DVS Parse

[AzazaelFenrir]

cosmetic stuff like parsers, dat swaps, (even time stamp and TP tracking etc.) well, I've never seen anyone banned for these; and I doubt SE will start now.

It's also impossible to detect those if they are programmed correctly>_>

I lol'd.
you're quite wrong.

Care to expand? Timestamp I agree on, but the rest?

[Amele]

cosmetic stuff like parsers, dat swaps, (even time stamp and TP tracking etc.) well, I've never seen anyone banned for these; and I doubt SE will start now.

It's also impossible to detect those if they are programmed correctly>_>

I lol'd.
you're quite wrong.

Care to expand? Timestamp I agree on, but the rest?

nothing is impossible when it comes to monitoring software. *shrugs*

basically; SE can't detect alot of stuff server side (because you have to send data to a server for a server to see it) but -everything- is detectable client side: SE just has to modify the client to do it and then send the data to SE.

the current version of POL already calls zwProcessRead on your entire running process list whenever it starts up and exits (either pol itself or FFXI, I can't remember off hand and I don't have it installed at work) it takes very little more work from there to monitor for when any process attempts to access another process - which is where you'd catch 90% of the 'undetectable' third party apps.

as for hooking: it's a little harder to detect yes; but it's pretty easy for an application to scan its memory space for .dlls resident that it didn't put there itself.

a large part of why timestamp is 'safe' is because it's not particularly more detectable than anything else that's currently in windower; (SE would be dumb to pull your local logs when all chat beyond echo goes through the server anyway) which has no bearing on whether or not windower or any app that interacts directly with POL's process is undetectable.

[AzazaelFenrir]

ok I thought that is where you were going with it, but I wanted to make sure I wasn't missing anything.

[Amele]

ok I thought that is where you were going with it, but I wanted to make sure I wasn't missing anything.

don't take zwProcessRead for granite. might've been a better response. but I figured that it was worth giving a real explanation.

[Malaquist]

zwProcessRead

ZA WARUDO.

(either pol itself or FFXI, I can't remember off hand and I don't have it installed at work)

I think it's POL? I seem to remember it being first noticed with POL launches instead of FFXI itself.

cosmetic stuff like parsers, dat swaps, (even time stamp and TP tracking etc.) well, I've never seen anyone banned for these; and I doubt SE will start now.

I can't imagine them ever going through the trouble of banning them when there will always be bigger issues going on.

[Kaylia]

cosmetic stuff like parsers, dat swaps, (even time stamp and TP tracking etc.) well, I've never seen anyone banned for these; and I doubt SE will start now.

It's also impossible to detect those if they are programmed correctly>_>

I lol'd.
you're quite wrong.

nothing is impossible when it comes to monitoring software. *shrugs*

And nothing is impossible when it come to hiding something to someone who doesnt have direct access to your pc... They could make another program on top of FFXI to scan the process and all, but it would be a lot of trouble for them, and there is always to go around those program. In worst case scenario, you could rewrite every packet to look legit, but I dont want to be the one who reverse engineer that.

Either way, under current circumstance, there is no way they can detect it because FFXI process doesn't have such scan.

[Amele]

Malaquist: I meant the exit point. I know that Pol scans on boot, what I don't remember is if it's pol scanning on reboot after exiting ffxi or on exit of pol. (it's reboot 90% sure).

Either way, under current circumstance, there is no way they can detect it because FFXI process doesn't have such scan.

you don't know that.

and SE already -has- the overlying app. it's called pol. all of it is in place, and yes; a local client that's slaved to a server counts as direct access.

POL could request ring0 and 95% of the players would give it to it if it meant they could play *shrugs*

(there are ways to get around it yes. there's ways to get around *those* ways too.)

[genome]

Malaquist: I meant the exit point. I know that Pol scans on boot, what I don't remember is if it's pol scanning on reboot after exiting ffxi or on exit of pol. (it's reboot 90% sure).

Either way, under current circumstance, there is no way they can detect it because FFXI process doesn't have such scan.

you don't know that.

and SE already -has- the overlying app. it's called pol. all of it is in place, and yes; a local client that's slaved to a server counts as direct access.

POL could request ring0 and 95% of the players would give it to it if it meant they could play *shrugs*

(there are ways to get around it yes. there's ways to get around *those* ways too.)

I think both are good points, but there's no point going on with "there are ways around that too" back and forth, because very early it becomes much more effort than either party would realistically want to invest.

SE has an interest in preventing cheating, but probably very little interest in preventing things like a windowed mode. They also probably don't want to be known as a company that installs spyware.
I think something like that happened with some WoW process looking at the titlebar of all your windows etc. I forget the details, but it's a demonstration that If a game starts spying on all your processes and sends back information that seems shady, someone will probably figure it out and let people know.

Anyways it's interesting to think of measures and countermeasures, and it's important to point them out when someone tries to make shaky claims like "this system is unbreakable" (where there are ways around complex protections as simple as stealing a password from a person), but the way it usually works in practice is that things need to be only complex enough to make it impractical or undesirable to try.

[Swampthing]

Is the parser hosted anywhere else now that it is not on sourceforge? Why was it taken off of sourceforge?

[AzazaelFenrir]

Is the parser hosted anywhere else now that it is not on sourceforge? Why was it taken off of sourceforge?

See I would link to a thread with the details, but well you already posted in it....

What you didn't read the thread?

spoiler alert:
Check page 2!!!!

[Kaylia]

Malaquist: I meant the exit point. I know that Pol scans on boot, what I don't remember is if it's pol scanning on reboot after exiting ffxi or on exit of pol. (it's reboot 90% sure).

Either way, under current circumstance, there is no way they can detect it because FFXI process doesn't have such scan.

long text

Yeah, it's a cat and mouse game that can last forever, but the party who is trying to spy on your computer imo is at the low end in a case like this one . It's usually easier to find a way around the program, than make a program that cover every aspect. And like you said, many company who tried to implement something "bigger" ended up pissing off a ton of people. Your WoW example show it, but similar stuff happened to Rainbow 6 not too long ago with the 3rd party program it was installing.

and SE already -has- the overlying app. it's called pol. all of it is in place, and yes; a local client that's slaved to a server counts as direct access.

Except they aren't in control of the client application, and because of that, they can't do what they want to your pc. Direct connection =/= direct access.

[Swampthing]

Is the parser hosted anywhere else now that it is not on sourceforge? Why was it taken off of sourceforge?

See I would link to a thread with the details, but well you already posted in it....

What you didn't read the thread?

spoiler alert:
Check page 2!!!!

I thought I had read all the posts so far, I guess I missed the one with the useful information

edit: Nope, the answers to my questions are not on page two ; ;

Zhais said it was taken down, but not why, which was my second question. My first, is it hosted anywhere else, I guess was sort of answered in that it wasn't hosted anywhere two days ago. But it could have been sometime between then and now :\

But I also only just noticed divisor's sig...

DvsParse - A Final Fantasy XI Parser (run away from because I got caught)
Forum account deactivated 9/28/07 via admin request.

wtf x.x Caught for what?

[AzazaelFenrir]

since your on Fenrir I will play nice.

During the great Taj war of 2007 information that DivisorTheory bought gil for his Mandu was put out. Other things happened, people were upset, there was yelling, some crying, somewhere in there FFXI wiki screwed people over. Divisor decided to take his parser down (think he is walking away from the game as well). Currently the only way to get it, is to know a guy who knows a guy who killed a guy.

[Swampthing]

Oh..well.. in that case lol. Thanks. Boo for taking the parser down nonetheless though.

[Amele]

Yeah, it's a cat and mouse game that can last forever, but the party who is trying to spy on your computer imo is at the low end in a case like this one . It's usually easier to find a way around the program, than make a program that cover every aspect.

SE isn't interested in preventing hacking. SE is interested in catching cheaters: as such, they're playing a much simpler game; all SE has to do is find a way to detect the application that found a way around their program; and detecting an outside process touching your process space is trivially easy; since windows api's expose functions that let you monitor all interprocess operations.

and SE already -has- the overlying app. it's called pol. all of it is in place, and yes; a local client that's slaved to a server counts as direct access.

Except they aren't in control of the client application, and because of that, they can't do what they want to your pc. Direct connection =/= direct access.[/quote]

I think you and I have different ideas of what control means then. (control of the code base = control of the app. everything in a windows OS can be done programmatically.) So in a very real sense, yes; SE can do whatever they want to your pc; just not in real-time.

SE has an interest in preventing cheating, but probably very little interest in preventing things like a windowed mode. They also probably don't want to be known as a company that installs spyware.
I think something like that happened with some WoW process looking at the titlebar of all your windows etc. I forget the details, but it's a demonstration that If a game starts spying on all your processes and sends back information that seems shady, someone will probably figure it out and let people know.

right; I started my comment with the supposition that SE doesn't care about utility tools that don't modify gameplay. (heck, they may even bless UI modding with the new windowed mode depending on what they do with DX9: which is quite unnecessary for windowing as hundreds of pre-dx9 games show)

incidentally, SE has also equipped pol to scan all your running processes (I alluded to it once before) when this was first enabled, pol didn't seem to be sending the data back; but since I know of no one who is currently monitoring pol's packet behavior - they could very well be nowI doubt they are.

if you're curious about seeing it yourself, I recommend the free version of processguard (google it) the full version is probably worth the money too - but if you're just interested in a little peeking to satisfy curiousity; the free version is plenty.