[TAURI] Wrobot detected

[Apexx 60]

I was using my custom Fight Class with WRotation, and my plugin, WRadar.

[Ordush 185]

15 minutes ago, Apexx said:

I was using my custom Fight Class with WRotation, and my plugin, WRadar.

Does your fightclass or WRadar use lua?
The reason i am asking is because they might be sniffing lua, that's what warmane did last time

[Apexx 60]

I will have to double check my class file. It's been a while since I last scripted it. I may have some lua code in there somewhere I am sure. The interesting thing for me, was it all happened after hitting level 10. I had been using the fight class without any problems up until that point. WRadar does not use lua.

[prestonjacobs 4]

3 hours ago, Ordush said:

Can you write down what parts of wrobot you were using?
Quester?
Fightclass?
etc? ?

Doesn't seem to matter, I've had it ban me while wrobot was only attached, not even running.
Ran without plugins and fightclass, doesn't seem to make a difference.
Warden only seems to activate at lvl 10

[artur.k 10]

maybe at 10 they ban but it can be activate on any lvl  just ban on 10 maybe every lvl 10+

[Mykoplazma 24]

They detect injection you can do nothing and still get banned. If you inject and lvl>10 ( they don't scan lower accounts lol ) they good bye bye. They detected unlocked lua much earlier. 

[Ordush 185]

I wonder, just for lols what will happen if you rename your wrobot.exe ?
Probably Droidz that has to recompile the exe for that btw. ?

Edited September 9, 2018 by Ordush

[prestonjacobs 4]

37 minutes ago, Ordush said:

I wonder, just for lols what will happen if you rename your wrobot.exe ?
Probably Droidz that has to recompile the exe for that btw. ?

Renamed it, moved to external drive, still detected.

[Ordush 185]

8 minutes ago, skip80k said:

Renamed it, moved to external drive, still detected.

You can not just rename the file lol =P
It has be recompiled and done by Droidz.

[arkhan 11]

But imagine you just rename it, Tauri will ban you and say that "Renamed" is detected and will disconnect you.

That's what i think.

[tutker 0]

So, any idea? Droidz can repair it, with some code?

Tauri is the first private server which detect wrobot?

[artur.k 10]

good question tutker

[Hansworst 0]

@Droidz  if you want to test quickly connect to WoD server (mop on 5.4.8) its running on 15x XP,  lvl 10 will take like 2min.

 

So far it only detected my Wrobot, but the lua unlocker and another bot run just fine without detection.

[Apexx 60]

It's funny to think if perhaps @Droidz runs the Tauri server, and doesn't want his own bot running on it?  I have seen him comment on other topics, but he doesn't seem to be particularly taking interest in this thread topic. No offense Droidz. I have moved on to other servers since then. It's not really worth the time perhaps?

[Ordush 185]

7 hours ago, Apexx said:

It's funny to think if perhaps @Droidz runs the Tauri server, and doesn't want his own bot running on it?  I have seen him comment on other topics, but he doesn't seem to be particularly taking interest in this thread topic. No offense Droidz. I have moved on to other servers since then. It's not really worth the time perhaps?

Don't worry guys, he will get around to you.
He answers questions where he has a quick answer first.
Things like this takes a lot of time and testing.

[chaosmode 0]

I was lucky enough to have just finished my sub when this happened. Everyone I know using this was getting banned. Not conventional detection. Worried that any work around will be a cat and mouse game. Robot is too public not to be downloaded, tested and a new detection issued.

[budziel 0]

If there is no way to fix it Retail would have a easy decetion for Honorbuddy and since its working forever... i dont think hungarian devs are better than a Blizzard Team.

[chaosmode 0]

Since we all know that Wrobot injects/hooks into the wow executable (correct me if I am wrong), I went looking for some kind of alternative. I spoke with the creators of Zzukbot, formerly Betterbot, a bot that does not hook into the executable (wow32.exe) at all. It is given elevated (administrative) privileges so that cheat detection does not have the privileges to see the robot, if that makes sense.  Zzukbot is java based which I have no clue how that all even works as I am not a programmer but that is what I learned. When I told these guys that Tauri detected wrobot, they were confused and thought I didn't know what I was talking about. I told them people were being banned by just having the robot open not operating. I was told that private servers (or blizzard until recently) do not use this type of injection detection. He asked me if Tauri used a custom launcher, which they do, so Tauri is pretty damn smart with regards to how they distribute their client. Anyways, if anyone was interested in talking programming with the zzukbot creators, they are in the zzukbot channel on slack: https://zzukbot.slack.com/.

Also, here is the source code as it was made public (in case wrobot want's to incorporate it, which I would totally pay for ? ):

https://github.com/Zz9uk3/ZzukBot_v1

Zzukbot only works with Vanilla.

[Matenia 627]

Zuukbot is C# and hooks. Warden is entirely different in Vanilla to MoP. ZzukBot just filters warden calls in vanilla to prevent detection. In MoP, Warden is much more advanced and way harder toget past that detection.
 

Regarding BetterBot, it was and will never be the same as ZzukBot. It's a Java based bot that uses C to do memory reading for camera angles and such, then sends clicks into the game. You have to run every instance under a different windows user.
None of what you said really contributes. I happen to know both the guys behind BetterBot and ZzukBot too. They are incredibly skilled - but none of this applies to MoP, the situations are just not comparable.

None of what you linked (which isn't even ZzukBot V3 anyway) is going to help here. And even vanilla can detect hooks and injection, if you write to memory at all. That is how oGasai was detected for quite a while. From TBC upwards, servers have implemented a way to detect insecure Lua calls too, which is how most servers now instantly ban PQR.

[prestonjacobs 4]

any update @Droidz ?

[Droidz 2738]

I found how they detect WRobot I'll fix it in next update

 

[tutker 0]

15 hours ago, Droidz said:

I found how they detect WRobot I'll fix it in next update

 

Thank you! You are awsome! When release next update? ?

[Droidz 2738]

If you can try with the new update and confirm me than problem is resolved (be careful)

[tutker 0]

1 hour ago, Droidz said:

If you can try with the new update and confirm me than problem is resolved (be careful)

Ok, i can try it with alter char, if this can help you. Where can i download updated version?

Oh, i think i found it, 2.2.0?

Edited September 20, 2018 by tutker
Add question

[Droidz 2738]

launch updater, and yes it is version 2.2.0