|
About 6 months ago I found another method for catching hackers. I did not release the method, but the topic is here
Basically this method will catch oblivion users even after the update which made the previous "no suspicious click" method I found not work.
Oblivion lets you attempt to place buildings where normally you cannot. If you attempt to do this without hacks the GUI stops you and the action is not recorded in the replay. But with oblivion the action is recorded even though the game engine stops it from actually being built. The reason for this behavior is probably due to this feature of oblivion, quoted from the readme: Build anywhere on any terrain for stacking UMS maps.
An automated tool could probably be constructed to search for these invalid build commands, but it is not that hard to do manually using bwchart. Bwchart actually tries to determine if a build command goes through for its resource plots. If it doesn't think that it did, it puts an asterisk near the command. You just need to check each asterisked build command to see if it was actually possible to attempt to build that building at that time and location (use the coordinates).
The most common invalid builds are attempting to build a building where there is already a building or building an extractor 1 square off of the actual geyser. In replays I watched of people I already knew to be using oblivion about 30% of the time they would have at least 1 invalid build command. This means that not that many replays of a suspected hacker need to be checked. Also it is impossible to have the invalid commands without a hack, so if you find just one replay with such an action it is 100% proof of hack.
I have not caught any big names with this method, but I haven't looked either (I do not follow the SC scene much anymore). This is trivial for the oblivion hack maker to fix so don't expect it to be useful for future replays but I would expect it to catch people from the last 6 months+. I'm sure there will be more methods found in the future, so don't worry hackers you are never safe.
Edit: see page 3 of comments for example.
|
|
|
flag, you're a fucking legend.
|
I was gonna bump this tomorrow, nice work flag!
|
|
|
|
|
lol flag and his haxor catching.
|
flag should get a bloodhound icon.
|
Nice. Got a sample hacker rep?
|
im refreshing my bwchart right now, hope this shit works lol
|
im looking at a replay of oblivion user and i cant figure out where that asterisk should be. Theres a thingie like * near selecting hatch action, but that is me. So where exactly do we look and can u provide a screenshot or something?
edit: i really am killing time here, but anyways - replay had many actions by me with * near them. Most are making drones at a hatchery, this has nothing to do with placing buildings. Then more, i had them while placing a hatchery, 3 in a row, meaning that i couldnt place it 3 times in a row. Now u stated that it wouldn't record those actions unless im using oblivion, how the hell do i get those actions then? I am clearly not a hacker and i can provide replay where guy starts at 5 frame on regular bnet game and uses multicommand/automacro. Unless i missed something this method doesnt work at all, since i havent found a single asterisk near his build orders, unless i missed it. If it does work, it will create insane amount of speculations since this isnt easy to figure out as far as im concerned. Hope u will explain the method, i will be waiting yo.
edit: ok theres actions that are marked as * performed by him, now i have 10 times more of those, if he cant place a factory somewhere and it is showing up then how is this different from me not being able to place a sunken colony or a hatchery since its all recorded as well?
On December 31 2008 12:10 flag wrote:
Also it is impossible to have the invalid commands without a hack, so if you find just one replay with such an action it is 100% proof of hack.
so far this seems totally untrue, maybe you mean something else by saying this or programs like chaoslauncher or advloader affecting this. Unless IM MISTAKEN and those * near me placing hatchery is not "invalid command" but something else. Which seems unlikely.
I would suggest everyone just wait to make sure this really is working yo
|
|
|
God you are such a genius
|
I think you need to check each individual build command with a * to see if it's on minerals/gas/unbuildable terrain. Most *'s will be false positives.
|
somebody give this guy a star
|
flag, you are a hero. Perhaps you should have waited until TSL2 to release it though  If it holds any weight, I'd like to nominate this guy for a forum star, or a custom icon.
|
On December 31 2008 12:47 food wrote:im looking at a replay of oblivion user and i cant figure out where that asterisk should be. Theres a thingie like * near selecting hatch action, but that is me. So where exactly do we look and can u provide a screenshot or something? edit: i really am killing time here, but anyways - replay had many actions by me with * near them. Most are making drones at a hatchery, this has nothing to do with placing buildings. Then more, i had them while placing a hatchery, 3 in a row, meaning that i couldnt place it 3 times in a row. Now u stated that it wouldn't record those actions unless im using oblivion, how the hell do i get those actions then? I am clearly not a hacker and i can provide replay where guy starts at 5 frame on regular bnet game and uses multicommand/automacro. Unless i missed something this method doesnt work at all, since i havent found a single asterisk near his build orders, unless i missed it. If it does work, it will create insane amount of speculations since this isnt easy to figure out as far as im concerned. Hope u will explain the method, i will be waiting yo. edit: ok theres actions that are marked as * performed by him, now i have 10 times more of those, if he cant place a factory somewhere and it is showing up then how is this different from me not being able to place a sunken colony or a hatchery since its all recorded as well? Show nested quote +On December 31 2008 12:10 flag wrote:
Also it is impossible to have the invalid commands without a hack, so if you find just one replay with such an action it is 100% proof of hack.
so far this seems totally untrue, maybe you mean something else by saying this or programs like chaoslauncher or advloader affecting this. Unless IM MISTAKEN and those * near me placing hatchery is not "invalid command" but something else. Which seems unlikely. I would suggest everyone just wait to make sure this really is working yo
Okay firstly you're not understanding how to look for these correctly.
In bwchart turn off all actions except build. This will eliminate problems with seeing stars next to things like making drones. The only starred actions we're looking for are ones where someone goes to build a building.
Then yes there are lots of actions with stars next to them. If you ACTUALLY READ HIS POST, then you'd see you need to then check the map coordinates with that action to see if it was just impossible to be placed due to a unit being there or another building being in the way, or if it is actually a place on the map in which you can not place buildings.
If there are any starred build actions in a location on the map that cannot have buildings built, it is a hack action.
|
On December 31 2008 12:47 food wrote:
im looking at a replay of oblivion user
Can you post the rep? I'm having trouble finding one.
|
On December 31 2008 13:08 SonuvBob wrote:
I think you need to check each individual build command with a * to see if it's on minerals/gas/unbuildable terrain. Most *'s will be false positives.
he says that if you not hacking you wont get those actions recorded, so when i was placing my hatchery at an unbuildable terrain( which happens a lot) it did get recorded. Check any known zerg replays, im sure everyone has this. In his opinion tho, this only gets recorded if youre hacking, which seems untrue so far, thats my point.
edit:
https://www.yousendit.com/download/TTZreUNEb0JwTVdGa1E9PQ
rugu_rena is a known hacker from East, plays play/obs pub games
u have to use 1.15.3 i would think
|
I tested w/placing a depot on minerals, it didn't show up in the rep.
|
On December 31 2008 13:15 food wrote:Show nested quote +On December 31 2008 13:08 SonuvBob wrote:
I think you need to check each individual build command with a * to see if it's on minerals/gas/unbuildable terrain. Most *'s will be false positives. he says that if you not hacking you wont get those actions recorded, so when i was placing my hatchery at an unbuildable terrain( which happens a lot) it did get recorded. Check any known zerg replays, im sure everyone has this. In his opinion tho, this only gets recorded if youre hacking, which seems untrue so far, thats my point. edit: ok sec ill link the replay in a sec
I just tested this and it didn't show the actions in the replay... -_-
|
Me too, tried building a hatchery in the middle of luna, on minerals, on top of an enemy hatch, etc, not a single build command in the rep.
|
well look up the replay i posted and tell me what my actions marked as * are then
action 3995
4005
4560 - for extractor
he has many too, supply, bunker etc, but check mine
|
They're whatever bwchart marks with a *, dunno how it determines them. The point is that trying to build on minerals/unbuildable terrain only shows up with Oblivion, so if you can find one of those (which would be among the *s), it means hack.
Seems like finding them without an automated tool would be really hard.
|
see the action that i just listed, i believe i was building a hatch/extractor, nothing else.
|
On December 31 2008 13:23 food wrote:
well look up the replay i posted and tell me what my actions marked as * are then
I just checked a number of them on python and none of the ones I checked so far are on unbuildable terrain, therefore they are not hack detections, you must have had a unit in the way or something.
It's only a detection of a hack when it was on unbuildable terrain.
|
On December 31 2008 13:28 food wrote:
see the action that i just listed, i believe i was building a hatch/extractor, nothing else.
As I said, the hatch one (one of the ones I checked) was not on unbuildable terrain so there is no hack there, and the one with the extractor doesn't have a star...
|
oh shit, maybe it does work then^^
|
On December 31 2008 13:30 food wrote:
oh shit, maybe it does work then^^
|
Ah, *s normally come from sending multiple build commands when you have the money, where only the last one, if any, actually results in a building (select an scv and spam bsclickbsclickbsclickbsclickbsclick)
|
On December 31 2008 13:32 SonuvBob wrote:
Ah, *s normally come from sending multiple build commands when you have the money, where only the last one, if any, actually results in a building (select an scv and spam bsclickbsclickbsclickbsclickbsclick)
Aha, cool to know. I wonder what the occasional ?'s come from (they're in the same column as the *'s). Who actually made bwchart? It'd be nice to be able to ask the creator questions about things in it that were never documented 
|
|
|
why the fuck would you want to build something on terrain you haven't seen yet? that's just plain retarded...
|
On December 31 2008 13:50 Xeris wrote:
why the fuck would you want to build something on terrain you haven't seen yet? that's just plain retarded...
I don't think it's whether you can see it or not, this is whether it's unbuildable terrain or not, like if you try to build a building and you misclick and hit a cliff or ramp, or if you go to build your assimilator and you miss the gas geyser, or if you go to build something like a cannon and you hit the minerals instead of hitting the ground.
|
On December 31 2008 13:50 Xeris wrote:
why the fuck would you want to build something on terrain you haven't seen yet? that's just plain retarded...
whoops nvm
|
Ah yeah, I guess gas would be the best thing to look for.
I'm not sure if *s are the only actions you'd have to look at, bwchart doesn't * all the failed build commands. So we need a program that checks the location for all non-refinery/assim/extractor build commands against mins/gas/invalid terrain (taking into account the size of the building) and checks all refinery/assim/extractor build commands to make sure they're over a geyser.
|
Alrite with the 30% estimation we can make the appropriate models in how many replays would you have to test on average before you can catch a * mark.
Suppose we're dealing with a bunch of replays of a suspecting hacker, and each of them has a .3 chance of showing a * mark. How many replays do we need to check, on average, before we can catch someone?
This is a "geometric distribution", so we're looking at the expected value of the geometric distribution. Which is:
1/0.3 = 3.333
So this is a very powerful tool in catching them, as on average, you only need to check 3-4 replays
|
Germany2896 Posts
So there are three checks if a building can be created:
1) In the GUI before the command is recorded
2) At the time the command is received
3) At the time the unit arrives at the target location
Only the second one indicates hack. And only if in the time between 1) and 2) nothing changed to block the build.
Do I understand this correctly? And does this also catch hackers using oblivion in safemode which deactivates all features zynastor considers detectable. And I guess build anywhere would be considered detectable.
|
Calgary25980 Posts
Keep fighting the good fight. I love you.
|
On December 31 2008 16:30 evanthebouncy! wrote:
Alrite with the 30% estimation we can make the appropriate models in how many replays would you have to test on average before you can catch a * mark.
Suppose we're dealing with a bunch of replays of a suspecting hacker, and each of them has a .3 chance of showing a * mark. How many replays do we need to check, on average, before we can catch someone?
This is a "geometric distribution", so we're looking at the expected value of the geometric distribution. Which is:
1/0.3 = 3.333
So this is a very powerful tool in catching them, as on average, you only need to check 3-4 replays
It's not about just finding a * mark, it's about finding a * mark that is due to unbuildable terrain as opposed to other buildings/units being in the way.
Jeez I hope flag having released this method doesn't create a slew of people checking replays and accusing others of hacking because their build actions have a * next to them 
|
On December 31 2008 19:31 MasterOfChaos wrote:
does this also catch hackers using oblivion in safemode which deactivates all features zynastor considers detectable. And I guess build anywhere would be considered detectable.
Yes, even in "safe mode" the oblivion still allowed the invalid builds. I have not tried with latest version of oblivion (could have changed in last 6 months but unlikely).
On January 01 2009 00:04 -orb- wrote:It's not about just finding a * mark, it's about finding a * mark that is due to unbuildable terrain as opposed to other buildings/units being in the way. Jeez I hope flag having released this method doesn't create a slew of people checking replays and accusing others of hacking because their build actions have a * next to them
I hope so too. Here is a replay for an example.
Only the selected action is a hack, and you can tell this because the x coordinate is 62 which would put it 1 square off of the map (supply depot is 3 long and this map is 64x64).
|
What exactly is "suspicous" does it mean anythign if you have them in your replay? Somebody please enlighten this noob.
|
Definition of a potentially suspicious event = any selection of a building or unit that belongs to another player.
That means to transform a potentially suspicious event into a proof of hack event, you must watch the replay at the exact time when the selection occurs and see if the player had vision or not on the selected building/unit. Because most really suspicious events will probably occur early in the game there is a time limit on suspicious events, that is any potential suspicious event occuring after that time limit is simply ignored. This limit is defined in the screen options. The default value is 15 minutes.
|
How do we know whether the spot on the map is buildable/unbuildable?
|
Hahaha I knew Ke422azn from a counter strike board I used to post on, and he was a douchebag there as well.
Was funny when we learned he was a proven starcraft hacker. What a noob.
On January 02 2009 12:52 jimminy_kriket wrote:
How do we know whether the spot on the map is buildable/unbuildable?
afaik you have to do it manually by looking at the map in the map editor program and looking at that coordinate. iirc the reference point (the coord given) is the left edge of the building, so look right of the coordinate to see if there is something there (or directly on the coord)
|
oh wow this takes so long
|
It's hard to do this with new maps because they all seem to be protected and I can't view them in the Campaign Editor.
|
Flag, that' brilliant. How did you figure it out?
|
On January 02 2009 15:14 Jonoman92 wrote:
It's hard to do this with new maps because they all seem to be protected and I can't view them in the Campaign Editor.
Just deprotect them. Google a deprotector for starcraft maps.
|
Good to know thanks.
I just decided to take a break from iccup yesterday and play a couple play/obs pub games.
2 games, 2 hackers. Lol it was ridiculous, one guy's marine did 20 damage, as if I wouldn't notice that -.-
|
On January 07 2009 05:24 Resonance wrote:
Good to know thanks.
I just decided to take a break from iccup yesterday and play a couple play/obs pub games.
2 games, 2 hackers. Lol it was ridiculous, one guy's marine did 20 damage, as if I wouldn't notice that -.-
That's not hacking, that's map rigging... like lastshadow.
|
Wow, really nice job Flag. Super cool.
|
I just created this account otherwise I'd start a new thread (10 day grace period before you can start a thread)...
...I recently returned to the world of starcraft after many years and I've been trying to improve my game. I managed to find a decent protoss practice partner but I've become suspicious after looking at our replays in BW chart. It appears that he doesn't use any hotkeys at all. His APM is around 100-140 and I consistently play around 150-160. I asked him if he uses hotkeys and he replied 'of course 1a2a3a4a567etc' but I find it incredibly strange there is no record of it.
Obviously his APM would be higher if BW chart was logging his hotkeys but it isn't. What is going on here? Also, how can I look for the autosplit hack?
|
you could upload a replay for us to look at, but to check for autosplit just make sure the "seconds" option at the top of bwchart is not checked then look at the time of the split, normal splits occur around 15-25 for bnet and on lan its usually around 6-11 or so, hack splits (autosplits) occur on 5 so if theres a bunch of 5's at the start time then he autosplit
i could have worded this better lol..
|
Thanks, I checked out our replays in BW chart and he's using the autosplit hack. I also used BWHF Agent and it flagged all his replays for autogather and autotraining. I can't believe I wasted over 10 games of my time against him.
This does explain his extraordinarily strong early game and near flawless macro.
|
On April 20 2009 07:03 hasuterrans wrote:
I just created this account otherwise I'd start a new thread (10 day grace period before you can start a thread)...
...I recently returned to the world of starcraft after many years and I've been trying to improve my game. I managed to find a decent protoss practice partner but I've become suspicious after looking at our replays in BW chart. It appears that he doesn't use any hotkeys at all. His APM is around 100-140 and I consistently play around 150-160. I asked him if he uses hotkeys and he replied 'of course 1a2a3a4a567etc' but I find it incredibly strange there is no record of it.
Obviously his APM would be higher if BW chart was logging his hotkeys but it isn't. What is going on here? Also, how can I look for the autosplit hack?
100-140 APMs is achievable without hotkeys..
Where did you find this guy? On an official bnet server? Just use iccup and you won't have to worry about shit like this, and if you do find someone actually hacking there, you can always report the bastard. Though it is uncertain they will ban him, as the admins are somewhat retarded and a lot of their decisions are arbitrary.. but the option is available, unlike official bnet (well, you can report people there too, but I have never heard of it working for anyone..)
|
|
|
|
|
|
EPT![[image loading]](http://golfscript.com/temp/hack2.jpg)
