MMORPG Bot Reverse Engineering and Tracking

[@LiveOverflow]

Bonus video with the analysis of the collected data will come within the next 24h. TL;DR summary: If you are a Guild Wars 2 player, don't worry about bots like that. It's child's play. Don't request ArenaNet to waste any resources on it.

[@planktonfun1]

great work

[@LiveOverflow]

you mean: "learn how to speak English properly"?

[@GRBtutorials]

What's wrong with his way of speaking? He (and most Germans) speaks English better than many people in the world, including me. And I'm pretty good!

[@LiveOverflow]

As bad as yours?

[@planktonfun1]

We all understand the video in English, you need global awareness education, English is not the main language of the world and should not be enforced because someone said so

[@Cevans3535]

I just wanna say that I have watched several tutorials on reverse engineering binaries and I REALLY enjoyed your video because you not only showed what you did to find certain bits of information, but you explained your entire thought process AND you told us the things you did that didn't actually work. 99% of tutorials -- even the good ones -- often leave out explanations of the dead end roads they went down. And the reason that's so important is it helps people who are trying to learn reverse engineering the mindset/thought process they should have when approaching the subject. It's easy to mirror something you watch in a video and think you understand it only to try it on something else and quickly realize you don't really know where to begin or how to approach it. This is the first video I've come across of yours and I'm definitely checking out more after I write this, but I'm really hoping that you take this approach in all of your videos. If not, you should. This is super helpful and you're definitely onto something with this style of talking about a subject. Sorry for the long comment, but I just had to say this. Cheers!

[@gnif]

Your strings are wide which is why IDA didn't notice them. You just need to tell IDA to include wide strings in the strings window (right click and configure)

[@inx1819]

thanks I'll keep that in mind

[@nukexplosion6679]

@@inx1819 What are you debugging?

[@kubeface115]

I don't even play GW2, yet this was utterly fascinating. You're a goddamn wizard.

[@mfiels]

3:31 Sending login credentials over HTTP? Oh boy...

[@georgegx95]

Well there's an endpoint that returns all users and their api keys.. HTTPS is a detail here, lol

[@HardcoreMontages]

lmao

[@mfiels]

George Gougoudis I left this comment before I saw the end, the logged in users endpoint is unbelievable!

[@Hevletica]

Phishy...

[@dXXPacmanXXb]

these are no real login credentials.

[@CardinalHijack]

The way that you talk through your way of thinking is so good. Makes it so easy to follow your thought process and your reasons for doing things.

[@tangytech7641]

do more bot videos on popular mmos, this is interesting stuff

[@Shuroii]

@ID3301 only really counts for online games tbh

[@MoeJama5454]

Hearing that makes me think of someone I used to watch, but yeah this is very interesting

[@warflower69]

You showed me nothing I didn't already know, except how to put what I know to use! I appreciate the candor of narration as you work through the problem. That is one of the most important things for people to see, it's OK if you don't know precisely what they next thing you click on is going to do, that's how you learn. Great video, thank you.

[@julianksterlarsen784]

Super interessting! And crazy how it was possible to extract such valueable and private information. I bet there's thousands of other companies doing something similar.

[@FreezeFrame175]

One of the best channels about reversing on youtube. Thanks for the video

[@seanpianka1818]

I love these videos. As large a python application developer, getting to explore more about this very unknown world (at least, to me) is super interesting. Keep the videos coming!

[@160.17]

This guy could get employed by Microsoft Apple Google and Amazon all by himself and save these companies trillions ... He is mind-blowing smart. I use computers since i'm a kid and have strong knowledge about pretty much every computer related stuff but in this video I quickly realised how much of a noob I was. This video made me humble so bad. I'm shocked. Wow.

[@gabriel-x7x9g]

Why would he want to work to those vile companies? He is better than them.

[@MrRathkor]

I legit spit my coffee out watching this at 7:30 in the morning when I saw you replay and edit the request to get the online users.

[@timfreeeed]

great documentation of your workflow. thanks

[@andretaulien398]

By the way, you can just load the memory dump into ida see the disassembly of whatever they tried to obfuscate/encrypt. Ida can also find strings in there, no need to do it manually.

[@petrasjonuska6305]

Andre Taulien It's cooler that way

[@skypeon1]

so many Lithuanians in the comment section, damn

[@ushelushel1]

You've inspired me to get back in GW2 after almost a year of not playing it, thanks

[@KrzysiuNet]

For string searching I like ProcessHacker 2 - double click on the process>Memory>[Strings...]>Set the settings>Optionally filter output.

[@nesu1645]

I would like to see more game related reverse engineering videos. Keep it up.

[@Dotexe245]

You deserve so many more subscribers. Please keep this content going :D

[@Dehvi_]

Couple tips for Windows executable reverse engineering. 1) There are many programs you can use to check how an executable is compiled and packed, couple of my favorites are Detect it easy and peId. 2) You can use Process Hacker 2 to find strings in memory of an executable. Great video btw!

[@cantucodes]

Your videos are very informative. It's almost like you have to play detective to discover what you did. Of course, having the right tools under your tool belt also helps ;) Keep up the great videos!

[@lx6381]

Dein Video ist Gold wert, konnte dadurch echt viel lernen, danke^^

[@minefunrapguy]

How didn't I know about fiddler earlier? I love it and constantly mess around with it now! Danke dir

[@LiamDennehy]

I don't think there is a single video of yours that hasn't had a #MindBlown moment for me. I know you think this is a bit mundane, but like all your work, yet again opening a whole world to my view. Thanks, keep up the great work!

[@61Marsh]

I would have never thought to reverse engineer the bot program to get all the api calls to their server. that's awesome.

[@IdanHorowitz]

Great video. i really enjoy you reverse engineering these types of MMO bots, i would love you try doing it for more bots as its also very educational :D

[@steinardarri]

Really cool video, I like how you went the extra step and tracked thos bot users for data

[@carlosgil2691]

Excellent video! Best reverse engineering channel!

[@IsAMank]

Super cool video, and absolutely hilarious that such a simple request gave you the bot user's account APIs. Talk about a botch job from the bot developer!

[@rey1242]

As the bot requires validation to work, you can remove it by checking for strings related to the login page on IDA, the newr adresses will be the validation ones, then you just need to make it return true

[@nicoper]

Awesome video as always. Guild Wars 2 is a great game, as well.

[@snooter28]

Okay.. I didn't like the video until you got the entire list of users.. and then geeked out graphing some data.. You earned my like.. Thumbs up clicked :P

[@patchouli_s75]

Fun fact: You just gave pirates a head start in pirating the bot.

[@cyanus7347]

so it can be pirated

[@deathhog]

Fun Fact: he just gave the devs a free access key to ban all those players too....

[@callumhilliscool]

Very cool my friend, subscribed - wish there was more content like this!

[@bestlty]

BEST CHANNEL EVER IN THE HISTORY OF KZbin AND HUMAN CIVILIZATION

[@BenClerix]

Subbed! Awesome videos ;) GW2 reddit brought me here!

[@alexionut6]

This is just... WOW. Dude you're awesome. Keep it up!

[@fedekotek]

I have 0 dev experience and I dont play gw2. I watched the entire thing. Time to get control of my life.

[@jungoogie]

0_0 I don't know how I ended up here but I couldn't stop watching. This reminds me of how many different programs I find myself using from start to end with making game assets.

[@DedmenMiller]

You could open the memdump (Yes it's a full memory dump) in IDA and let it automatically find/analyze the binary.

[@mmet0diev]

you are defo in the top 5 Comp Sci/Software Eng/Hacking channels.

[@ayyildiz-ccc]

Just found your channel. Seems to be educative and I believe I will learn a lot. Keep up the good work.

[@hallejohn]

Ich habe keine Ahnung von GW2 und auch nicht vom Programmieren, aber es ist interessant und einigermaßen verständlich für mich. Dankeschön. =)

[@zandiskoul]

Your a boss man! This made me happy to watch.

[@TylerTraverse]

You're so awesome. I love your videos so much! So much to learn, and I really like the way you present the information.

[@Cubinator73]

If you're dealing with .NET assemblies, don't bother with Reflector, take a look at dnspy.

[@lmaoroflcopter]

Cubinator73 dnspy, ilspy and greywolf are my go-tos for messing with .net. Greywolf by Digital bodyguard lets you patch the il and export the exe, great for messing with execution flow and logic, or in my case patching out an annoying taskbar notification thing for a driver utility.

[@nobytes2]

dotpeek also pretty good, there's also apps strictly for strings. If you install flare vm you get tons of malware analysis tools.

[@dimitriygeorgiev9248]

Just awesomely crazy... Good job.

[@CabbageGod]

I'm glad you waited for the service to shut down before doing this, a buddy of mine found this issue and showed me how to perform it ages ago. We always used to mess with those filthy cheaters. >:)

[@matthias1637]

Thanks for this amazing video, you never fail to deliver :D

[@Reneator]

Very good video about deep programming knowledge, without getting complex. It helped me!

[@lpoki8897]

I'd love it if someone posted this video on the site where the bot was sold. I don't think they'd be all to happy with it if they found out it just spits your API keys out on request.

[@Anonymouspock]

The mouse key hook actually uses Windows API to intercept and maybe send raw input, no injection required.

[@AholicKnight]

This video is strangely motivational.

[@GamingMiscellaneous]

Very interesting. Good job

[@thebigvrguy4571]

WoW, That is really amazing. It's inspiring.

[@TurtleFul]

This is some impressive work man!

[@EvanDear]

I love your channel so, so much

[@tomcho8221]

The dump format isn't raw, it's stores all sorts of information other than the memory like open handles and threads.

[@zacharypriest2787]

I enjoyed this video! I will watch more of your videos :)

[@PrinceRapthorne]

I learned a lot today, thank you for this video :)

[@Shinika01]

Really interresting video.... I'm subscribing to see what's next :) And i will come back on your videos to see what else you have to teach. Thanks for the share, keep on the good work, keep giving us your taught process (mostly why i subscribed!) Good luck on KZbin

[@phanmemviet2565]

I love this video. Please make more videos like this xD

[@klausgreinerfiorini]

I love your videos, i just got into the security market and i'm learning from 0 your videos will surely help a lot i've always wanted to make bots for games for the sake of it but never did it. I would love if you could make a video about android apps pen testing

[@jeffalbert8415]

You should do more of these documentary's where you reverse engineer a program in the wild.

[@dontreadmyprofilepicture5209]

I have no idea what is going on or where I am but I like this video, even though I understood none of it. I found it enjoying and your voice soothing. Keep making videos, 4am me is out & won't remember this comment :)

[@kermitthehermit9373]

Man!!I wanna be able to do all this. You're a genius

[@morphman86]

Continue watching the channel, check a few other data forensic channels, check out the free online universities for Computer Forensic courses and you'll be a good way on the way to be able to do all these things. There are a few hacker conventions that also give good info on how it all works, with videos freely available here on KZbin. Check out things like DefCon.

[@NullPointer871ICant]

It's not about being genius. Everyone can learn that just not everybody wants to.

[@kermitthehermit9373]

morphman86 can you please suggest me any of those universities? Thank you

[@loongaming105]

Udemy is a good one as well as nullbytes own university. I believe its skill stack. some of the packages you can find are like....idk 16$ for 100s of lectures and online classes. You arnt bound to them like a real college or university. There's no tests, no quizzes, no grades. Its all just based on you learning material. Access anywhere, any time.

[@Wintergin]

Exactly my thoughts, and even the comment 'I do not know how this works so I fiddle with it'; made me feel aware that this guy is good in being resilient and really good in self teaching.

[@cewa44]

WoW nice Love this video, thanks for showing me something new :D

[@sucrose]

Very interesting. I used to make wallhacks for Soldier Front and aimbots for Gunbound when I was younger... much profits. These videos make me want to get back into it.

[@blank6604]

7:14 press Windows [no Ctrl +] a to mark every thing in the wimdow your in. (Only text and numbers)

[@yukkuriwa]

You mean, CTRL + A, Right?

[@blank6604]

@@yukkuriwa yes.

[@Cajun82]

craaazy stuff ...i have no clue about programming but this is crazyy :)

[@WiseWeeabo]

it's hard to really stop injection from happening, when it comes to the mouse clicks you have to rely on the system flag to tell if the clicks are authentic, these need to come from certified drivers (although you can also just patch whatever checks for the flag on the client)

[@fltfathin]

a bit late you probably know it: there's also hardware route of custom usb hardware and external hardware OCR, best way is always in game design

[@ishimarumasaki1998]

You earned a subscriber, don’t let me down

[@its.moonjc]

Super interesting. Thank you for this.

[@lockstar1019]

I have no idea whats going on and yet i am going to watch part 2

[@agito289]

wow what a great content, subscribed

[@VirtualMatterTails]

Thanks for the video! you big helped

[@nikize]

I can recommend ILSpy Smartscreen primarily checks code signing certificate of the program (see the Publisher) - not much of hashes and how many are using it. To avoid the smartscreen you must supply your app (with certificate) to Microsoft. Visual Studio should be able to open the memory dump, and also let you step thru it if you want. (I really hope this is available in the community version)

[@WolfrostWasTaken]

If the memory contains non-obfuscated data you could have easily debugged using some tools like OllyDbg or even Cheat Engine (even if OllyDbg provides a list of strings really similar to the IDA one)

[@tinoc6451]

dayum son, your hacking skills are over the top!

[@ayushman_sr]

you are my favorite channel ☺

[@OthmanAlikhan]

Thanks for the video, very interesting!

[@DueLosGaming]

send the graph to data is beautiful.

[@theaifam5]

For dotNet reversing is better to use dnSpy which have better integration and more features.

[@Zhung36]

I just realized that I had watched this video before, not knowing about GW2 and I'm quite intrigued by how games' economy works, but not the games itself (since I'm not MMORPG kind of player) Then two years later I've already addicted to it and then stumbled this video again browsing GW2 economy subreddit How the table have turned... I'm gonna watch it again

[@trapworld3023]

Im in college and watching every single video of yours so that i able to solve any ctf challenges thanks men: ∆

[@danielkrajnik3817]

2:08 this that's what sold it to me, your videos are so good ☉_☉

[@Evercreeper]

your intro is awesome

[@Janrupf]

Nice, I'm always learning something ;) And I'm always a bit suprised to read german Text. Well, I already know you live in Germany, but your englisch is perfect. BTW: I'm German too

[@LiveOverflow]

I think the developers of the trading bot are german. that's why the text was german in the TOS

[@Janrupf]

LiveOverflow Well, some of youre programms are german too, aren't they?

[@OllyWood688]

That clicking in the background music sounds like someone munching right next to my ear and I can't bear it :c Glad it stops after around 1 minute

[@OllyWood688]

I also learned new things here and that's worth a like and a sub :)

[@medjassertoubib4467]

i love reversing . you are my 2nd hero . +rep :)

[@LiveOverflow]

2nd hero? Who is first!!??!?!??

[@medjassertoubib4467]

LiveOverflow someone named zonz he teach me how to reverse

[@olfmombach260]

That was so interesting and fun to watch! The thing is, if I had attempted to do this kind of research, I would have given up after the first 5 minutes, because I know nothing about the workflow and how to interpret findings and outputs of these various programs (even most of the shown programs I did not know). So can you give a short explanation of how you collected this mass of knowledge over time? Ps: Schland :D

[@LiveOverflow]

guess how many times I attempted projects like this and gave up? Every time you do that, you learn a tiny little bit more. and at some point you succeed.

[@ivangutowski]

Far, far above my level of knowledge and interest, however well explained and interesting to see what you discovered, even if I could not emulate this myself.

[@blairsaid]

DUDE YOU ARE A FUCKING BOSS. I'm super inspired to try some of these tools. Thank you so much. Love your channel.

[@igeljaeger]

jaja sehr schönes video Hans

[@markayala7752]

you are awsome , fan from Egypt :)

[@satriowahyutomo]

how could you know if with deleting the username and password parameter will discover the entire API key?

[@lugux565]

This bot looks like coded in AutoIt. Why did not you just try to decompile with Exe2Auto in case it was an autoit file? Maybethe source was obfuscated but this language is easy to deobfuscate.

[@UsmanAbdulHalim]

I'm more interested on unpacking that binary files. The crazy thing, I did some reversing on a private server of a game launcher back then, what I didn't expect after unpack the binary was that the launcher uses somekind of remote sql to fetch the login data. I can even see the database and it's password for connecting to remote server.

[@sonycservice]

What is written at the end of the 2 sentences in python "raw = open ..." and "with open ..." ?

[@campercat5342]

Man this is crazy shit! Nice video