Valhalla Legends Forums Archive | Battle.net Bot Development | Post-Reply Pre-Login Ping (0x25 Ping Spoof => 0 Ping)

AuthorMessageTime
v0id
Ok I understand I can accomplish -1 ping by using the following code:

Case &H25
    If Val(GetStuff("Other", "Spoof -1 Ping")) = 1 Then
          Exit Sub

And I get normal ping by this code:

    Else
          With PBuffer
                .InsertNonNTString Mid(Data, 5, 4)
                .SendPacket &H25
          End With
    End If

That is my 0x25 Packet sending and receiving.  Now how do I go about getting 0 ping?  I read, and have interpreted in my own words, the title "Post-Reply Pre-Login Ping" to "Reply After the Pre-Login Ping as been sent".  To get -1 is "Ignore Pre-Login Ping" as you see above.  It just ignores it completely.  How do you reply to the packet after it has already been sent?  By a timer?

Any help is appreciated.
August 26, 2005, 7:30 PM
HdxBmx27
-1 = Ignoring it
Normal = Normal
0 =  Sending it before you get it
You can get 0 by sending packet 0x25 (SID_PING) before you recive it. Send it with a value of 0 right after you send 0x50 (SID_AUTH_INFO)
~-~(HDX)~-~
August 26, 2005, 7:46 PM
v0id
.SendPacket 0?

Because that gets me IPBanned.
August 26, 2005, 7:55 PM
HdxBmx27
.InsertDWORD 0
.SendPacket &H25
~-~(HDX)~-~
August 26, 2005, 7:56 PM
v0id
I sent that packet in my &H50, after the rest of the coding, and I also put changed it to this in the above coding:

If Val(GetStuff("Other", "Spoof 0 Ping")) = 1 Then
Else

So it doesn't do anything in the &H25, it moves to &H50 and then sends the packet with a value of 0.

Result:  Normal Ping.

I even put it in my &H25 Packet.

If Val(GetStuff("Other", "Spoof 0 Ping")) = 1 Then
    With PBuffer
          .InsertDWORD 0
          .SendPacket &H25
    End With

Same result, normal ping.
August 26, 2005, 8:04 PM
HdxBmx27
Send it when you send 0x50, not when you recive 0x50.
~-~(HDX)~-~
August 26, 2005, 8:08 PM
v0id
There we go, thanks man.  I appreciate it much! :)
August 26, 2005, 8:16 PM
Spht
[quote author=Securify link=topic=12628.msg125580#msg125580 date=1125084654]I read, and have interpreted in my own words, the title "Post-Reply Pre-Login Ping" to "Reply After the Pre-Login Ping as been sent".  To get -1 is "Ignore Pre-Login Ping" as you see above.  It just ignores it completely.[/quote]

No.  Isn't it obvious?  "Ignore Pre-Login Ping," pre-logon ping being the SID_PING message Battle.net sends before login (hence, "pre login") to determine your "ping time."  The bot will ignore that message, but respond to all future requests.  This gives you what people tend to call "-1 ping"(?)

"Post-Reply Pre-Login Ping," again referring to the ping that is sent before login ("pre-login ping").  But here instead of ignoring the request, the bot will now reply before it even receives the message (hence, "post reply").  This sort of tricks Battle.net allowing you to achieve an extraordinary low ping time--usually zero.

There you have it.
August 26, 2005, 9:23 PM
Yegg
Spht, I have a question. After I've received 0x25, can I echo back a different value? If I can echo back a different value would this mean that I can make up my own ping timestamp?
August 26, 2005, 9:50 PM
KkBlazekK
You can echo back any 4 bytes you want.  It doesn't make a change in the ping though.
August 26, 2005, 10:10 PM
v0id
[quote author=Spht link=topic=12628.msg125593#msg125593 date=1125091416]
[quote author=Securify link=topic=12628.msg125580#msg125580 date=1125084654]I read, and have interpreted in my own words, the title "Post-Reply Pre-Login Ping" to "Reply After the Pre-Login Ping as been sent". To get -1 is "Ignore Pre-Login Ping" as you see above. It just ignores it completely.[/quote]

No. Isn't it obvious? "Ignore Pre-Login Ping," pre-logon ping being the SID_PING message Battle.net sends before login (hence, "pre login") to determine your "ping time." The bot will ignore that message, but respond to all future requests. This gives you what people tend to call "-1 ping"(?)

"Post-Reply Pre-Login Ping," again referring to the ping that is sent before login ("pre-login ping"). But here instead of ignoring the request, the bot will now reply before it even receives the message (hence, "post reply"). This sort of tricks Battle.net allowing you to achieve an extraordinary low ping time--usually zero.

There you have it.
[/quote]

I appreciate you going, kind of, in depth about this subject.  I was a bit confused on the true meaning, but I got it now.

Again, thanks.
August 26, 2005, 10:14 PM
Quarantine
[quote author=Yegg link=topic=12628.msg125597#msg125597 date=1125093054]
Spht, I have a question. After I've received 0x25, can I echo back a different value? If I can echo back a different value would this mean that I can make up my own ping timestamp?
[/quote]

You can however time your  response to SID_PING and get an approximate ping that you want.
August 26, 2005, 10:34 PM
Yegg
[quote author=Warrior link=topic=12628.msg125600#msg125600 date=1125095667]
[quote author=Yegg link=topic=12628.msg125597#msg125597 date=1125093054]
Spht, I have a question. After I've received 0x25, can I echo back a different value? If I can echo back a different value would this mean that I can make up my own ping timestamp?
[/quote]

You can however time your  response to SID_PING and get an approximate ping that you want.
[/quote]
I see. Thanks Warrior.
August 27, 2005, 12:17 AM
FrOzeN
You can also add to your ping time.
Eg. Let's say you normal ping is 172ms.

By doing:
[code]Case &H25
    'Code to Pause for 3 seconds
    With PBuffer
        .InsertNonNTString Mid(Data, 5, 4)
        .SendPacket &H25
    End With[/code]

Your ping will be: 3172ms.
However it's very hard to make it do this accurately, and by causing your ping to exceed 59999ms you won't establish a connection to Battle.net.

Yet, not sure how but people have exceeded Battle.net pings over 60 seconds.. but there unstable and usually only last 2-10 minutes.
August 27, 2005, 6:35 AM
KkBlazekK
[quote author=FrOzeN link=topic=12628.msg125661#msg125661 date=1125124521]
Yet, not sure how but people have exceeded Battle.net pings over 60 seconds..
[/quote]

They still send the keepalive packet, which keeps the connection alive.
[quote]
but there unstable and usually only last 2-10 minutes.
[/quote]
Where did you get that from?
August 27, 2005, 6:57 AM
FrOzeN
Don't remember, remembered this from over a year ago.
Probably from someone who didn't send the KeepAlive packet. :P
August 27, 2005, 7:14 AM
LoRd
[quote]However it's very hard to make it do this accurately, and by causing your ping to exceed 59999ms you won't establish a connection to Battle.net.[/quote]

Battle.net stores user ping values in a doubleword which can be any numerical value from 0 to 4294967295.  Perhaps you failed to send the version check data before the hash values changed?
August 27, 2005, 7:33 AM
shout
[quote author=LoRd[nK] link=topic=12628.msg125665#msg125665 date=1125128001]
[quote]However it's very hard to make it do this accurately, and by causing your ping to exceed 59999ms you won't establish a connection to Battle.net.[/quote]

Battle.net stores user ping values in a doubleword which can be any numerical value from 0 to 4294967295.  Perhaps you failed to send the version check data before the hash values changed?
[/quote]

There may be a limit on how long logons can take. So you would need to keep the other packets going while holding off the ping packet. </speculation>
August 27, 2005, 7:39 AM
FrOzeN
[quote author=LoRd[nK] link=topic=12628.msg125665#msg125665 date=1125128001]
[quote]However it's very hard to make it do this accurately, and by causing your ping to exceed 59999ms you won't establish a connection to Battle.net.[/quote]

Battle.net stores user ping values in a doubleword which can be any numerical value from 0 to 4294967295.  Perhaps you failed to send the version check data before the hash values changed?
[/quote]

I was lazy testing this, I've never done it properally by making the code pause.
With StealthBot on Windows 98SE. I'd click 'Connect', then wait..
Once it said "[TimeStamp] [BNET] Connected!" I would suddenly click the Title bar and hold the mouse down counting to 59 before releasing. When holding the title bar down it pauses everything the program does. Once i'd release it would continue connecting giving me pings around 57,000ms.. I tried getting it as close to 60,000ms. Anytime that I exceeded 60 seconds it wouldn't connect. And the closest I got was 57,### so I fiqured 60 seconds was the maximum.

Also another story I remember, I had StealthBot set to give me 0 ms. During the connection my computer was LAGGING EXTREMELY BAD and somehow it gave me 16ms, the best i've ever got properally is 156ms so don't know how it happened but it did.
August 27, 2005, 8:03 AM
JoeTheOdd
[code]Public Sub Send0x50(bZeroPing As Boolean)
    With Buffer
        .InsertDWORD 0                              '(DWORD)      Protocol ID (0)
        .InsertDWORD GetDWORD(modINI.GetGameID)    '(DWORD)      Platform ID
        .InsertDWORD GetDWORD("68XI")              '(DWORD)      Product ID
        .InsertDWORD GetVerbyte(modINI.GetGameID)  '(DWORD)      Version Byte
        .InsertDWORD 0                              '(DWORD)      Product language
        .InsertDWORD 0                              '(DWORD)      Local IP for NAT compatibility*
        .InsertDWORD 0                              '(DWORD)      Time zone bias*
        .InsertDWORD &H1033                        '(DWORD)      Locale ID*
        .InsertDWORD &H1033                        '(DWORD)      Language ID*
        .InsertNTString "USA"                      '(STRING)    Country abreviation
        .InsertNTString "United States"            '(STRING)    Country
        .Push &H50
        If bZeroPing = True Then
            .InsertDWORD 0
            .Push &H25
        End If
        .Flush
    End With
End Sub

Public Sub Parse(Data As String)
    With Debuffer
        .Buffer = Data
        .RemoveVoid 1                              'Remove sanity byte
        Select Case .RemoveByte
            Case &H25
                Select Case modINI.PingValue
                    Case "-1"
                        'Nothing
                    Case Else
                        sckBnet.SendData Data
                End Select
            'Handle the rest of the packets here
        End Select
    End With
End Sub[/code]
August 27, 2005, 11:35 AM
v0id
[quote author=Blaze link=topic=12628.msg125663#msg125663 date=1125125876]
[quote author=FrOzeN link=topic=12628.msg125661#msg125661 date=1125124521]
Yet, not sure how but people have exceeded Battle.net pings over 60 seconds..
[/quote]

They still send the keepalive packet, which keeps the connection alive.
[quote]
but there unstable and usually only last 2-10 minutes.
[/quote]
Where did you get that from?
[/quote]

You can either manually send it or not?  Not sure.  Maybe the user disconnected locally.
August 27, 2005, 7:57 PM
R.a.B.B.i.T
[quote author=FrOzeN link=topic=12628.msg125670#msg125670 date=1125129823]
[quote author=LoRd[nK] link=topic=12628.msg125665#msg125665 date=1125128001]
[quote]However it's very hard to make it do this accurately, and by causing your ping to exceed 59999ms you won't establish a connection to Battle.net.[/quote]

Battle.net stores user ping values in a doubleword which can be any numerical value from 0 to 4294967295.  Perhaps you failed to send the version check data before the hash values changed?
[/quote]

I was lazy testing this, I've never done it properally by making the code pause.
With StealthBot on Windows 98SE. I'd click 'Connect', then wait..
Once it said "[TimeStamp] [BNET] Connected!" I would suddenly click the Title bar and hold the mouse down counting to 59 before releasing. When holding the title bar down it pauses everything the program does. Once i'd release it would continue connecting giving me pings around 57,000ms.. I tried getting it as close to 60,000ms. Anytime that I exceeded 60 seconds it wouldn't connect. And the closest I got was 57,### so I fiqured 60 seconds was the maximum.
[/quote]I wrote a simple bot explicitly to test this.  I have successfully gotten over 1 million ping.  All you do is call Sleep() in the ms delay you want to have for a ping before sending the first 0x25 to Battle.Net (only when you recieve, do not send with 0x50), then sending following 0x25 responses normally.
August 27, 2005, 8:28 PM
Quarantine
...thanks for repeating what I showed above?
August 27, 2005, 8:35 PM
R.a.B.B.i.T
Eh...I probably should have read the whole first page ;\
August 28, 2005, 9:42 PM

Search