness education, English is not the main language of the world and should not be enforced because someone said so

[@Cevans3535]

I just wanna say that I have watched several tutorials on reverse engineering binaries and I REALLY enjoyed your video because you not only showed what you did to find certain bits of information, but you explained your entire thought process AND you told us the things you did that didn't actually work. 99% of tutorials -- even the good ones -- often leave out explanations of the dead end roads they went down. And the reason that's so important is it helps people who are trying to learn reverse engineering the mindset/thought process they should have when approaching the subject. It's easy to mirror something you watch in a video and think you understand it only to try it on something else and quickly realize you don't really know where to begin or how to approach it. This is the first video I've come across of yours and I'm definitely checking out more after I write this, but I'm really hoping that you take this approach in all of your videos. If not, you should. This is super helpful and you're definitely onto something with this style of talking about a subject. Sorry for the long comment, but I just had to say this. Cheers!

[@gnif]

Your strings are wide which is why IDA didn't notice them. You just need to tell IDA to include wide strings in the strings window (right click and configure)

[@inx1819]

thanks I'll keep that in mind

[@nukexplosion6679]

@@inx1819 What are you debugging?

[@kubeface115]

I don't even play GW2, yet this was utterly fascinating. You're a goddamn wizard.

[@dalmaronthefirst2237]

GW2 has the single least toxic most helpful community I have ever met. Like srsly, its an amazing mmorpg.

[@timfreeeed]

great documentation of your workflow. thanks

[@CardinalHijack]

The way that you talk through your way of thinking is so good. Makes it so easy to follow your thought process and your reasons for doing things.

[@cantucodes]

Your videos are very informative. It's almost like you have to play detective to discover what you did. Of course, having the right tools under your tool belt also helps ;) Keep up the great videos!

[@seanpianka1818]

I love these videos. As large a python application developer, getting to explore more about this very unknown world (at least, to me) is super interesting. Keep the videos coming!

[@IdanHorowitz]

Great video. i really enjoy you reverse engineering these types of MMO bots, i would love you try doing it for more bots as its also very educational :D

[@user-of4mr3tl5n]

This guy could get employed by Microsoft Apple Google and Amazon all by himself and save these companies trillions ... He is mind-blowing smart. I use computers since i'm a kid and have strong knowledge about pretty much every computer related stuff but in this video I quickly realised how much of a noob I was. This video made me humble so bad. I'm shocked. Wow.

[@steinardarri]

Really cool video, I like how you went the extra step and tracked thos bot users for data

[@warflower69]

You showed me nothing I didn't already know, except how to put what I know to use! I appreciate the candor of narration as you work through the problem. That is one of the most important things for people to see, it's OK if you don't know precisely what they next thing you click on is going to do, that's how you learn. Great video, thank you.

[@julianksterlarsen784]

Super interessting! And crazy how it was possible to extract such valueable and private information. I bet there's thousands of other companies doing something similar.

[@nesu1645]

I would like to see more game related reverse engineering videos. Keep it up.

[@tangytech7641]

do more bot videos on popular mmos, this is interesting stuff

[@Shuroii]

@ID3301 only really counts for online games tbh

[@MoeJama5454]

Hearing that makes me think of someone I used to watch, but yeah this is very interesting

[@alexanderburton5990]

You deserve so many more subscribers. Please keep this content going :D

[@FreezeFrame175]

One of the best channels about reversing on youtube. Thanks for the video

[@callumhilliscool]

Very cool my friend, subscribed - wish there was more content like this!

[@minefunrapguy]

How didn't I know about fiddler earlier? I love it and constantly mess around with it now! Danke dir

[@LiamDennehy]

I don't think there is a single video of yours that hasn't had a #MindBlown moment for me. I know you think this is a bit mundane, but like all your work, yet again opening a whole world to my view. Thanks, keep up the great work!

[@bulletproof1453]

Just found your channel. Seems to be educative and I believe I will learn a lot. Keep up the good work.

[@nicoper]

Awesome video as always. Guild Wars 2 is a great game, as well.

[@mfiels]

3:31 Sending login credentials over HTTP? Oh boy...

[@georgegx95]

Well there's an endpoint that returns all users and their api keys.. HTTPS is a detail here, lol

[@HardcoreMontages]

lmao

[@mfiels]

George Gougoudis I left this comment before I saw the end, the logged in users endpoint is unbelievable!

[@Hevletica]

Phishy...

[@dXXPacmanXXb]

these are no real login credentials.

[@TylerTraverse]

You're so awesome. I love your videos so much! So much to learn, and I really like the way you present the information.

[@Dehvi_]

Couple tips for Windows executable reverse engineering. 1) There are many programs you can use to check how an executable is compiled and packed, couple of my favorites are Detect it easy and peId. 2) You can use Process Hacker 2 to find strings in memory of an executable. Great video btw!

[@Reneator]

Very good video about deep programming knowledge, without getting complex. It helped me!

[@Shinika01]

Really interresting video.... I'm subscribing to see what's next :) And i will come back on your videos to see what else you have to teach. Thanks for the share, keep on the good work, keep giving us your taught process (mostly why i subscribed!) Good luck on KZbin

[@IsAMank]

Super cool video, and absolutely hilarious that such a simple request gave you the bot user's account APIs. Talk about a botch job from the bot developer!

[@alexionut6]

This is just... WOW. Dude you're awesome. Keep it up!

[@matthias1637]

Thanks for this amazing video, you never fail to deliver :D

[@ushelushel1]

You've inspired me to get back in GW2 after almost a year of not playing it, thanks

[@lx6381]

Dein Video ist Gold wert, konnte dadurch echt viel lernen, danke^^

[@andretaulien398]

By the way, you can just load the memory dump into ida see the disassembly of whatever they tried to obfuscate/encrypt. Ida can also find strings in there, no need to do it manually.

[@petrasjonuska6305]

Andre Taulien It's cooler that way

[@skypeon1]

so many Lithuanians in the comment section, damn

[@jungoogie]

0_0 I don't know how I ended up here but I couldn't stop watching. This reminds me of how many different programs I find myself using from start to end with making game assets.

[@PrinceRapthorne]

I learned a lot today, thank you for this video :)

[@its.moonjc]

Super interesting. Thank you for this.

[@zacharypriest2787]

I enjoyed this video! I will watch more of your videos :)

[@thebigvrguy4571]

WoW, That is really amazing. It's inspiring.

[@dimitriygeorgiev9248]

Just awesomely crazy... Good job.

[@BenClerix]

Subbed! Awesome videos ;) GW2 reddit brought me here!

[@61Marsh]

I would have never thought to reverse engineer the bot program to get all the api calls to their server. that's awesome.

[@zandiskoul]

Your a boss man! This made me happy to watch.

[@hallejohn]

Ich habe keine Ahnung von GW2 und auch nicht vom Programmieren, aber es ist interessant und einigermaßen verständlich für mich. Dankeschön. =)

[@TurtleFul]

This is some impressive work man!

[@GamingMiscellaneous]

Very interesting. Good job

[@OthmanAlikhan]

Thanks for the video, very interesting!

[@Janrupf]

Nice, I'm always learning something ;) And I'm always a bit suprised to read german Text. Well, I already know you live in Germany, but your englisch is perfect. BTW: I'm German too

[@LiveOverflow]

I think the developers of the trading bot are german. that's why the text was german in the TOS

[@Janrupf]

LiveOverflow Well, some of youre programms are german too, aren't they?

[@EvanDear]

I love your channel so, so much

[@MrRathkor]

I legit spit my coffee out watching this at 7:30 in the morning when I saw you replay and edit the request to get the online users.

[@cewa44]

WoW nice Love this video, thanks for showing me something new :D

[@klausgreinerfiorini]

I love your videos, i just got into the security market and i'm learning from 0 your videos will surely help a lot i've always wanted to make bots for games for the sake of it but never did it. I would love if you could make a video about android apps pen testing

[@zxcghoul1275]

Thanks for the video! you big helped

[@kermitthehermit9373]

Man!!I wanna be able to do all this. You're a genius

[@morphman86]

Continue watching the channel, check a few other data forensic channels, check out the free online universities for Computer Forensic courses and you'll be a good way on the way to be able to do all these things. There are a few hacker conventions that also give good info on how it all works, with videos freely available here on KZbin. Check out things like DefCon.

[@NullPointer871ICant]

It's not about being genius. Everyone can learn that just not everybody wants to.

[@kermitthehermit9373]

morphman86 can you please suggest me any of those universities? Thank you

[@loongaming105]

Udemy is a good one as well as nullbytes own university. I believe its skill stack. some of the packages you can find are like....idk 16$ for 100s of lectures and online classes. You arnt bound to them like a real college or university. There's no tests, no quizzes, no grades. Its all just based on you learning material. Access anywhere, any time.

[@Silver9041]

Exactly my thoughts, and even the comment 'I do not know how this works so I fiddle with it'; made me feel aware that this guy is good in being resilient and really good in self teaching.

[@rey1242]

As the bot requires validation to work, you can remove it by checking for strings related to the login page on IDA, the newr adresses will be the validation ones, then you just need to make it return true

[@phanmemviet2565]

I love this video. Please make more videos like this xD

[@carlosgil2691]

Excellent video! Best reverse engineering channel!

[@yuyuko_s75]

Fun fact: You just gave pirates a head start in pirating the bot.

[@cyanus7347]

so it can be pirated

[@deathhog]

Fun Fact: he just gave the devs a free access key to ban all those players too....

[@DedmenMiller]

You could open the memdump (Yes it's a full memory dump) in IDA and let it automatically find/analyze the binary.

[@KrzysiuNet]

For string searching I like ProcessHacker 2 - double click on the process>Memory>[Strings...]>Set the settings>Optionally filter output.

[@jeffalbert8415]

You should do more of these documentary's where you reverse engineer a program in the wild.

[@dontreadmyprofilepicture5209]

I have no idea what is going on or where I am but I like this video, even though I understood none of it. I found it enjoying and your voice soothing. Keep making videos, 4am me is out & won't remember this comment :)

[@olfmombach260]

That was so interesting and fun to watch! The thing is, if I had attempted to do this kind of research, I would have given up after the first 5 minutes, because I know nothing about the workflow and how to interpret findings and outputs of these various programs (even most of the shown programs I did not know). So can you give a short explanation of how you collected this mass of knowledge over time? Ps: Schland :D

[@LiveOverflow]

guess how many times I attempted projects like this and gave up? Every time you do that, you learn a tiny little bit more. and at some point you succeed.

[@snooter28]

Okay.. I didn't like the video until you got the entire list of users.. and then geeked out graphing some data.. You earned my like.. Thumbs up clicked :P

[@sucrose]

Very interesting. I used to make wallhacks for Soldier Front and aimbots for Gunbound when I was younger... much profits. These videos make me want to get back into it.

[@agito289]

wow what a great content, subscribed

[@ivangutowski]

Far, far above my level of knowledge and interest, however well explained and interesting to see what you discovered, even if I could not emulate this myself.

[@CabbageGod]

I'm glad you waited for the service to shut down before doing this, a buddy of mine found this issue and showed me how to perform it ages ago. We always used to mess with those filthy cheaters. >:)

[@Cajun82]

craaazy stuff ...i have no clue about programming but this is crazyy :)

[@lpoki8897]

I'd love it if someone posted this video on the site where the bot was sold. I don't think they'd be all to happy with it if they found out it just spits your API keys out on request.

[@bestlty]

BEST CHANNEL EVER IN THE HISTORY OF KZbin AND HUMAN CIVILIZATION

[@Herakleion]

I have 0 dev experience and I dont play gw2. I watched the entire thing. Time to get control of my life.

[@blairsaid]

DUDE YOU ARE A FUCKING BOSS. I'm super inspired to try some of these tools. Thank you so much. Love your channel.

[@Photoficaj]

Super awesome Sir.

[@AholicKnight]

This video is strangely motivational.

[@purplenightdrive627]

This is amezing thank you so much for beautifull video

[@Anonymouspock]

The mouse key hook actually uses Windows API to intercept and maybe send raw input, no injection required.

[@ishimarumasaki1998]

You earned a subscriber, don’t let me down

[@amadlover]

Very awesome and inspiring

[@muhammadadibdzulfikar9584]

This is amazing !! Great!! Get more on mmorpg ;]

[@wildwest1832]

yeah good job explaining your approach, and what tools you used.

[@nikize]

I can recommend ILSpy Smartscreen primarily checks code signing certificate of the program (see the Publisher) - not much of hashes and how many are using it. To avoid the smartscreen you must supply your app (with certificate) to Microsoft. Visual Studio should be able to open the memory dump, and also let you step thru it if you want. (I really hope this is available in the community version)

[@dracau18]

Hello LiveOverflow, Like you I have analyse two bots from an other game, but in fidler the first bot use https and the second encrypted packet (TCP or UDP). My question is, how to decrypt these packets ? Thank you :)

[@lockstar1019]

I have no idea whats going on and yet i am going to watch part 2

[@Garkolym]

Alter, wie geil du einfach bist :D Verdienst auf JEDEN Fall mehr Abonnenten!

[@dominikletzplayz]

Garkolym gib ich dir recht!

[@SeekersMentality]

you are defo in the top 5 Comp Sci/Software Eng/Hacking channels.

[@mrfincher]

Awesome topic

[@trapworld3023]

Im in college and watching every single video of yours so that i able to solve any ctf challenges thanks men: ∆

[@WolfrostWasTaken]

If the memory contains non-obfuscated data you could have easily debugged using some tools like OllyDbg or even Cheat Engine (even if OllyDbg provides a list of strings really similar to the IDA one)

[@orpheuzdevelopment4098]

I actually understood what is happening. May god I learned some stuff last few years :D

[@Zhung36]

I just realized that I had watched this video before, not knowing about GW2 and I'm quite intrigued by how games' economy works, but not the games itself (since I'm not MMORPG kind of player) Then two years later I've already addicted to it and then stumbled this video again browsing GW2 economy subreddit How the table have turned... I'm gonna watch it again

[@Evercreeper]

your intro is awesome

[@tinoc6451]

dayum son, your hacking skills are over the top!

[@UrbanGT]

Nice video! Awesome reverse engineering...

[@schukaproallied9834]

Great video

[@hoodedwarrior8956]

Very nice, I am now maybe a bit too old, in my youth somebody used a hex editor to modify some values within a fairly old mmo client-side and he got through, ofc he was banned and that thing patched in next maintenance and obviously storing important data client-side is a no-no and it was their fault that they got burned... But yea little by little I am getting the picture now. Thanks.

[@markayala7752]

you are awsome , fan from Egypt :)

[@mustafaalican4695]

I love reversing online games. I even have 0day for an old Turkish made MMO :D. Cool video btw.

[@GabrielSilva-mv4fm]

amazing, thx

[@DueLosGaming]

send the graph to data is beautiful.

[@ayushman_sr]

you are my favorite channel ☺