Fix anti-cheat path of diablo

[louis030195]

Nothing noticed with sniffer, sample:

full d2gs sniffer dump

but when launching simpleBot.js:

full d2gs bot dump

[louis030195]

How to fix:
look carefully the packets sent / received (probably d2gs) with sniffer, don't hesitate to display raw packets ctrl+f raw, uncomment ifs ...

Or try to see when the bot is kicked out but the output is not so clear ...

Would be nice to have a connection dump of before the anti-cheat to compare

[louis030195]

SID_CHATEVENT seems to be received once the bot stop receiving D2GS_PONG (maybe the D2GS_PING sent is incorrect, protocol has been changed)

sidToClient : SID_CHATEVENT {"ff":255,"name":"SID_CHATEVENT","size":42,"params":{"eventId":18,"usersFlags":0,"ping":0,"ipAdress":0,"accountNumber":3131961357,"registrationAuthority":3131961357,"username":1684621056,"text":1852731237}}

This SID_CHATEVENT seems to be a "bot checker" or something (i may be wrong), it's new btw
https://bnetdocs.org/packet/307/sid-chatevent

[louis030195]

We can try to reproduce exactly the D2GS_PING behavior of the client, for that we need to understand the tickCount pattern, i made something to count the occurrence of the difference between current and last tick count:

d2gsToServer : D2GS_PING {"tickCount":6058578,"delay":200,"wardenResponse":0}
[ { element: -5047, occurences: 75 },
{ element: -5031, occurences: 65 },
{ element: -5016, occurences: 49 },
{ element: -5015, occurences: 39 },
{ element: -5063, occurences: 33 },
{ element: -5062, occurences: 31 },
{ element: -5078, occurences: 29 },
{ element: -5032, occurences: 27 },
{ element: -5046, occurences: 8 },
{ element: -5079, occurences: 5 },
{ element: -5094, occurences: 5 },
{ element: -5125, occurences: 4 },
{ element: -5093, occurences: 3 },
{ element: -5109, occurences: 2 },
{ element: -5140, occurences: 2 },
{ element: -4140812, occurences: 1 },
{ element: -5110, occurences: 1 },
{ element: -5141, occurences: 1 },
{ element: -5172, occurences: 1 },
{ element: -5844, occurences: 1 } ] true

strangely some number come back often ...

[therpr]

@louis030195 Hi, dunno if you fixed that already, but the fix is pretty simple, watch for 0x2b from server and respond with the same packet you received.

Afaik 0x2b size is 6 bytes

[louis030195]

@louis030195 Hi, dunno if you fixed that already, but the fix is pretty simple, watch for 0x2b from server and respond with the same packet you received.

Afaik 0x2b size is 6 bytes

Thank you but this one is of course obvious yes and was fixed long time ago

diablo2-protocol/lib/client/createClientD2gs.js

Line 55 in cb0f2f9

if (version === '1.13') clientD2gs.socket.write(Buffer.from('2b0155332211', 'hex'))// 2b0155332211 // PoD anticheat packet XD

If you have any idea about the new anti-hack :)

[therpr]

New one? ;P Im only aware of this 0x2b packet.

As for the 0x2b one, i thought we had to wait first for the server to send it, but looking at the code you provided, we can just send it blindly after connecting to GS.

[rom1504]

yeah there must be a new one as this doesn't seem to be enough. Do you have a different experience, does it work for you?

[therpr]

Sure, im using a vanilla d2 installation (so i dont have to worry about PoD anticheat dll) with patch_d2.mpq copied over (so i get all PoD features) and the only thing required is responding to this 0x2b packet.

[rom1504]

vanilla d2 installation
with patch_d2.mpq copied over (so i get all PoD features)

yeah these 2 things are what we don't (and can't) have, I guess pod server added something to detect something that behave differently in the client if you don't have those

[therpr]

You can connect without a problem using vanilla patch_d2.mpq you just won't get any PoD features, but server won't disconnect you.

As for the d2 client itself i doubt they added anything, maybe it's a standard thingy for d2gs used in PoD?

Looking at PVPGN forums (for ex. https://forums.pvpgn.pro/viewtopic.php?id=1999) i assume PoD still runs on PVPGN GS, maybe that will be a useful hint?

[rom1504]

Yeah maybe. Something they could've added is generic bot detection not specific to pod, like making sure all packets are properly sent, and it's possible we're not behaving exactly like the vanilla client.

[Villiyo]

hi(sorry for my English I use a translator) in the last season of Path of Diablo I used a remade D2 etal(thank you for tereport and Hydra sorc) using d2 path. mpq (pod) in the folder with the vanilla version and it worked only needed an injector pod.dll /now an error occurred when trying to create a server or log in .https://youtu.be/ijYdOmYUfaQ

[tronico88]

Sure, im using a vanilla d2 installation (so i dont have to worry about PoD anticheat dll) with patch_d2.mpq copied over (so i get all PoD features) and the only thing required is responding to this 0x2b packet.

how do you send the packet?

im doing it like this:

BYTE Antishit[6] = {0x2b,0x01,0x55,0x33,0x22,0x11};
D2NET_SendPacket(6, 0, Antishit);

but its still lagging me out. i have checked it with some sniffer and i do send this packet to the gs though

[geota]

Sniffing sent 0x2b packets. Seems to match what you have.

[tronico88]

yea its still dropping me though.. maybe it has to be some specific timing... i dont know. how did u get redvex to work? could you help me maybe? want to use the netstuff plugin ^^