[00:00.000 --> 00:01.340]  World of game hacking.
[00:03.220 --> 00:04.700]  Oh, I have to hold this thing right.
[00:04.820 --> 00:05.600]  Oh, no, it's pretty good.
[00:05.740 --> 00:05.940]  Okay.
[00:07.760 --> 00:12.540]  So, if I was on my first slide right now, it would be telling you that I am Nick Cano.
[00:12.700 --> 00:13.400]  I'm 21.
[00:13.660 --> 00:15.520]  I've been breaking computers since I was 12.
[00:16.820 --> 00:19.900]  Professionally, I'm authoring a book for the No Starch Press on game hacking.
[00:20.480 --> 00:25.320]  I develop bots for online games, and I also do malware analysis and detection at my day job.
[00:26.280 --> 00:30.060]  For hobby work, I like vulnerability discovery and rootkit and malware development.
[00:30.820 --> 00:34.420]  And that's kind of really related to my game hacking stuff.
[00:34.900 --> 00:39.940]  So, this presentation is going to talk about... let me fix this.
[00:42.280 --> 00:46.640]  Okay, so this presentation is going to talk about just kind of the world of game hacking.
[00:46.800 --> 00:50.620]  It's not going to be so technical, so you're not going to walk out of here like a pro game hacker.
[00:50.840 --> 00:59.980]  But it is going to tell you about kind of just the tools game hackers use, the methods they use, and the fight between game hackers and game companies.
[01:01.140 --> 01:11.960]  So, we're going to start off just talking about an overview, and then we're going to go into the tools of the trade, all the methods that game hackers use for full control, and then we'll talk about the moral and legal implications.
[01:12.180 --> 01:13.720]  And that's really the main point of this talk.
[01:16.710 --> 01:19.950]  I'm using my non-existent slides to kind of guide my talk.
[01:21.370 --> 01:22.610]  So, what is game hacking?
[01:22.750 --> 01:24.370]  Game hacking is automating gameplay.
[01:25.110 --> 01:26.650]  There's a lot of things you can do.
[01:28.110 --> 01:30.070]  You write bots when you're hacking games.
[01:30.610 --> 01:37.650]  And so, there's like cave bots, which are bots that can walk around in the game, and hunt and kill monsters, collect gold, do whatever, and get you levels.
[01:37.990 --> 01:40.970]  And that's normally what you're going to sell, is a cave bot.
[01:41.150 --> 01:49.290]  And then some people make aim bots, maybe for like first-person shooters, that will automatically aim their gun, and then they shoot headshot dead, they win.
[01:49.290 --> 01:50.890]  And then there's auto healers.
[01:51.010 --> 01:58.090]  Some people just don't want to be bothered healing in the game, so they have it detect when your health is low, press a button, okay, you've done healed.
[01:58.490 --> 01:59.750]  And then there's combo bots.
[02:00.110 --> 02:09.930]  So, in like PvP-heavy games, you might make a bot where like, when my friend shoots this spell, I'm also going to shoot this spell, and then you just have ten kids shoot a spell, and there's a headshot, and the guy's dead.
[02:10.830 --> 02:14.450]  So, all of these things can be really profitable.
[02:15.170 --> 02:27.850]  And then there's also other bots that people will write, which not so much as profitable, but they're normally integrated into the more advanced stuff, and these like heads-up displays, where you might show extra information, like the combo bot just did this much damage,
[02:27.950 --> 02:31.650]  or like you just got hit for this much damage in the past second, and stuff like this.
[02:31.930 --> 02:34.130]  Just things to make it easier for the people playing.
[02:34.430 --> 02:45.830]  And then there's like extra perception, extra sensory perception bots, like wall hacks, or floor hacks, or spying up a level, or seeing someone through a mountain, and stuff like this.
[02:46.510 --> 02:50.030]  And some people, some game hackers also write recorders and replayers.
[02:50.190 --> 02:54.390]  Like, there's a tool called LOL Replay for League of Legends that can record the games.
[02:54.510 --> 02:59.030]  What it does is it captures all the packets, and then just replays them to the client at any time, so you can watch it.
[02:59.510 --> 03:00.250]  Stuff like that.
[03:01.670 --> 03:06.690]  So, game hacking started probably when online gaming started, to be honest.
[03:06.690 --> 03:09.990]  I mean, as soon as something new comes out, hackers want to break it.
[03:10.190 --> 03:11.610]  So, game hacking's been around for a while.
[03:11.830 --> 03:26.510]  But if you want to look at like the golden age, when the most bots, when bots were most effective, and they were best, is probably late 90s, early 2000s, when online gaming was becoming prevalent, but the games were still simple enough to manipulate easily.
[03:26.950 --> 03:33.110]  So, games like Tibia, Ultima Online, and RuneScape all came out around 97, 2000.
[03:33.110 --> 03:39.450]  And these games, if you play them, you'll realize a lot of people use bots on these games, just because of how simple their architecture is.
[03:41.110 --> 03:41.990]  Raise my water.
[03:48.730 --> 03:51.060]  And then there's the question of, why do we do it?
[03:51.100 --> 03:51.720]  Why do we hack games?
[03:51.780 --> 03:52.760]  A lot of people do it for fun.
[03:52.840 --> 03:54.400]  I started out a 14-year-old kid.
[03:54.580 --> 03:55.680]  I saw people with bots.
[03:55.740 --> 03:56.980]  I was like, cool, I want to do that.
[03:57.260 --> 04:00.500]  So, it's a challenging hobby for someone who's into hacking.
[04:01.080 --> 04:01.840]  It's really fun.
[04:01.840 --> 04:07.220]  It's also great practice for anyone trying to learn reverse engineering, or just development in general.
[04:08.240 --> 04:09.680]  Some people do it for the reputation.
[04:10.080 --> 04:14.060]  It's cool to say to all your friends in the game, look, I made this bot, go use it.
[04:14.540 --> 04:15.520]  And then profit.
[04:15.720 --> 04:18.940]  And this is the main motivation for a lot of the really good game hackers is profit.
[04:19.080 --> 04:23.580]  You can get in-game gold, an extreme amount of it, and real-life money as well.
[04:23.700 --> 04:26.820]  People make six figures, people make millions of dollars selling bots.
[04:26.820 --> 04:28.470]  So, it's an actual real business.
[04:31.240 --> 04:34.120]  So, if I had slides, you'd see this pretty graph.
[04:34.560 --> 04:37.230]  But I have a case study of a game called Tibia.
[04:37.680 --> 04:39.170]  No one's ever heard of this game.
[04:39.700 --> 04:45.560]  So, in 2011, they reported that after expenses, they made $1.8 million.
[04:46.340 --> 04:57.170]  Now, estimated from my income, the income of other bot makers, and the income of everyone I know in the botting community for that game, the botting community made about $1.1 million.
[04:57.740 --> 05:00.680]  So, only $700,000 less than the game itself.
[05:00.940 --> 05:05.080]  So, it can be... profit can be a huge motivation for game hackers.
[05:06.600 --> 05:19.420]  And then another case study, if you look at World of Warcraft, which many more of you have heard of, the guy who created bots called Pocket Gnome and Shadow Bot, made a company called Ceiling Fan Software.
[05:19.420 --> 05:23.300]  Where he made $289,000 in the time he sold these bots.
[05:24.140 --> 05:26.820]  And then there's a guy, Mike Donnelly, I believe is his name.
[05:26.940 --> 05:29.120]  He gave a game hacking talk at DEFCON a few years ago.
[05:29.500 --> 05:35.340]  He had a company called MDY Industries that made a bot called Glider, and it made $4 million in its lifetime.
[05:39.360 --> 05:40.820]  So, tools of the trade.
[05:41.680 --> 05:46.500]  If you're a game hacker, one of the number one things you need is called Cheat Engine.
[05:46.500 --> 05:48.700]  It's a memory scanner, so you pull it up.
[05:49.020 --> 05:50.080]  You attach to your game.
[05:50.220 --> 05:52.480]  You say, oh, I have 500 health right now.
[05:52.580 --> 05:54.900]  So, you put in the value 500, hit scan.
[05:55.220 --> 05:58.760]  Now you see every memory address where 500 is, right?
[05:58.840 --> 05:59.760]  Now you let your health change.
[05:59.880 --> 06:00.920]  Now it's 480.
[06:01.180 --> 06:03.160]  You put 480 in, hit scan again.
[06:03.440 --> 06:06.280]  You do that until you have like one result, maybe two results.
[06:06.460 --> 06:07.360]  It doesn't matter at this point.
[06:07.460 --> 06:09.260]  They're probably both representing health.
[06:09.520 --> 06:10.520]  Now you know what your health is.
[06:10.520 --> 06:15.660]  So, now you can make an arbitrary program that just reads this one memory address in the game and hits a button.
[06:15.720 --> 06:16.960]  Now you have an auto healer, right?
[06:17.380 --> 06:19.140]  So, it's a really powerful tool.
[06:19.340 --> 06:20.540]  It's also great for writing.
[06:20.600 --> 06:24.080]  You can write scripts in Lua to easily manipulate memory.
[06:24.280 --> 06:25.580]  It's great for prototyping.
[06:25.960 --> 06:31.180]  So, if you say, oh, I want to make some hack that manipulates memory in some way, it's great for testing.
[06:33.320 --> 06:37.960]  OLEDBG is another great tool that people use, or IDA or whatever you want to use, any debugger really.
[06:38.680 --> 06:40.660]  You can manipulate the game's code.
[06:40.920 --> 06:42.660]  You can step through it, see what it's doing.
[06:42.860 --> 06:43.780]  It's really powerful.
[06:46.220 --> 06:49.460]  If you're really serious about game hacking, it's something you definitely can't do without.
[06:49.820 --> 06:52.500]  And then, of course, there's Process Monitor and Process Explorer.
[06:52.620 --> 06:53.420]  They're just god mode.
[06:54.480 --> 06:56.380]  So, like, you drop Process Monitor.
[06:56.500 --> 06:58.500]  You want to figure out how is this game loading map files.
[06:58.600 --> 07:01.340]  Maybe you want to modify the map and find the code that's touching it.
[07:01.600 --> 07:04.320]  So, you look at your Process Monitor log.
[07:04.320 --> 07:09.360]  You find the thing that's saying read file on something, something, something.map.
[07:09.580 --> 07:10.580]  You double-click it.
[07:10.600 --> 07:14.400]  Now you have a full stack trace of all kernel mode and user mode code that calls it.
[07:14.720 --> 07:17.740]  And now you can find exactly where the game touches that map file.
[07:19.100 --> 07:21.460]  And then, of course, a good development environment is key.
[07:22.020 --> 07:23.120]  I use Visual Studio.
[07:23.360 --> 07:24.400]  Some people use Notepad.
[07:25.020 --> 07:26.580]  Others use Vim and GCC.
[07:26.580 --> 07:28.500]  It's really up to you.
[07:28.620 --> 07:34.840]  But most game hackers stick to low-level, compiled-to-native code stuff, because they have a lot of control over the game.
[07:36.740 --> 07:43.460]  And then, once you have your toolkit, and once you've reverse-engineered a game, there's a lot of things you can do with that.
[07:43.520 --> 07:44.560]  You can manipulate memory.
[07:44.820 --> 07:49.900]  Let's say you reverse-engineer the list of creatures in the game, right?
[07:50.040 --> 07:54.380]  And it has some value in the structure that says, this creature is not visible.
[07:54.860 --> 07:56.960]  Well, now you iterate through that list.
[07:57.120 --> 07:58.520]  You slap them all to one.
[07:58.840 --> 07:59.940]  And now every creature is visible.
[08:00.060 --> 08:01.800]  You see every creature, even if you're not supposed to.
[08:01.880 --> 08:02.420]  Stuff like this.
[08:04.200 --> 08:05.800]  Or you can inject a DLL.
[08:07.960 --> 08:09.740]  DLL injection is really powerful.
[08:09.940 --> 08:11.180]  It's also really detectable.
[08:11.820 --> 08:12.400]  So there's a debate.
[08:12.520 --> 08:14.080]  Some game hackers just don't touch it.
[08:14.560 --> 08:15.700]  I do it all the time.
[08:16.020 --> 08:19.340]  So you can inject a DLL, and you can hook functions.
[08:19.440 --> 08:23.060]  So let's say the game's calling DirectX drawText function, right?
[08:23.360 --> 08:26.380]  So you look at the text that's being drawn, and, oh, it's your enemy name.
[08:26.560 --> 08:29.280]  So now you know where the enemy name's being drawn on the screen.
[08:29.480 --> 08:30.680]  Move the gun to that position.
[08:30.800 --> 08:31.320]  Hit a button.
[08:31.720 --> 08:32.240]  Aim bot.
[08:35.600 --> 08:36.480]  Where am I at?
[08:37.620 --> 08:40.140]  And you can do a lot of other things with hooking as well.
[08:40.680 --> 08:41.980]  It's great for drawing, too.
[08:42.160 --> 08:42.760]  Drawing HUDs.
[08:42.840 --> 08:47.860]  You can hook, like, drawing player name function again, and maybe draw stuff under them.
[08:47.940 --> 08:50.260]  Like, they have this much health if it doesn't normally show that.
[08:50.260 --> 08:51.620]  So it's great for that as well.
[08:56.060 --> 08:58.380]  Stealth methodology is another big thing.
[08:59.880 --> 09:01.640]  Games will try to detect bots.
[09:01.840 --> 09:03.380]  They will ban people who use them.
[09:03.520 --> 09:04.460]  And that's not fun.
[09:04.560 --> 09:06.500]  If you're selling a bot, your users get banned.
[09:06.540 --> 09:07.720]  You're not selling a bot anymore.
[09:08.140 --> 09:11.500]  So you really have to pay attention to stealth.
[09:14.700 --> 09:23.800]  So one thing, like, the first thing someone does if they're trying to hide from client-side detection at game is removing any injected DLLs from the module list.
[09:23.960 --> 09:27.780]  So they grab process environment block, find the module list, take it out.
[09:27.900 --> 09:31.640]  And now game doesn't know your DLL is injected unless it uses some advanced techniques.
[09:32.460 --> 09:35.620]  And then there's, like, randomizing the names of your processes in Windows.
[09:35.620 --> 09:40.580]  So instead of bot.exe, every time you start it up, it's askalaskalaskalask.exe.
[09:40.720 --> 09:41.640]  Some random text, right?
[09:42.500 --> 09:46.740]  And then there's hiding bot artifacts using rootkits.
[09:46.860 --> 09:51.180]  So maybe you just hook every single file function that the game could possibly call.
[09:51.360 --> 09:54.620]  And you just make sure it never shows your files in memory.
[09:54.740 --> 09:55.920]  Simple user mode rootkits.
[09:56.840 --> 10:05.600]  Or if you want to get really advanced, you might manual map the DLL in memory with no headers and do all the relocations yourself and do some crazy advanced stuff.
[10:05.760 --> 10:09.900]  Like, if you're up against a blizzard or something, that's something you definitely need to do if you're injecting.
[10:11.580 --> 10:15.920]  And another method you'll use to keep games from detecting you is anti-reversing.
[10:16.220 --> 10:27.260]  So maybe you'll take your PE header once you inject a DLL or once your process forks, you just blank out that PE header of everything but import tables and the essentials the process needs to run.
[10:27.600 --> 10:28.740]  So it's harder to detect.
[10:29.000 --> 10:29.200]  Or...
[10:29.920 --> 10:32.140]  Because once you corrupt that, they attach a debugger.
[10:32.180 --> 10:33.440]  Debugger might get confused, right?
[10:33.500 --> 10:36.120]  If you take out the entry point or whatever, depending on the type of debugger.
[10:37.260 --> 10:40.020]  You can pack your code.
[10:40.200 --> 10:42.460]  So you have a DLL packed into your resource section.
[10:42.700 --> 10:44.280]  You decrypt it at run time.
[10:44.460 --> 10:45.680]  You manual map it into memory.
[10:45.800 --> 10:46.460]  All your code's there.
[10:46.520 --> 10:47.840]  It makes it really hard to reverse engineer.
[10:49.020 --> 10:52.000]  Or there's also debugger detection, which is really common.
[10:52.000 --> 10:53.420]  There's many ways to do it.
[10:53.800 --> 10:56.620]  And the fun thing is hindering analysis upon detection.
[10:56.760 --> 10:59.220]  Like me, I like to blue screen them if they're debugging my process.
[10:59.500 --> 11:02.460]  So you can call set-processes-critical from NTDLL.
[11:02.640 --> 11:06.920]  And now if your process has debug rights and it dies, computer blue screen.
[11:07.200 --> 11:11.620]  So detect the debugger, hit exit after calling set-processes-critical, blue screen.
[11:11.700 --> 11:12.480]  They lost everything.
[11:12.780 --> 11:15.100]  So that's one of my favorite methods.
[11:17.840 --> 11:19.260]  Moral and legal implications.
[11:19.260 --> 11:21.640]  These are something... this is one thing you really have to think about.
[11:22.740 --> 11:28.360]  There's the moral aspect of if a game gets overrun with bots, you've basically killed that game.
[11:28.480 --> 11:29.720]  There's no fun left, right?
[11:30.200 --> 11:35.320]  And then there's the legal implications of game companies will seriously sue you if you ruin their game.
[11:36.360 --> 11:41.960]  If you look at how bots affect virtual worlds, there's... botters get large advantages.
[11:41.960 --> 11:44.960]  So they have more in-game assets, more items.
[11:45.160 --> 11:46.180]  They have more gold.
[11:46.460 --> 11:48.520]  They get... they go to work and they come back.
[11:48.640 --> 11:50.320]  They have five more levels above you.
[11:50.720 --> 11:55.160]  And they might have enhanced PvP abilities because they have their combo bots or their aim bots or whatever.
[11:56.820 --> 11:59.900]  So the economy becomes extremely inflated because of this.
[12:00.360 --> 12:01.420]  Gold becomes abundant.
[12:02.120 --> 12:03.920]  Cash for gold services thrive.
[12:05.640 --> 12:10.560]  And it's just... it's immensely hard for new players to come into a game and play it.
[12:10.640 --> 12:15.860]  When you have level 400 running around with infinite gold and you're a level one like, well, what do I do?
[12:15.940 --> 12:17.020]  Oh, someone just killed me.
[12:18.300 --> 12:20.520]  And the game mechanics also change.
[12:20.720 --> 12:28.680]  Sometimes games will implement... implement new mechanics or new ways of playing the game to make it easier for fair players to keep up with bots.
[12:28.900 --> 12:30.740]  But that inherently kills the game.
[12:30.740 --> 12:32.100]  It's not what it used to be.
[12:32.240 --> 12:33.600]  It's easier or it's different.
[12:34.120 --> 12:35.320]  So that's also an issue.
[12:36.840 --> 12:41.080]  So one case study I have here is a game called Tibia again.
[12:41.460 --> 12:53.260]  In 2007, if you wanted to spend $30 to buy gold in this game when the gold was much more challenging and there were no bots, you would get maybe 75,000 gold for $30 if you're lucky in 2007.
[12:53.660 --> 12:56.260]  Now in 2014, game is overrun with bots.
[12:56.260 --> 12:58.020]  You spend 30 bucks, you have 4 million gold.
[12:58.260 --> 12:59.000]  Go crazy.
[13:01.260 --> 13:07.360]  Another case study on Tibia is in 2009, the game had been around for 12 years.
[13:07.660 --> 13:14.000]  The top level was level 430 and the 1,000th level was level 220.
[13:14.680 --> 13:24.780]  Now in 2014, which is, what, five years later, the 1,000th level is 398 and the top level 744.
[13:25.960 --> 13:27.640]  That seems like double.
[13:27.820 --> 13:30.620]  The experience difference there is actually almost six times.
[13:30.940 --> 13:39.840]  So in the five years since bots became prevalent in this game, people are six times higher level than they were in the 12 years that the game was played manually.
[13:39.980 --> 13:41.400]  Which, it's a huge deal.
[13:45.360 --> 13:50.460]  So when game companies see this happening to their games, they obviously want to take out the botters.
[13:50.860 --> 13:53.020]  So they'll implement detection methods.
[13:53.240 --> 13:54.520]  Blizzard has Warden.
[13:55.280 --> 14:04.580]  Some game companies have their own proprietary software, but most companies go with out of the box solution, like Valve Anti-Cheat or Punk Buster or Game Guard or Hack Shield.
[14:04.580 --> 14:08.140]  The problem with these is they're just broken by nature.
[14:10.100 --> 14:14.020]  So when they detect people, which they're not always legit detections.
[14:14.120 --> 14:16.620]  Sometimes the detection is just broken, the player never bought it.
[14:17.240 --> 14:18.520]  They'll just delete the account.
[14:18.660 --> 14:20.640]  Sometimes they'll ban them, but normally they delete their accounts.
[14:20.760 --> 14:22.700]  And whatever money they spent on that game is gone.
[14:23.220 --> 14:28.080]  And it's very expensive for players, whether they bought it or not, if the game is pay to play.
[14:28.200 --> 14:32.620]  Like if you have to pay $60 for a copy of this game and you're banned, then you probably don't want to bought.
[14:32.620 --> 14:37.800]  And like I said, tens of thousands of fair players have been wrongly banned in the past due to bugs.
[14:38.180 --> 14:40.720]  An example of this is Punk Buster.
[14:41.880 --> 14:48.580]  So recently, actually in October of 2013, there was a false positive for their Battlefield 4 detection.
[14:50.160 --> 14:56.240]  Something like 2,000 to 4,000 players just got banned and they didn't get their accounts back for a week.
[14:56.300 --> 14:57.680]  And that's like a $60 game, right?
[14:58.220 --> 15:06.360]  And then back in 2008, there was actually a group of hackers that was like, well, hey, Punk Buster just arbitrarily scans memory.
[15:06.540 --> 15:07.340]  We should attack it.
[15:07.700 --> 15:11.080]  So they open up IRC and they go into some high populated channels.
[15:11.240 --> 15:15.140]  And they just spam signatures, bought signatures in IRC.
[15:16.120 --> 15:20.180]  Everyone, everyone with the IRC channel open just gets banned instantly, right?
[15:20.180 --> 15:23.100]  So just completely taken out.
[15:23.360 --> 15:26.980]  So it just shows how broken the detection can be in some instances.
[15:27.040 --> 15:29.440]  Because it just scanned memory of every process.
[15:29.640 --> 15:31.860]  Not processes with handles to the game.
[15:32.120 --> 15:33.600]  Not game processes.
[15:33.860 --> 15:35.720]  Not processes that open after the game.
[15:35.860 --> 15:36.440]  Just everything.
[15:39.460 --> 15:42.080]  I had one other case study and I totally lost it.
[15:42.900 --> 15:48.400]  So Valve Anti-Cheat actually has a much worse track record than Punk Buster.
[15:48.700 --> 15:54.260]  There's been seven times since it was released in early 2000s that it's wrongfully banned people.
[15:54.600 --> 15:58.780]  So the initial release was just banning people at random for what they call faulty memory.
[15:58.900 --> 16:00.020]  I don't even know what that means.
[16:01.180 --> 16:02.900]  But it was pretty bad.
[16:03.600 --> 16:11.260]  And then same version and a few versions after that would ban players who are using a wine equivalent for gaming.
[16:11.560 --> 16:12.040]  Sedega.
[16:12.180 --> 16:12.780]  I've never heard of it.
[16:13.060 --> 16:18.600]  But anyone who was using that, which was like wine but for games, would get banned on Linux.
[16:18.840 --> 16:20.000]  So that was pretty bad.
[16:20.340 --> 16:26.140]  In 2004, there was a server side glitch that banned like 12,000 people.
[16:26.600 --> 16:28.760]  Funnily enough, it happened on April 1st.
[16:28.760 --> 16:31.020]  So I don't know if they were just joking around or what.
[16:33.960 --> 16:37.620]  July 2010, another 12,000 people were banned on Call of Duty.
[16:38.680 --> 16:44.320]  Because Valve Anti-Cheat, which is made by the guys who make Steam, thought a Steam update was a bot.
[16:44.860 --> 16:48.320]  Steam replaced the DLL in place while the game was running.
[16:48.460 --> 16:50.160]  And VAC was like, oh, that can't be good.
[16:50.380 --> 16:50.880]  Banned.
[16:51.000 --> 16:52.000]  12,000 people gone.
[16:54.540 --> 16:59.780]  So in 2011, more COD players were banned due to being affected by malware.
[16:59.780 --> 17:05.260]  So this malware is walking around with a bot signature for some reason, and it's getting a bunch of people banned.
[17:06.220 --> 17:14.220]  And then in 2011 and 2014, there were undisclosed bugs that got another handful of people banned on VAC.
[17:14.220 --> 17:18.380]  So bot detection can be really broken in some instances.
[17:20.000 --> 17:27.680]  So instead of going after the players, sometimes game companies decide, let's go after the hackers, the people who are making the bots.
[17:28.160 --> 17:33.000]  So game companies will sue you if you make a bot and they get mad at you.
[17:35.120 --> 17:37.200]  There are a few instances of this I'm going to talk about.
[17:38.440 --> 17:39.620]  First, a small anecdote.
[17:39.940 --> 17:42.200]  I made a tool for a game called League of Legends.
[17:42.540 --> 17:44.320]  My tool was called LOL Oracle.
[17:44.480 --> 17:52.560]  And what it did is, whenever the loading screen pulled up, it just showed like the players' ranks and their win-loss ratio, how many times they played that champion, stuff like this.
[17:53.140 --> 17:59.780]  So Riot Games, the game company that made League of Legends, they had a website for tools like this, where it says, this is what you can do, this is what you can't do.
[17:59.900 --> 18:01.600]  If you're in a gray area, send us an email.
[18:01.760 --> 18:02.620]  Here's our email address.
[18:03.300 --> 18:06.880]  So for two weeks, I'm sending them emails like, hey, I made this tool.
[18:07.060 --> 18:08.060]  I want to release it.
[18:08.160 --> 18:09.600]  I don't want to piss you off.
[18:09.760 --> 18:10.640]  Can you respond?
[18:10.720 --> 18:11.400]  Here's what it does.
[18:11.560 --> 18:12.160]  Here's the code.
[18:12.260 --> 18:12.600]  Let me know.
[18:12.800 --> 18:13.760]  I get nothing back.
[18:13.920 --> 18:14.440]  So whatever.
[18:14.640 --> 18:15.440]  Two weeks has gone by.
[18:15.700 --> 18:19.540]  I buy a website template, buy a host, put up a website, announce it on Reddit.
[18:20.120 --> 18:21.860]  Almost immediately, I get a message on Reddit.
[18:22.000 --> 18:24.280]  Hi, my name's Dave Pritchett.
[18:24.340 --> 18:25.220]  I'm from Riot Games.
[18:25.360 --> 18:26.260]  Can you add me on Skype?
[18:26.320 --> 18:27.140]  I want to talk to you.
[18:27.140 --> 18:28.640]  I had this guy on Skype.
[18:28.800 --> 18:33.140]  Basically, what he has to say is, you need to shut this down or we're going to send a cease and desist.
[18:33.440 --> 18:41.340]  He basically told me, look, the lawyers just wanted to send you a cease and desist because we don't like this thing, but I didn't want it to go to legal if it didn't have to.
[18:41.440 --> 18:44.020]  So I'm asking you nicely or we might take you to court.
[18:44.780 --> 18:47.780]  Literally within an hour of release in this thing after emailing them.
[18:48.300 --> 18:53.860]  So some more intense instances of this can be seen with World of Warcraft.
[18:53.860 --> 18:57.380]  They really go after bot makers.
[18:57.640 --> 19:01.560]  So I mentioned both CeilingFan software and MDY Industries earlier.
[19:01.760 --> 19:03.900]  CeilingFan made $268,000.
[19:04.200 --> 19:08.580]  Blizzard in 2012 reamed them in court for $7 million.
[19:09.180 --> 19:16.240]  $7 million settlement because they made $268,000 or $98,000 selling bots.
[19:16.240 --> 19:20.840]  Then in 2006, much earlier, MDY made $4 million.
[19:21.080 --> 19:23.920]  They got reamed for $6 million by Blizzard as well.
[19:25.900 --> 19:28.680]  So TLDR, if you piss off game companies, you're f*cked.
[19:31.280 --> 19:32.720]  Oh, also RuneScape.
[19:33.020 --> 19:34.540]  There was a bot for RuneScape.
[19:35.680 --> 19:41.440]  And Jagex, the people who make RuneScape, basically said, you can't make this, we're suing you.
[19:42.060 --> 19:46.580]  Once the lawsuit finished, there was an undisclosed amount of money paid.
[19:47.440 --> 19:54.280]  But the people who developed the bots, if they touch RuneScape, talk about RuneScape, or touch any other Jagex game, they have to pay a million dollars.
[19:54.700 --> 19:55.980]  That was part of the court settlement.
[19:56.260 --> 20:01.240]  So they just said, don't go anywhere near our stuff ever again, or you're going to have to pay us a lot of money.
[20:01.380 --> 20:03.100]  So they take it very seriously.
[20:04.100 --> 20:05.800]  Okay, that's it.
[20:05.940 --> 20:09.120]  I wish I had my slides, because I'd have some better visual representations.
[20:09.920 --> 20:12.520]  I'll open it up to Q&A if anyone has any questions.
[20:15.650 --> 20:19.370]  Actually, I have a good case study in and of itself.
[20:20.550 --> 20:43.330]  About, I'd say, sometime around mid to early last year, a game called Arma 3 had a, frankly, a worm that was a game hack, which was using the in-game scripting language, to infect the profiles of the players, and then it spread through the multiplayer.
[20:43.670 --> 20:50.550]  And in spreading, what it would do is, it would cause everything on the server to blow up, and it would kill everybody and all that stuff.
[20:50.670 --> 20:52.830]  And it would say, hey, Bohemia, fix your game.
[20:53.290 --> 21:02.490]  So what it was doing was, it was exploiting the fact that they had functions which could be recompiled in-game after they were called.
[21:03.250 --> 21:09.070]  So they were able to use that to act as a worm and infect the user profiles.
[21:09.310 --> 21:14.470]  In order to get rid of it, you had to delete the user profile to actually get rid of it.
[21:14.550 --> 21:19.990]  But if you got into another multiplayer server with someone in there, everybody in the server got infected.
[21:21.550 --> 21:27.710]  That sounds along the lines of the punk buster trick that they did with just banning a bunch of random people.
[21:28.790 --> 21:31.710]  Oh, that was... I was in the developer...
[21:33.450 --> 21:38.070]  I was in the developer community chats for that game when that was going on.
[21:38.390 --> 21:39.670]  It was chaos.
[21:40.510 --> 21:40.730]  Yeah.
[21:41.470 --> 21:43.330]  Any other questions?
[21:48.200 --> 21:49.040]  Hi, yes.
[21:49.720 --> 21:55.040]  I had to quickly run to your interview because I do the radio stuff, but I got to see most of you here talking.
[21:55.120 --> 22:05.600]  I'm really happy that you're able to do a talk, not only about games, but something I feel important to me because I used to develop games as an independent contractor from 2005 to 2009.
[22:05.780 --> 22:08.500]  I left that because I work in the other hell now, which is gaming marketing.
[22:09.840 --> 22:18.300]  And one of the main reasons why I left is I used to do design, mainly level design and working with the people who run the engines in the art department and connect them together.
[22:19.440 --> 22:40.420]  And what frustrated me and had me left is compounding that we've dumbed down our gaming audience for being creative, essentially punishing them for exploring options and possibly making new game plays, combined with the fact that the gaming industry tends to copy what's successful without understanding why things were successful,
[22:40.560 --> 22:44.600]  unless they're also afraid due to budgets to do any sort of new change.
[22:44.600 --> 22:52.220]  My question is that do you think this is something that will never be fixed or do you think what would it take for companies to start going back on this?
[22:52.320 --> 22:53.900]  Is it the expansion of indie games?
[22:54.000 --> 22:56.740]  Would it be the death of the quote-unquote triple-A market?
[22:58.600 --> 22:59.860]  Honestly, it's hard to say.
[23:02.000 --> 23:03.260]  I've noticed the same as you.
[23:03.480 --> 23:06.420]  And one big thing is when a game is successful, everyone copies it.
[23:06.540 --> 23:07.500]  Like, look at Call of Duty.
[23:07.720 --> 23:16.740]  Like, five years ago it was a great game to play and now they've just re-released the same game with the same cutscenes and same graphics and everything a million times.
[23:18.600 --> 23:24.440]  So, to that, I'm really not sure what it'll take for the gaming industry to realize this.
[23:25.700 --> 23:30.620]  I'm not so much the creative type or the marketing type, so that might actually be out of my depth at this point.
[23:30.800 --> 23:39.740]  I personally think it's probably going to be a combination of factors, and I think they're going to slowly reach their vector points soon with the way it tastes have been changing.
[23:40.020 --> 23:42.600]  But I think what would be really important is talks like what you've done.
[23:42.700 --> 23:44.460]  So, thank you for having this talk.
[23:44.580 --> 23:45.160]  I appreciate it.
[23:45.260 --> 23:45.680]  Thank you.
[23:51.730 --> 23:52.170]  Hello.
[23:52.170 --> 23:53.770]  This was an interesting talk.
[23:54.150 --> 23:57.270]  I've always wondered, like, what the heck is Punk Buster anyway?
[23:57.730 --> 23:59.850]  And now I know a little something about that.
[24:00.710 --> 24:15.090]  My question is, so it sounds like they are detecting bots by basically kind of checking to see if the game that's running is the same game that the developers wrote.
[24:16.730 --> 24:20.610]  Is there anything like heuristic detection?
[24:20.610 --> 24:28.310]  Like, if it notices somebody is shooting very accurately, then that's a possible bot?
[24:28.730 --> 24:31.730]  So, heuristic detection is typically server-sided.
[24:32.030 --> 24:36.190]  One of the games I make a bot for called Tibia right now, they do a lot of server-sided detection.
[24:37.150 --> 24:47.530]  And it's mostly based on, like, if this player walks to the same place a hundred times today, well, it's probably a bot because people play much more randomly.
[24:47.590 --> 24:49.710]  They just go where they feel like going and stuff like this.
[24:50.150 --> 24:52.050]  So, there's heuristics on that aspect.
[24:52.310 --> 24:54.850]  There's also heuristics for detecting combo bots.
[24:55.010 --> 25:03.270]  Like, if the same group of ten people all shoot the same rune within 200 milliseconds ten times in a row, they're probably using a combo bot and stuff like this.
[25:04.610 --> 25:08.310]  Like you said, client-side, they're doing basically like malware signatures.
[25:08.610 --> 25:15.490]  They just have a list of signatures they scan memory for, or they check, make sure all the DLLs have the same code and memory that they had on disk.
[25:17.510 --> 25:21.490]  Wood of Warcraft has a really interesting way of detecting client-side as well.
[25:21.810 --> 25:23.770]  And it might include some heuristics.
[25:23.930 --> 25:25.290]  We don't really know.
[25:25.490 --> 25:35.470]  I haven't looked at Warden, but from what I've been told, no one really knows what it can do, because it sends down some compiled bytecode and some proprietary language to the client.
[25:35.730 --> 25:39.570]  This bytecode executes, and it has some question in there.
[25:39.670 --> 25:42.230]  It has some riddle, basically a function that returns some value.
[25:42.410 --> 25:45.890]  And when that value is returned, then the game sends it to the game server.
[25:45.890 --> 25:51.190]  So the only way to evade that is really to let it execute and hope you don't get caught.
[25:51.230 --> 25:57.090]  Because if the game server doesn't get that response, then it knows you've just shut off Warden and it'll disconnect you or ban you or do whatever.
[25:57.630 --> 25:59.710]  So yeah, there's a lot of interesting methods.
[26:00.410 --> 26:02.690]  And heuristic detection is definitely one.
[26:02.830 --> 26:04.190]  There's great papers on it.
[26:04.250 --> 26:06.990]  I wish I had the information with me right now.
[26:06.990 --> 26:10.410]  But yeah, it's definitely something that's used, but mostly server-sided.
[26:12.990 --> 26:14.110]  A follow-up.
[26:16.010 --> 26:19.590]  What might you do if you were on the other side?
[26:20.210 --> 26:22.970]  What might you do to check for bots?
[26:24.070 --> 26:25.830]  So I've thought about this a lot.
[26:26.310 --> 26:29.790]  And there's the signature detection, which is kind of broken.
[26:30.430 --> 26:36.070]  I would probably take that and I would chop it out to something more specific, first of all.
[26:36.070 --> 26:41.910]  Something that's not going to get you banned when you're in an IRC channel and someone pastes a signature.
[26:43.430 --> 26:48.450]  There's stuff like, instead of trying to detect bots, I think they should actually be prevented.
[26:49.290 --> 27:04.030]  So other than that, other than basic signature type detection, I would probably look at preventing bots doing things like packing the game and loading it at runtime or having it compiled in some fast but proprietary bytecode language that's run, stuff like this.
[27:06.570 --> 27:08.570]  Randomized packets and stuff like this.
[27:08.790 --> 27:20.210]  Like, the game server sends down some value between 0 and 255 and then that determines some random packet numbers that are used to identify the way it talks back and forth.
[27:20.350 --> 27:21.230]  I mean, it's a hindrance.
[27:21.470 --> 27:22.750]  It's security by obscurity.
[27:23.210 --> 27:32.330]  But when I'm making bots, if I can just see this value being pushed to a function that I've determined to be create packet, it's really easy to know that this is packet number I need.
[27:32.410 --> 27:39.510]  Now if it's got some function call and then it's doing a switch case and then I have to reverse engineer all this, it makes it extremely harder to make bots.
[27:39.510 --> 27:42.690]  So there's the security by obscurity I think is the best bet.
[27:42.850 --> 27:50.450]  And then beyond that, some signature based detection and probably some memory checks and stuff like this.
[27:50.550 --> 27:52.770]  It's really hard to approach though.
[27:52.910 --> 27:56.930]  Which is why everyone who's done it has been pretty broken so far.
[27:58.410 --> 27:59.490]  Okay, thanks.
[27:59.750 --> 28:00.310]  Thank you.
[28:02.330 --> 28:04.050]  Much thanks to the gentleman before me.
[28:04.190 --> 28:05.590]  That was very similar to my question.
[28:05.830 --> 28:09.310]  What resources would you recommend for both sides of that?
[28:12.070 --> 28:13.890]  Resources really depends on the game.
[28:14.130 --> 28:17.550]  Like if you want to hack a specific game, there's always going to be a community for it.
[28:17.730 --> 28:22.310]  If you just want general resources, I would say learn reverse engineering.
[28:22.530 --> 28:25.350]  Because it's not like... game hacking is not a specific thing.
[28:25.350 --> 28:30.930]  There's some specific things you need to know like how to effectively hook DirectX and stuff like this.
[28:31.090 --> 28:36.850]  But beyond that, it's really just knowing how to reverse engineer a game binary and then how to hook into it.
[28:37.010 --> 28:42.410]  So a little bit of malware analysis, a little bit of malware dev, throw them together and you've got Game Hacker's Arsenal right there.
[28:44.170 --> 28:47.050]  Specific resources, like I said, it depends on the game.
[28:47.290 --> 28:54.690]  For the game Tibia, there's a site called tpforums.org and it's just got every structure in this game outlined and... sorry.
[28:54.690 --> 28:58.810]  Every time there's a game update, it's got different addresses for everything in the game.
[28:58.970 --> 29:01.130]  So it's just really dependent on the community.
[29:01.590 --> 29:01.890]  Okay.
[29:02.190 --> 29:13.150]  So then, by the same token, as far as detecting that that was going on on the game developer side, sort of the methodologies that they would use, still nothing really particular?
[29:13.630 --> 29:15.530]  Well, see, that's an interesting question.
[29:15.630 --> 29:16.890]  This is another thing I've thought about.
[29:16.890 --> 29:27.270]  One huge thing, if you want to detect a bot, instead of having some catch-all software like Punkbuster, you should really find those specific communities that are making those bots and see what they're doing.
[29:27.750 --> 29:44.870]  Because if you know that this whole community that has all the main bot developers for your game, all sets, all just nopes out this jump right here to do this certain bot function, like maybe it's a jump that jumps over printing a name if the player's on a different floor or something,
[29:45.050 --> 29:48.270]  and they nope it out, so now you can always see the name, something like that.
[29:48.350 --> 30:00.310]  If you know everyone's using that, well, you can interpolate the address of where that's happening in your code using some assembly magic, and now you see if that code is 90, 90, 90, 90, and you know there's a bot.
[30:00.310 --> 30:06.010]  So if you're looking at it on a game-specific level, you can really go look at what the communities are doing and detect that way.
[30:06.510 --> 30:07.030]  Very good.
[30:07.330 --> 30:07.610]  Thanks, man.
[30:07.910 --> 30:08.190]  Thanks.
[30:10.830 --> 30:11.550]  Hey, how's it going?
[30:11.630 --> 30:11.970]  Great talk.
[30:12.170 --> 30:13.050]  Oh, man, that's so weird.
[30:14.190 --> 30:19.390]  I was curious, you know, so a lot of the services nowadays are the gaming services like, you know, Blizzard.
[30:19.550 --> 30:22.510]  You tie all your crap to like one account, you know?
[30:23.070 --> 30:27.070]  And so that means that kind of doing that testing is kind of really dangerous.
[30:27.070 --> 30:42.230]  So when it comes to, you know, trying to figure out how to, you know, how to bot a game without getting spotted, you know, what kind of methods do we do to actually test or, you know, tread the water and making sure that a bot won't get banned because it's...
[30:42.230 --> 30:46.010]  Or they make it expensive to do is what it seems like, or at least that's one mitigation.
[30:46.490 --> 30:51.590]  So a lot of the mitigation techniques or the detection techniques, they have two parts to them.
[30:51.710 --> 30:56.030]  One is like the memory scanner verifying that the DLLs are what they say they are.
[30:56.730 --> 31:01.570]  And basically every cheat software out there, there's some forum that tells you exactly how to disable it.
[31:01.750 --> 31:06.870]  What code to nope out, what functions to hook, and what returns to give, and now the software's broken.
[31:07.090 --> 31:09.790]  So it's the signature detection that matters at that point.
[31:10.270 --> 31:20.350]  And if you're sitting here with your compiler open and you're prototyping a bot, they're not going to have your signature unless you're doing something very specific, but it's... the chances are really nil.
[31:20.550 --> 31:25.510]  So if you're experimenting and you're keeping it to yourself, chances are you're not going to have a problem.
[31:25.750 --> 31:34.330]  When you start distributing that bot to your friends and stuff, and the game company sees a botting issue and they look specifically at those players, that's when there's going to be a problem.
[31:34.330 --> 31:41.910]  Or if you start selling it, well now they're going to get their security team or their anti-botting team to reverse engineer your bot, tear it apart, and find the signatures as well.
[31:42.070 --> 31:46.290]  So they're not going to like pinpoints you if all of a sudden you disable Warden or something?
[31:46.550 --> 31:48.910]  If you disable Warden, you will get pinpointed.
[31:49.030 --> 31:51.770]  Because like I said, it has that riddle thing from what I've heard.
[31:51.890 --> 31:57.970]  I've never played with it, but that's what I've heard that once it sends the code down, the server needs a response or it's going to kick you off.
[31:59.450 --> 32:01.490]  So once again, it's game specific.
[32:01.690 --> 32:03.950]  Like League of Legends, I played with it all day.
[32:03.950 --> 32:05.130]  I made zoom hacks.
[32:05.290 --> 32:06.290]  I made camera hacks.
[32:06.430 --> 32:08.030]  I did all this fun stuff with League of Legends.
[32:08.150 --> 32:08.910]  I never got banned.
[32:09.550 --> 32:12.910]  But people use bot of Legends and they get banned all the time on League.
[32:13.150 --> 32:19.890]  So it's, for the most part, for the majority of cases, that's not a problem until you start distributing the bot.
[32:20.070 --> 32:26.050]  But in cases like World of Warcraft and stuff, it might be a problem and I'm not sure I'm the best person to comment on how to get around it.
[32:27.090 --> 32:33.370]  Slightly unrelated, I was into console hacking and got all my friends banned off Xbox Live.
[32:33.370 --> 32:37.290]  And I wonder if you had any experience in doing the same kind of thing?
[32:37.710 --> 32:43.630]  I have no experience in console hacking, but from what I understand, there's a lot of hardware hacking aspects to it.
[32:43.930 --> 32:46.030]  And that's way out of my league at this point.
[32:46.410 --> 32:47.090]  Well, it's a lot of fun.
[32:47.090 --> 32:48.590]  It's something I'd love to get into.
[32:48.590 --> 32:50.930]  So I'm definitely going to check it out when I have more time.
[32:51.190 --> 32:51.490]  Cool.
[32:51.850 --> 32:52.150]  Thanks.
[32:52.150 --> 32:52.590]  Thanks.
[32:55.170 --> 33:01.450]  What's stopping the game companies from using code signing to make sure you're not nopping anything out from their PE files?
[33:03.250 --> 33:09.650]  So, code signing would work for like DLLs that are being loaded, but most games are going to inject the DLL, do it all at runtime.
[33:09.890 --> 33:16.390]  And if your code is signed, it doesn't really matter because the signature is only checked right before the process works.
[33:16.390 --> 33:21.190]  So if I'm modifying your code at runtime, then there's really nothing you can do.
[33:21.710 --> 33:24.670]  Some workarounds that games use is, of course, like ASLR.
[33:24.910 --> 33:28.150]  So it makes it hard to modify stuff at runtime, but it's still not impossible.
[33:29.450 --> 33:34.190]  For like someone who's just getting into game hacking, ASLR seems like a major setback.
[33:34.370 --> 33:40.670]  But once you've been doing it for a while, it's extremely easy because it's not like you're an exploit on the stack trying to find your location.
[33:40.670 --> 33:45.750]  I mean, you can call git module handle and now you have the base address and you do some simple math.
[33:46.270 --> 33:53.570]  So it's not really an issue because, I mean, some people do hex editing, but if you're serious, you're not hex editing.
[33:53.790 --> 33:58.530]  And if you're serious, and if you're not serious, you're probably not working with a game that has signed binaries.
[33:59.350 --> 34:03.730]  And what about attaching to itself so that you can't attach to it with a debugger?
[34:03.730 --> 34:10.830]  And if you combine that with signed binaries, now you can't attach and modify memory short of having kernel access.
[34:11.630 --> 34:14.990]  Well, you can still attach a debugger even if it's attached to itself.
[34:15.150 --> 34:16.170]  Like there's a plug-in for Oli.
[34:16.250 --> 34:20.010]  I think Oli Advance has the plug-in for this where you check attach to process anyway.
[34:20.150 --> 34:21.190]  And now you can attach to it.
[34:21.510 --> 34:23.470]  Now there's anti-debugging measures as well.
[34:23.610 --> 34:29.330]  And that's just where you pull out your reverse engineer toolkit and you go at it like you're going at malware.
[34:29.330 --> 34:36.030]  If you've ever done malware analysis, you find out how it's detecting you, you take that out of the equation.
[34:36.310 --> 34:42.930]  Now, like you said, combined with signed binaries, maybe it becomes an issue because now you have to patch it every time you attach to the binary.
[34:42.930 --> 34:45.630]  But that's where custom tools come in.
[34:45.730 --> 34:48.810]  You write a script to do this automatically or you write a plug-in or whatever.
[34:48.810 --> 34:51.030]  If you're using IDA, use IDA Python.
[34:51.270 --> 34:53.450]  Have a Python script do it as soon as you attach and stuff.
[34:53.590 --> 34:56.410]  So it's definitely a setback, but it doesn't make it impossible.
[34:56.710 --> 34:57.390]  Okay, thanks.
[34:59.970 --> 35:00.470]  Hi.
[35:01.210 --> 35:09.710]  As far as checking runtime binaries, developed a failed game about five years ago.
[35:09.910 --> 35:11.030]  The game just never took off.
[35:11.650 --> 35:18.110]  What we did though, to check it, was about every 30 seconds from the server, we would send down a fingerprint request.
[35:18.630 --> 35:21.550]  And it would fingerprint a section of memory.
[35:21.870 --> 35:24.250]  If we got the wrong answer, you got logged out.
[35:24.490 --> 35:26.470]  No banning, but gone.
[35:28.430 --> 35:37.590]  For the commercialization of bots, to prevent getting sued, why not just move it, at least the business portion of it, offshore?
[35:38.750 --> 35:40.290]  So, some people do that.
[35:40.670 --> 35:42.330]  There's a lot of ways people make money.
[35:42.570 --> 35:49.330]  Some games, you'll develop a bot, and then you'll have a team of friends, whatever, that just run this bot themselves.
[35:49.550 --> 35:52.610]  You don't sell the bot, but you have friends that run this on hundreds of accounts.
[35:52.610 --> 35:57.750]  Then you have hundreds of millions of gold, and you sell the gold, and that's how you make your money.
[35:58.510 --> 36:03.590]  Now, the game company can't really prove that you used gold getting a bot, so they can't really sue you.
[36:03.750 --> 36:08.350]  And selling gold is illegal in the eyes of the game company, but in the eyes of the law, it's not.
[36:08.350 --> 36:14.630]  There's nothing that they can say is intellectual property theft with selling gold, where they can with developing a bot.
[36:14.870 --> 36:16.310]  So, that's one way people do it.
[36:16.710 --> 36:21.830]  Some people do sell bots, like you said, move it offshore, sell it on tour, and use bitcoins.
[36:21.830 --> 36:24.710]  I've never seen anyone do that, but I'm sure someone's tried it.
[36:25.130 --> 36:32.630]  I'm not sure if it's easy then, because a lot of the audience buying bots is going to be a 13-year-old kid who just wants to play this game.
[36:32.750 --> 36:42.710]  And this 13-year-old kid doesn't want to fire up tour, figure out how to buy bitcoins, get his mom's approval to use the credit card to buy bitcoins, and then buy a bot for this game.
[36:42.730 --> 36:45.230]  It's too much trouble, so that might be an issue.
[36:45.230 --> 36:53.890]  But, like an example, like I said, with gold selling is the best way to do what you said, because gold in the game is almost like bitcoins, right?
[36:54.510 --> 37:04.310]  So, an example of that is there's one guy who uses my bot, and he has about six dedicated servers running something like 1,200 characters at a time.
[37:04.650 --> 37:08.230]  Now, across 70 servers, 1,200 characters is a lot.
[37:08.350 --> 37:11.010]  It's a little less than 20 characters on every server running.
[37:11.010 --> 37:17.510]  He just collects immense amount of gold, and he makes more money selling that gold than I make selling the bot to him and everyone else.
[37:17.770 --> 37:20.450]  So, that's probably the main way to do what you say there.
[37:20.890 --> 37:21.510]  Thank you.
[37:22.550 --> 37:23.050]  Thank you.
[37:23.530 --> 37:24.590]  I've got two questions.
[37:24.750 --> 37:26.770]  The first one is kind of based on what he said.
[37:26.970 --> 37:31.710]  How prevalent is console hacking, and what's the vector to it?
[37:31.770 --> 37:33.030]  How do they...?
[37:33.030 --> 37:36.850]  So, like he just said, super prevalent.
[37:37.090 --> 37:38.230]  I've seen it a lot.
[37:38.950 --> 37:41.390]  Is it more hardware-side or software-side?
[37:41.690 --> 37:44.590]  I think it's really hardware-sided from what I've seen.
[37:44.770 --> 37:44.830]  Okay.
[37:44.830 --> 37:53.690]  Like the Xbox, it had a JTAG header on it, and then they could pull down the serial information and communicate with the debug interface, and somehow from there they got stuff onto it.
[37:54.130 --> 38:01.810]  Then there's like, you can get the hard drive from the Xbox, and you can find the files that store the information about games.
[38:01.810 --> 38:09.050]  And there was a thing, this is the one console hacking thing I did do, is like the save file for Call of Duty Modern Warfare 2.
[38:10.250 --> 38:10.690]  Sorry.
[38:11.070 --> 38:17.910]  The name that you had in-game, which was supposed to be your gamertag, was also stored in their save file for some reason.
[38:18.150 --> 38:24.410]  So you could modify that, and you could change the color of it and stuff by just modifying it with a hex editor in place.
[38:24.410 --> 38:31.070]  And then you could put it back on your hard drive, load it in the Xbox, and now you have whatever name you want with whatever fancy characters and colors you want.
[38:31.610 --> 38:35.530]  So I think there's a lot of different venues to it, but I mean, I've seen it everywhere.
[38:35.730 --> 38:42.350]  I mean, there's not a game on, not a first-person shooter on the console that doesn't have god-mode servers you can log on if you have a JTAG Xbox.
[38:42.990 --> 38:44.110]  One other quick question.
[38:44.250 --> 38:46.810]  I hear guys talking about they read the source code.
[38:46.970 --> 38:48.570]  Where do they get the source code from for games?
[38:51.790 --> 38:52.790]  So it depends.
[38:53.290 --> 38:55.950]  Like, I think... I can't remember the game.
[38:56.030 --> 38:58.250]  I think it might have been Daisy that just had a huge leak.
[38:58.370 --> 38:59.770]  All their source code was leaked.
[39:00.030 --> 39:00.550]  Oh, okay.
[39:01.830 --> 39:12.050]  Some other people may... I've seen people go as far as pulling it out in IDA and decompiling it and then fixing out variable names their self and making it compilable code.
[39:12.470 --> 39:17.970]  Some games that are written in stuff like Flash, you can decompile the Flash to your compilable code already.
[39:18.430 --> 39:26.810]  So there's been instances of people decompiling a game that's in Flash, basically, writing the scripts to make the changes to the code that they need to recompile it.
[39:27.090 --> 39:36.530]  And then just every time the game updates, they just decompile it, put it as a branch in a repository, do a merge with their bot, recompile the Flash, and then redirect it.
[39:36.610 --> 39:40.690]  Now you have a full bot based on their code base with no reverse engineering magic anywhere.
[39:41.430 --> 39:42.210]  All right, thanks.
[39:42.450 --> 39:42.750]  Thanks.
[39:45.810 --> 39:58.470]  When can you call something a bot, let's say, I have a plugin for World of Warcraft, which helps me, let's say, play better, right?
[39:58.470 --> 40:09.290]  And it uses the API, which other people use to build plugins, and technically it's legal.
[40:09.630 --> 40:13.350]  I never really used it, but let's say I'm just better because of it.
[40:13.350 --> 40:17.070]  Or two examples.
[40:18.950 --> 40:26.250]  Once I modified my mouse to... I combined it with a blinking circuit.
[40:26.450 --> 40:37.050]  So it turned into an auto-clicking mouse, and all semi-automatic weapons in games, they became automatic.
[40:38.450 --> 40:51.290]  Nobody noticed, but in one game, I just put a little dot on my screen in the middle to shoot guns with no crosshairs, and I got banned pretty fast.
[40:51.510 --> 40:56.830]  Who decides what is a hack, what is a bot, and what is not?
[40:57.230 --> 41:00.450]  Okay, so I have two minutes, so I'm going to answer this really quick and then take the guy behind you.
[41:00.450 --> 41:09.810]  But in that instance, where you said it was turning semi-automatic weapons into automatic, it was probably heuristics, like one guy asked about earlier.
[41:10.050 --> 41:16.630]  Where the server saw, at a set interval, you were hitting this button every single time, and you were getting kill shots every single time.
[41:16.810 --> 41:20.550]  Some heuristic probably said, he's using some bot and bans you now.
[41:20.770 --> 41:24.910]  As to who says it's a bot, it's... I mean, it's dependent on the game company.
[41:24.910 --> 41:29.150]  They decide what they call a cheat, and their detection is really the be-all, end-all.
[41:29.390 --> 41:37.650]  So, there have been lots of instances of people not using bots and getting detected, not due to bugs, but just playing really well, or really consistently.
[41:37.990 --> 41:39.590]  So, it's really dependent on the game.
[41:40.770 --> 41:41.330]  I see.
[41:41.490 --> 41:41.770]  Thank you.
[41:42.050 --> 41:42.250]  Thanks.
[41:44.250 --> 41:49.530]  Just about... someone else asked about how to get rid, or what to do against bots.
[41:49.530 --> 42:08.050]  One thing I know Blizzard does is, if it detects a new bot, is not ban it, but wait until the guy finishes it, and starts selling it, and then ban the other people who bought it, to get the reputation of that guy down, so nobody buys it anymore from him.
[42:08.210 --> 42:09.350]  So, it stops developing.
[42:11.070 --> 42:13.050]  I find it an interesting idea.
[42:13.750 --> 42:15.710]  Yeah, I would say that's interesting, too.
[42:15.830 --> 42:19.990]  It's kind of a dirty way of doing it, but when people are messing up your game, I guess, playing dirty is allowed.
[42:21.970 --> 42:25.090]  Okay, well, I am out of time, so thank you guys.
[42:25.270 --> 42:26.490]  Thanks for the wonderful questions.