diablo2-protocol
diablo2-protocol copied to clipboard
Fix anti-cheat path of diablo
Nothing noticed with sniffer, sample:

but when launching simpleBot.js:
How to fix: look carefully the packets sent / received (probably d2gs) with sniffer, don't hesitate to display raw packets ctrl+f raw, uncomment ifs ...
Or try to see when the bot is kicked out but the output is not so clear ...
Would be nice to have a connection dump of before the anti-cheat to compare
SID_CHATEVENT seems to be received once the bot stop receiving D2GS_PONG (maybe the D2GS_PING sent is incorrect, protocol has been changed)
sidToClient : SID_CHATEVENT {"ff":255,"name":"SID_CHATEVENT","size":42,"params":{"eventId":18,"usersFlags":0,"ping":0,"ipAdress":0,"accountNumber":3131961357,"registrationAuthority":3131961357,"username":1684621056,"text":1852731237}}
This SID_CHATEVENT seems to be a "bot checker" or something (i may be wrong), it's new btw https://bnetdocs.org/packet/307/sid-chatevent
We can try to reproduce exactly the D2GS_PING behavior of the client, for that we need to understand the tickCount pattern, i made something to count the occurrence of the difference between current and last tick count:
d2gsToServer : D2GS_PING {"tickCount":6058578,"delay":200,"wardenResponse":0} [ { element: -5047, occurences: 75 }, { element: -5031, occurences: 65 }, { element: -5016, occurences: 49 }, { element: -5015, occurences: 39 }, { element: -5063, occurences: 33 }, { element: -5062, occurences: 31 }, { element: -5078, occurences: 29 }, { element: -5032, occurences: 27 }, { element: -5046, occurences: 8 }, { element: -5079, occurences: 5 }, { element: -5094, occurences: 5 }, { element: -5125, occurences: 4 }, { element: -5093, occurences: 3 }, { element: -5109, occurences: 2 }, { element: -5140, occurences: 2 }, { element: -4140812, occurences: 1 }, { element: -5110, occurences: 1 }, { element: -5141, occurences: 1 }, { element: -5172, occurences: 1 }, { element: -5844, occurences: 1 } ] true
strangely some number come back often ...
@louis030195 Hi, dunno if you fixed that already, but the fix is pretty simple, watch for 0x2b from server and respond with the same packet you received.
Afaik 0x2b size is 6 bytes
@louis030195 Hi, dunno if you fixed that already, but the fix is pretty simple, watch for 0x2b from server and respond with the same packet you received.
Afaik 0x2b size is 6 bytes
Thank you but this one is of course obvious yes and was fixed long time ago https://github.com/MephisTools/diablo2-protocol/blob/cb0f2f98dd7f456ece477fbc57a67f6a62768f9a/lib/client/createClientD2gs.js#L55
If you have any idea about the new anti-hack :)
New one? ;P Im only aware of this 0x2b packet.
As for the 0x2b one, i thought we had to wait first for the server to send it, but looking at the code you provided, we can just send it blindly after connecting to GS.
yeah there must be a new one as this doesn't seem to be enough. Do you have a different experience, does it work for you?
Sure, im using a vanilla d2 installation (so i dont have to worry about PoD anticheat dll) with patch_d2.mpq copied over (so i get all PoD features) and the only thing required is responding to this 0x2b packet.
vanilla d2 installation with patch_d2.mpq copied over (so i get all PoD features)
yeah these 2 things are what we don't (and can't) have, I guess pod server added something to detect something that behave differently in the client if you don't have those
You can connect without a problem using vanilla patch_d2.mpq you just won't get any PoD features, but server won't disconnect you.
As for the d2 client itself i doubt they added anything, maybe it's a standard thingy for d2gs used in PoD?
Looking at PVPGN forums (for ex. https://forums.pvpgn.pro/viewtopic.php?id=1999) i assume PoD still runs on PVPGN GS, maybe that will be a useful hint?
Yeah maybe. Something they could've added is generic bot detection not specific to pod, like making sure all packets are properly sent, and it's possible we're not behaving exactly like the vanilla client.
hi(sorry for my English I use a translator) in the last season of Path of Diablo I used a remade D2 etal(thank you for tereport and Hydra sorc) using d2 path. mpq (pod) in the folder with the vanilla version and it worked only needed an injector pod.dll /now an error occurred when trying to create a server or log in .https://youtu.be/ijYdOmYUfaQ
Sure, im using a vanilla d2 installation (so i dont have to worry about PoD anticheat dll) with patch_d2.mpq copied over (so i get all PoD features) and the only thing required is responding to this 0x2b packet.
how do you send the packet?
im doing it like this:
BYTE Antishit[6] = {0x2b,0x01,0x55,0x33,0x22,0x11};
D2NET_SendPacket(6, 0, Antishit);
but its still lagging me out. i have checked it with some sniffer and i do send this packet to the gs though

Sniffing sent 0x2b packets. Seems to match what you have.
yea its still dropping me though.. maybe it has to be some specific timing... i dont know. how did u get redvex to work? could you help me maybe? want to use the netstuff plugin ^^
I hope we find the right packet to stay in game, this is not working for me, i send it and nothing
This works for me for non-maps and for non-multi person games. It seems it works for awhile in multi person games but more often than not it gets DC'd. There seems to be other packets that get sent in maps and when playing with others that the client is expected to respond to. Ill see if I can log them.
I try to send the packet , to block it.. and nothing.. i shoud say i use custom dll's that i inject in game , also i try with redvex... nothing..
This d2 protocol seems to work for you. but idk how to use it on windows and join in game .:(
@tronico88 @xkpx64 the original developer of this already sending the packet, but its not at the right time... comment out where he is doing that... add a listener for GS->C 0x2b and echo back C->GS what you get (which seems to be hardcoded to the above packet). That works for me.
@geota @xkpx64 can y’all hit me on discord, trying to mess around with net stuff and would love some assistance thepodfather#8086