Bots... XenoBot? iBot?

[Luls]

It could do with a few changes, like a simple "tool" to automount

If I had the most recent version of Tibia downloaded I'd get a screenshot... Automount is seriously the easiest function to use with Xeno.

Also, wtf. You're always on skype, why not now?

[Necktra]

I checked the iBot forum a day ago and saw a function that many did want, don't remember really what it was about. But in that thread, they had problem. They did discuss how to add the function without misclick and take skull/yellow. Since Xenobot does'nt simulate keyboard and mouse, it can't really do wrong, misclicking and stuff like that. And since it's not clientside detection, there is really no reason to have a bot that simulate mouse and keyboard - it only makes things harder and easier to fuck up.

I don't know if it's possible in iBot, but in Xenobot, you can actually inject the bot when watching Tibiacast. If you got a friend who are in a pvp situation and can't start his bot/mwall timer, or simply he don't use bot, you can help him with it by telling him if you're watching his cast. You can even making script in Tibiacast using Xenobot, which might help alot for people who want to make a high level script but don't have a high leveled char, or for people that want a personally script but don't know how to a script themself.

[Pirate]

I'm not gonna say iBot has a keylogger hidden within the code...
... but I'm not gonna say it doesn't either.

it does have keyloggers

[Apoc]

it does have keyloggers

Thats a risk, we all share ... :/

[DarkstaR]

It seems that the big problem with scripting is just naming conventions. I like verbosity and separation of functions where, apparently, users like cluster fucks. I can easily make all item functions accept both names and id's, so I may work that in very soon.

[Beo]

A problem Xenobot has, is payment options. People like to pay via phone etc, and even that does not support all countries.

I prefer paypal option, myself.

[XtrmJosh]

it does have keyloggers

If you knew absolutely anything about bots, you'd know that a keylogger would be the most unnecessary thing in any bot.

You can actually do this right now, download and run cheatEngine, and attach to the tibia client, then search for a "string", and type in your password. It will come up in plaintext, do the same for your account name, oop, again, it's stored in your memory in plaintext. It can be read the exact same way that your health, mana, etc can be read.

The only reason people assume iBot contains a keylogger is because it uses a keyboard hook to check for user input and it delays / modifies certain functions to work around it, as a result of that I think one or two anti virus programs pick up on the fact that it is recording keystrokes.

[XtrmJosh]

If I had the most recent version of Tibia downloaded I'd get a screenshot... Automount is seriously the easiest function to use with Xeno.

Also, wtf. You're always on skype, why not now?

Been at work all day, I'm probably overlooking it somewhere, and if it's a function I don't really need a demonstration anyways

[DarkstaR]

It can be read the exact same way that your health, mana, etc can be read.

Wrong.

For health and mana, you read a static address and then XOR it with a value read from another static address - this is due to the encryption they added earlier this year.

For password and account number, you have to read a value (v1) from a static address (pointer to std::string pointer), read a value (v2) from v1 plus an offset (pointer to std::string buffer size), read a value (v3) from v1 plus another offset (pointer to std::string buffer). Now logic comes into play:

If v2 is less than or equal to 15, then v3 is our password/account name. If v2 is greater than 15, then we have to read another value (v4) from the address in the first four bytes of v3. Now v4 is our password/accountname.

[XtrmJosh]

Wrong.

For health and mana, you read a static address and then XOR it with a value read from another static address - this is due to the encryption they added earlier this year.

For password and account number, you have to read a value (v1) from a static address (pointer to std::string pointer), read a value (v2) from v1 plus an offset (pointer to std::string buffer size), read a value (v3) from v1 plus another offset (pointer to std::string buffer). Now logic comes into play:

If v2 is less than or equal to 15, then v3 is our password/account name. If v2 is greater than 15, then we have to read another value (v4) from the address in the first four bytes of v3. Now v4 is our password/accountname.

Ok, drop the word exactly. If the account name or password is longer than 15 characters, it becomes a pointer and random memory is assigned with the pointer stored at the original location.

I guess what I'm trying to say, really, is that to get someones account info does not require any black magic, and if any player doesn't have UAC disabled, they won't have noticed that the majority of bots all have some form of keyboard hook (which may show up as a virus depending on AV software), and that most bots communicate with the web to check for updates & news etc, failing that just to do a check on the login information they use for their bots license time.

It would be incredibly easy for any bot developer to take control of all their users accounts, but all in all, it would also be wasteful considering that all the money they would make from the accounts & items would be virtually worthless compared to the real money they will make (which is already real money, so won't need trading) from selling the bot in the first place.

On top of that, if the developer were to try rebrand I'm sure people would catch on, so the same trick can't realistically be done twice, either...