Some bots (in particular, the one I'm using ... *cough*Spht*cough*) seem to not like it when BNLS returns 0x01 for the status to BNLS_AUTHORIZEPROOF reply (meaning that the bot's ID or password was invalid). Whether it's intentional (disable old versions or whatever) or not (didn't allow for nonzero statuscodes, accidental BNLS password change, etc), this can be annoying. If the bot you're using allows you to change the BNLS server to 127.0.0.1, then you could try this. It simply passes data between the bot and the real BNLS server, except that when the BNLS_AUTHORIZEPROOF reply is sent from the server, the status code always gets changed to 0x00 (bot is authorized), which makes the bot think it's allowed to move on.

BNLS seems to be down at the moment, so I'm not able to test it myself (eww...), so hopefully someone else will be able to, because I'm about to fall asleep.

By the way, this is my first Win32 app.

http://linkware.clan-mac.com/kanebot/misc/bnls_authorizer.zip

Or everyone can stop using the out-dated BNLS authorization packets (unless there's still some reason to use them...) and just dump all of their authorization processing and just move along the protocol.  Besides, what caused SphtBotv3 to all of the sudden become unauthorized?

[quote author=Mephisto link=topic=10156.msg94764#msg94764 date=1105369017]
Or everyone can stop using the out-dated BNLS authorization packets (unless there's still some reason to use them...) and just dump all of their authorization processing and just move along the protocol.  Besides, what caused SphtBotv3 to all of the sudden become unauthorized?
[/quote]

The reason for using them, as Kane pointed out, is to disable old versions.  Change the password to disable old versions, eh? :)

Thanks, Kane.  I've been having trouble with it lately myself; that helps!

That would be really easy to fix, and I think UL did it already.

[quote author=Mephisto link=topic=10156.msg94774#msg94774 date=1105383558]
That would be really easy to fix, and I think UL did it already.
[/quote]

It probably wouldn't be "really easy to fix" if you don't have access to the source code nor a plugin system (which even then might not be enough).  The proxy-like application Kane created is a good solution to the problem.

Just hack SphtBotv3 like i did.  Goto offset 0xa3801 in your favorite hex editor and change it from a 0x74 to 0xeb

Thanks for finding the offset.  :)

Ditto

[quote author=UserLoser link=topic=10156.msg94778#msg94778 date=1105387179]
Just hack SphtBotv3 like i did.  Goto offset 0xa3801 in your favorite hex editor and change it from a 0x74 to 0xeb
[/quote]

There are a couple drawbacks to that:

1.) As a solution it only works for SphtBotv3.
2.) It doesn't address the actual cause of the problem, which is that Skywing has been eaten by WoW and Yoni by the Israeli government.

Somebody should point out that this is one of the problems with relying on a third party server (vL's) for authentication.  Not only is it a means of control (If you want a bot on Battle.net you HAVE to come through US), it's also a failure point if the technology isn't maintained.

If Blizzard updates one of their clients now, I wonder how long it'll take to update BNLS :)

Bypassing a failed authorize isn't necessarily wise, as historically it's been used to disable versions which had flaws discovered.  For example, Spht found a logic bug that let anyone use setuser to grant privileges, so he changed his authorization password to force people to upgrade to a fixed version.  That said, I don't know whether this incident is a case of passwords changed intentionally, accidentally, or simple lossage by the server.  Also, be grateful I convinced UserLoser to use eb instead of 75 for the logic change. ;)

[quote author=Kp link=topic=10156.msg94785#msg94785 date=1105389877]
Bypassing a failed authorize isn't necessarily wise, as historically it's been used to disable versions which had flaws discovered.  For example, Spht found a logic bug that let anyone use setuser to grant privileges, so he changed his authorization password to force people to upgrade to a fixed version.  That said, I don't know whether this incident is a case of passwords changed intentionally, accidentally, or simple lossage by the server.  Also, be grateful I convinced UserLoser to use eb instead of 75 for the logic change. ;)
[/quote]

Yeah I was going to point out an issue with using 75 for the logic change, but he didn't.  ;)  jnz -- what happens when the code gets fixed and goes back to zero?  Another breakage!

[quote author=Kp link=topic=10156.msg94785#msg94785 date=1105389877]
Bypassing a failed authorize isn't necessarily wise, as historically it's been used to disable versions which had flaws discovered.[/quote]I'd hope that anyone using this tool would know the risks involved, I certainly do.

I wrote it because SphtBotv3 stopped working, I looked on his website, didn't see any updated news, so I still downloaded it again thinking maybe he simply forgot to add news about it... and it still wasn't able to connect. So, I delve further into the problem, and it turned out that SphtBotv3 would simply stop handling BNLS packets (not disconnect or anything) after it received 0x01 in msg 0x0F. So I wrote a small workaround for it.

Of course I realize that it could be a risk if it indeed is a security "lockdown" of old versions, but I also feel that I'm willing to take that risk and subject myself to the consequences if the risk turns into a nightmare.

I'd hope that anyone else using this tool would know the risks involved.


Edit: On a side note, I had tried using JBLS to remedy the problem, and it had seemed to work. Then I tried to logon my WarCraft III account with it, and it always got stuck at the logon sequence (Specifically, I think it was the LogonProof msg that it didn't seem to like), so I figured that this would be the best alternative.

I originally was going to use jmp instead by writing an HDL to use whenever this issue came about.  Turned out I figured it was just easier to modify the executable it's self because the HDL was failing to hook SphtBot for whatever reason && don't know jmp off top of head (do now, though)

[quote author=tA-Kane link=topic=10156.msg94789#msg94789 date=1105391146]Edit: On a side note, I had tried using JBLS to remedy the problem, and it had seemed to work. Then I tried to logon my WarCraft III account with it, and it always got stuck at the logon sequence (Specifically, I think it was the LogonProof msg that it didn't seem to like), so I figured that this would be the best alternative.
[/quote]JBLS is only the basic logon pieces of the BNLS protocol, and doesn't handle all of the packets.  This is one of the reasons some bots don't work (such as SphtBot): they require other packets before they logon.

[quote author=R.a.B.B.i.T link=topic=10156.msg94842#msg94842 date=1105410669]
[quote author=tA-Kane link=topic=10156.msg94789#msg94789 date=1105391146]Edit: On a side note, I had tried using JBLS to remedy the problem, and it had seemed to work. Then I tried to logon my WarCraft III account with it, and it always got stuck at the logon sequence (Specifically, I think it was the LogonProof msg that it didn't seem to like), so I figured that this would be the best alternative.
[/quote]JBLS is only the basic logon pieces of the BNLS protocol, and doesn't handle all of the packets.  This is one of the reasons some bots don't work (such as SphtBot): they require other packets before they logon.
[/quote]

Last time I used JBLS I modified it slightly to handle 0x0e and 0x0f.  :)

As UserLoser pointed out to me JBLS assumes things it shouldn't.  It seems that if using BNLS to connect with WAR3 you *must* send BNLS_CHOOSENLSREVISION (not sure if that macro is entirely accurate) and with JBLS it is not necessary.  Perhaps the author should change this?

BNLS seems to be back online, and I have fixed (finished?) the program to be able to work.

Download the new (latest and likely final) version (executable and source) here:
http://linkware.clan-mac.com/kanebot/misc/bnls_authorizerV1.0.zip

[quote author=tA-Kane link=topic=10156.msg94862#msg94862 date=1105431953]
BNLS seems to be back online, and I have fixed (finished?) the program to be able to work.
[/quote]

I don't think it's back online.....  I don't know that it ever went "offline" per se, but I'm still getting the response code of 1.

I too still get a response code of 1, but the BNLS authorizer changes it to 0.

[quote author=R.a.B.B.i.T link=topic=10156.msg94842#msg94842 date=1105410669]
[quote author=tA-Kane link=topic=10156.msg94789#msg94789 date=1105391146]Edit: On a side note, I had tried using JBLS to remedy the problem, and it had seemed to work. Then I tried to logon my WarCraft III account with it, and it always got stuck at the logon sequence (Specifically, I think it was the LogonProof msg that it didn't seem to like), so I figured that this would be the best alternative.
[/quote]JBLS is only the basic logon pieces of the BNLS protocol, and doesn't handle all of the packets.  This is one of the reasons some bots don't work (such as SphtBot): they require other packets before they logon.
[/quote]

It's probably BNLS_CONFIRMLOGON.  That packet just contains a boolean value.  You could probably implement a dummy handler in JBLS for this packet that always returns true since I don't one would really care to verify the server.

[quote author=Mephisto link=topic=10156.msg94857#msg94857 date=1105423484]
As UserLoser pointed out to me JBLS assumes things it shouldn't.  It seems that if using BNLS to connect with WAR3 you *must* send BNLS_CHOOSENLSREVISION (not sure if that macro is entirely accurate) and with JBLS it is not necessary.  Perhaps the author should change this?
[/quote]

Doesn't seem necessary.  As long as it assumes 2 for that value for WAR3 connections, then all is fine as long as this is documented.  If however JBLS doesn't implement BNLS_CHOOSENLSREVISION, then that would be bad.

[quote author=EviL_MarinE link=topic=10156.msg94959#msg94959 date=1105516722]
Or you could not use BNLS and try using hashes? so every time bnls goes down your bot will still work, and if it is made public people wont be annoyed cos there bot wont stop working...[/quote]You're not paying attention. That's not the goal of this program.

[quote author=EviL_MarinE link=topic=10156.msg95014#msg95014 date=1105567351]
Use Hashes and not bnls, then your bot wont die! :P
[/quote]

True enough.

Somebody deleted my posts :D

Was it because i said "if u dont use BNLS your bot will stay alive" ?

Well if i hurt somebodys feeling for apparantly saying something bad about bnls, then im sorry, but its my opinion and im only helping others...

If you're already connected to B.net then it doesn't matter if BNLS is down.

[quote author=EviL_MarinE link=topic=10156.msg95088#msg95088 date=1105640140]
Well if i hurt somebodys feeling for apparantly saying something bad about bnls, then im sorry, but its my opinion and im only helping others...
[/quote]It was because the program is about by passing 0x0E/F, which is not relevent to local hashing. It was made for bots that don't have/support Local hashing I assume.

[quote author=Blaze link=topic=10156.msg95116#msg95116 date=1105654778]
[quote author=EviL_MarinE link=topic=10156.msg95088#msg95088 date=1105640140]
Well if i hurt somebodys feeling for apparantly saying something bad about bnls, then im sorry, but its my opinion and im only helping others...
[/quote]It was because the program is about by passing 0x0E/F, which is not relevent to local hashing. It was made for bots that don't have/support Local hashing I assume.
[/quote]Indeed, 0x0E/F isn't about hashing at all really, it's about making sure your bot is "authorized" to connect to BNLS. But since BNLS no longer requires bots to be authorized to work, it's now used to make sure that your bot has the latest password. If it doesnt, a bot can then assume that it's too old to function (perhaps a necessary security fix, or disabling leaked versions). But this program changes the result returned from BNLS from "password too old" to "good password". You might think that it would affect what BNLS allows and doesn't, but that's the thing, BNLS no longer cares about the password, so it does the same thing whether or not you have the latest password, or even if you don't provide a password. It's the bot itself that decides to not function if the password is too old.

I hope this makes sense to you, because I've dumbed it down a lot.  :\