1497 Tibia accounts have been detected...

Quote:

---

1497 Tibia accounts have been detected using unofficial software to play during the last couple of weeks. These accounts have been deleted today.

---

2 day ago I said in shoutbox that I predicted it would happen within 2 days. Looks like I was right. I'm working on a theory, so bare with me :P

Who got hit?

172 RP - Fine
29 K (Main testing account) - Fine
70 ED / 94 RP - Fine
101 EK - Fine

I use it on all of these accounts, I'll assume my others are fine since I don't use it on them.


For those who got banned:

1. Did you ever try to walk while the cavebot was trying to walker, causing weird "step wars" between you and the bot? If so, how often?
2. Were you injected during any of the "mini-patches"?
3. How many clients did you run at once?
4. What scripts did you use?
5. In healing, did you make sure to have the range set in your configurations for randomization, or was it always instant?
6. Did you ever use any of the combo options on these accounts?
7. Did you ever mention botting in-game?
8. Did you keep distance from creatures or follow them?
9. What's your timezone and average playing times

Based on what I've seen, we have about 4 valid looking reports. While that can be very bad, it has to be compared to the number of users. We have roughly 200 unique users per day and roughly 400 unique users per 3 days. With the numbers given now, the math still boils down to 99% undetectable. Also, it seems that the bans arent distributed widely amongst users, but amongst a small group of user's accounts. What I mean by this is that maybe only 1/100 people get banned, but that one person gets banned on 3 accounts. The reasons for this could be as follows:

1. Timing - Could just be because the user's timezone was the most vulnerable to the detections.
2. Usage - Could have to do with the players usage style. For instance, auto healing with exact intervals for hours on end is very easy to detect.
3. Luck - You could simple be one very unlucky person.
4. Scripts - One script might have a combination of actions which, when used together, can cause weird, detectable behaviour. It is common that multiple inputs produce unpredictable actions in systems such as these.

I'm going to be studying the recent bans to find a "common denominator," so to speak. The more I know the safer we can all be.

Updated my first post.

Could you tell us what your theory so far is? :D

btw look what ive found
http://www.tibia.com/news/?subtopic=...flist=10100010

before u started selling 4lifes licence at neobot forum been a guy who found 15~~ lines detectable in ur bot however neo had only 1... what u gonna tell about that?

That was me making a post saying that I used one line of code to detect NeoBot and it took 15 lines to detect XenoBot (and that isn't possible since my last update). Learn to read.

"What u gonna tell about that"

Bot account #1 - UNHARMED
Bot Account #2 - UNHARMED

I used both frag helper, healer, and cave botting on both accounts =)
I did obey DarkStars tips to stay safe however I did ignore some with complete disregard, such as not botting in the same location for too long.

http://i206.photobucket.com/albums/b...rewX07/ban.png

Did you ever try to walk while the cavebot was trying to walker, causing weird "step wars" between you and the bot? If so, how often? Never
Were you injected during any of the "mini-patches"? No
How many clients did you run at once? 1
What scripts did you use? http://forums.xenobot.net/showthread...laze-%E2%82%B0 The Edron Trolls script and Darashia rots script for mages.
In healing, did you make sure to have the range set in your configurations for randomization, or was it always instant? Made sure it was set for randomization.
Did you ever use any of the combo options on these accounts? No
Did you ever mention botting in-game? No
Did you keep distance from creatures or follow them? Follow.
What's your timezone and average playing times - Eastern Timezone, 4 PM to 8PM.

I never botted for more than an hour at a time.

Edit: This is the edron trolls script - http://forums.xenobot.net/showthread...lls-Very-Basic

I'd also like to say that I just purchased the bot yesterday, so I've only used it for a total of 2 hours, MAYBE.

I seen implement dash in xeno , as i remember elf + magebot been detectable because of this functions ofc when enable...

btw. it's so hardly steal whole source from neo?xD

1. Did you ever try to walk while the cavebot was trying to walker, causing weird "step wars" between you and the bot? If so, how often? Yes, Not often After a few seconds(30?) of not winning id turn off the walker to grab an item from the floor or reach a ladder or something, If I had to guess an amount of times no more then 10 times per char
2. Were you injected during any of the "mini-patches"? Not today but the last few days yes. So it was after at least one mini patch.
3. How many clients did you run at once?2-4 normally occasionally 3 or 4 if i had to move money or logged on my main
4. What scripts did you use? Ill attach every script i used on the banished chaarcters, looting and healing was changed at least once while using these scripts
5. In healing, did you make sure to have the range set in your configurations for randomization, or was it always instant? It was a range,youll see in the files. It could of been bigger but Iv done worse with neo in the past.
6. Did you ever use any of the combo options on these accounts?What options? I dont think so
7. Did you ever mention botting in-game?Never
8. Did you keep distance from creatures or follow them?follow/reach
9. What's your timezone and average playing timesEST

I noticed the chars would be trapped by chairs, parcels, tables occasionally. cumulatively Id say each character was trapped trying to make click for a total of 1hour.


I cant attach files in this thread?
http://forums.xenobot.net/showthread...ll=1#post10474 - scripts i used on the chars that got banished
http://forums.xenobot.net/showthread...0482#post10482 - online times

I did change and add somethings to this script during the time I was botting those chars. for example 2 days~ ago did I added the cleanup() function. Used this script maybe 4days~ I used it on other chars who are fine.
http://forums.xenobot.net/showthread...0563#post10563

Quote:

---

Originally Posted by Andrewx

I'd also like to say that I just purchased the bot yesterday, so I've only used it for a total of 2 hours, MAYBE.

---

(not flaming)

Just my opinion but if you purchased the bot yesterday i highly doubt that was the cause of your deletion. Are there any other programs youve been using?

Quote:

---

Originally Posted by DarkstaR

That was me making a post saying that I used one line of code to detect NeoBot and it took 15 lines to detect XenoBot (and that isn't possible since my last update). Learn to read.

"What u gonna tell about that"

---

L.M.F.A.O!!! OWNED!

Account 1: 118 knight - SAFE
Account 2: 116 knight - SAFE
Account 3: 112 knight - SAFE
Account 4: 124 knight - SAFE
Account 5: 48 knight - SAFE

135~~ ek SAFE, i use cavebot, healing and lighthack, one tibia, without mc and i never log to tibia with bot when mini patch (before login to game, i always check minipatch without bot injected) now im scary. What u think guys, still boting or stop?

Account 1, Only healing; SAFE
Account 2, Healing and creating walkers; SAFE
Account 3, Botting; SAFE
Account 4, Botting; SAFE

Quote:

---

Originally Posted by Andrewx

http://i206.photobucket.com/albums/b...rewX07/ban.png

Did you ever try to walk while the cavebot was trying to walker, causing weird "step wars" between you and the bot? If so, how often? Never
Were you injected during any of the "mini-patches"? No
How many clients did you run at once? 1
What scripts did you use? http://forums.xenobot.net/showthread...laze-%E2%82%B0 The Edron Trolls script and Darashia rots script for mages.
In healing, did you make sure to have the range set in your configurations for randomization, or was it always instant? Made sure it was set for randomization.
Did you ever use any of the combo options on these accounts? No
Did you ever mention botting in-game? No
Did you keep distance from creatures or follow them? Follow.
What's your timezone and average playing times - Eastern Timezone, 4 PM to 8PM.

I never botted for more than an hour at a time.

Edit: This is the edron trolls script - http://forums.xenobot.net/showthread...lls-Very-Basic

I'd also like to say that I just purchased the bot yesterday, so I've only used it for a total of 2 hours, MAYBE.

---

And you didnt use any other bot on your acc before xeno?

Quote:

---

Originally Posted by mateolse

135~~ ek SAFE, i use cavebot, healing and lighthack, one tibia, without mc and i never log to tibia with bot when mini patch (before login to game, i always check minipatch without bot injected) now im scary. What u think guys, still boting or stop?

---

U mad? From Xenobot users there are only 2 ppl banned ( one trusted as I have read ). I bet on this wave was banned 50% of Redbot users, 50% of TibiaAuto users. lulz

So u are wrong danonix, only 1 person has admited that he was banned, without any screens, info on Redbot forum. There I can see many screens and trusted ppl, as 280 ms banned (maybe by neo). In my guild we have 5 players and 40+ chars. All were botted. The best botted lvl is 430+, avg botting lvl is 156. We were trying redbot since end of neo. Only one acc was banned. One where we didnt use anything since neobot end, contains 160+ ek and 130 ek. So I guess many of them got banned by last neobot. I dont want to blame xenobot and darkstar, but now its time to change all of ur source code, coz u know ur theory about injection and clientmods isnt right. Just open your eyes , open your mind. Proud like a god, dont pretend to be blind.

gona stop using it on my main and only on my bot acc, till i know its more safe, dont know if hud should matter ?

liked the hud for my main (xp/h on screen) and auto healing just incase a big sudden dmg,

Safe!

1. Yes. Hard to tell how often :p
2. Yes
3. 2 - 4
4. Attached the scripts to my post. Botted dwarves most.
5. There was a default range of 9%
6. Don't know what they are so I probably didn't.
7. Nope
8. Followed them
9. Last month - 95 hours. Last week - 14 hours. UTC +1

Why can't we post attachments on this board?
My scripts are here http://forums.xenobot.net/showthread...ll=1#post10501

By the way, have you seen blackd's theory on updated tibia.dat files?

Quote:

---

Originally Posted by HolmaN

And you didnt use any other bot on your acc before xeno?

---

No, the account that was banned was made on January 12th, I hadn't played Tibia in over a year before this.

I manually went through rook, and started looking into botting around the time I got to level 8. Xenobot is the only bot that had been used on this account. I looked around quite a bit before trying any bots because I didn't want to use a bad one.

I'm not bashing xenobot, obviously it picked my account up, but clearly it was one of the few. I'm just posting so you all can know what it is I had used and done before I was banned.

Okay, so the theory is that these minipatches are actually bot scans. While there is no visible detection code in the client, it is very possible that, when "downloading a new .dat file," they can be sending bytecode which is then codecaved into running a quick detection sweep. The first one I saw, 2 days ago, is when I made the prediction. seems pretty accurate. Also, The dat file size seemed to stay the same, only its checksum changed.

I'm not 100% sure on this but I've kept the old installer, so I will be reinstalling raw 9.44 and stepping through code as the update occurs so I can see exactly what's going on. My bet is, if this is what they're doing, its also how Neo users have been banned. Luckily, though, thanks to my recent update, this will be much harder to do. Detecting XenoBot.dll inside of Tibia will take nothing short of a rootkit, which XenoBot already has (the word malicious is used loosely on Wikipedia to decribe rootkits, but they also give this detail "[useful for] Conceal cheating in online games from software like Warden." Don't go around thinking I'm calling XenoBot a virus, lol)


If there is a type of stealth client-sided detection associated with these updates, I will have it reversed, analysed, trumped, and counter-acted within the week.

Quote:

---

Originally Posted by DPK

(not flaming)

Just my opinion but if you purchased the bot yesterday i highly doubt that was the cause of your deletion. Are there any other programs youve been using?

---

A guy made a new acc before 3 days , used tibia auto and got detected.
They changed something..

Quote:

---

Originally Posted by DarkstaR

Okay, so the theory is that these minipatches are actually bot scans. While there is no visible detection code in the client, it is very possible that, when "downloading a new .dat file," they can be sending bytecode which is then codecaved into running a quick detection sweep. The first one I saw, 2 days ago, is when I made the prediction. seems pretty accurate. Also, The dat file size seemed to stay the same, only its checksum changed.

I'm not 100% sure on this but I've kept the old installer, so I will be reinstalling raw 9.44 and stepping through code as the update occurs so I can see exactly what's going on. My bet is, if this is what they're doing, its also how Neo users have been banned. Luckily, though, thanks to my recent update, this will be much harder to do. Detecting XenoBot.dll inside of Tibia will take nothing short of a rootkit, which XenoBot already has (the word malicious is used loosely on Wikipedia to decribe rootkits, but they also give this detail "[useful for] Conceal cheating in online games from software like Warden." Don't go around thinking I'm calling XenoBot a virus, lol)


If there is a type of stealth client-sided detection associated with these updates, I will have it reversed, analysed, trumped, and counter-acted within the week.

---

That is highly likely, if I recall correctly, I was injected during a mini patch.

Well I've been botting to 14h stamina, back to 25~ and down to 14 during the nights. And I'm safe.
Been in the same spawns, had the same setup while healing etc, and with no gold pick up.

My RL got deleted on 4 accs, only using neobot.

So XenoBot is 100% safe?

Quote:

---

Originally Posted by dawbur93

So XenoBot is 100% safe?

---

Read the whole thread befor you post.

We cannot say that something is trustable 100%. Becouse Tibia gives best to find out bots and Xenobot tries to make best to be undetectable. I think that Tibia has more better way to catch bots cuz we get know later when they do something.

Quote:

---

Originally Posted by Andrewx

http://i206.photobucket.com/albums/b...rewX07/ban.png

Did you ever try to walk while the cavebot was trying to walker, causing weird "step wars" between you and the bot? If so, how often? Never
Were you injected during any of the "mini-patches"? No
How many clients did you run at once? 1
What scripts did you use? http://forums.xenobot.net/showthread...laze-%E2%82%B0 The Edron Trolls script and Darashia rots script for mages.
In healing, did you make sure to have the range set in your configurations for randomization, or was it always instant? Made sure it was set for randomization.
Did you ever use any of the combo options on these accounts? No
Did you ever mention botting in-game? No
Did you keep distance from creatures or follow them? Follow.
What's your timezone and average playing times - Eastern Timezone, 4 PM to 8PM.

I never botted for more than an hour at a time.

Edit: This is the edron trolls script - http://forums.xenobot.net/showthread...lls-Very-Basic

I'd also like to say that I just purchased the bot yesterday, so I've only used it for a total of 2 hours, MAYBE.

---

It's not Xenobot's fault. (Maybe someone already said it but haven't looked through the whole thread..

Quote:

---

Originally Posted by Xeno Scripts

It's not Xenobot's fault. (Maybe someone already said it but haven't looked through the whole thread..

---

Maybe you should read it then, the only bot used on that account was xenobot. I'm not claiming the bot is easily detectable. I posted my ban so the developers could try and figure out how it was detected.

Xenobot is the only bot even installed on my computer.

Quote:

---

Originally Posted by DarkstaR

Okay, so the theory is that these minipatches are actually bot scans. While there is no visible detection code in the client, it is very possible that, when "downloading a new .dat file," they can be sending bytecode which is then codecaved into running a quick detection sweep. The first one I saw, 2 days ago, is when I made the prediction. seems pretty accurate. Also, The dat file size seemed to stay the same, only its checksum changed.

I'm not 100% sure on this but I've kept the old installer, so I will be reinstalling raw 9.44 and stepping through code as the update occurs so I can see exactly what's going on. My bet is, if this is what they're doing, its also how Neo users have been banned. Luckily, though, thanks to my recent update, this will be much harder to do. Detecting XenoBot.dll inside of Tibia will take nothing short of a rootkit, which XenoBot already has (the word malicious is used loosely on Wikipedia to decribe rootkits, but they also give this detail "[useful for] Conceal cheating in online games from software like Warden." Don't go around thinking I'm calling XenoBot a virus, lol)


If there is a type of stealth client-sided detection associated with these updates, I will have it reversed, analysed, trumped, and counter-acted within the week.

---

Hm..intresting. Does that means if I avoid the bot scan, for example by start the bot after login, that it would be more safer? Aswell there should'nt be any risk for having bot installed on the computer?

Guys, as I said earlier, my acc is safe, but I think i have useful information - my XenoBot was injected during mini-patch 2 times and as i said my acc is safe.Weird.

Quote:

---

Originally Posted by Necktra

Hm..intresting. Does that means if I avoid the bot scan, for example by start the bot after login, that it would be more safer? Aswell there should'nt be any risk for having bot installed on the computer?

---

Having it on your computer won't be a problem, they can't legally scan your computer itself, only the tibia files.

Even if they can scan your computer, a fair player could play on a cheating friends system. Inconclusive.

Quote:

---

Originally Posted by DarkstaR

Okay, so the theory is that these minipatches are actually bot scans. While there is no visible detection code in the client, it is very possible that, when "downloading a new .dat file," they can be sending bytecode which is then codecaved into running a quick detection sweep.

---

I believe I have heard of this as well.

Quote:

---

Originally Posted by DarkstaR

If there is a type of stealth client-sided detection associated with these updates, I will have it reversed, analysed, trumped, and counter-acted within the week.

---

Hopefully you are able to succeed in doing so. Good luck, Dark.

Its only eyewashing by darkstar. Thats problem with xenobot and his injections like icons in elfbot was.

All of Elfbot was injected, not just Icons. I honestly would put up money betting you have absolutely no clue what "injected code" entails or how common it is.

Ye I dont know how tibia detect system works, but I know much about programming, even you will win money, and also I will bet on that u dont know also whats going on with this system, like we can see after massbans.

edit: Expensive is not always better than free tool ;)

Quote:

---

Originally Posted by anczej

Ye I dont know how tibia detect system works, but I know much about programming, even you will win money, and also I will bet on that u dont know also whats going on with this system, like we can see after massbans.

edit: Expensive is not always better than free tool ;)

---

And I bet that you don't even belong here, and I also bet that you don't even use Xenobot.

All I can say is gtfo