Blizzhackers

I see a lot of posts relating to botting risk and everybody seems to have a different answer. In an effort to reduce/eliminate these posts, I have gathered information pertaining to all known bots/hacks/exploits from my own experience and the experiences of others. I will try to update this list as best I can.

Warden Activity (1.0.3b):
Offset Scanning (checking for modified game code)
Signature Checks (Hooks/Injection/DLLs within D3 memory space)

ZoiD: "The whole thing is a joke, it would have been a better use of resources to show a dialog box asking 'Do you hack? (Y/N)'. Because only an idiot with no understanding of basic computing could ever be banned by the current warden. The only thing that stops people from figuring this basic crap out is the fear that warden is still the big scary beast it originally was."

Programs (Clientside Risk):
DemonBuddy - Injection, Paid, Medium
HellBuddy - Injection, Paid, Medium
Immortal Bot - Injection, Paid, Medium
AutoIt/AutoHotkey - No Injection, Free, Low
Cheat Engine - Memory Reading/Writing, Free, Low (reading) - Medium (writing)

Botting Activity (Serverside Risk):
AH Botting - High
Sarkoth Gold Farming - Medium
Core of Arreat Gold Farming - Low
Infinite Exp (ZK) - Medium
Iskatu Exp Farming - Low
Lt. Vachem Exp Farming - Low
Potion Farming - Low
AFK Crafting - Low

Other:
Trade Scamming - Low
Maphack (Memory Reading ONLY) - Low
UNID Item Parsing - Low
Speedhack - Medium
Gear Swapping - Low
Screenshot Generator - Low
WASD Project - Low
Post Processing/Overlays - Low

Legend:
Low - Little or no reported bans, future detection unlikely
Medium - Some bans for this activity/program, future detection possible
High - Several bans for this activity/program, future detection likely

Myth:
Randomization/Delays decrease the chance of getting banned
Warden is scanning your PC for running programs outside of Diablo's memory space
Diablo Warden is just as good as WoW Warden
It is possible to bot the AH without getting banned

Truth:
Every program/activity in this post is technically bannable
If you write a bot, Blizzard is coming (R.I.P. D3A, mmBBQ, D3Adventure, others...)
Botting is the reason most of us continue to play
It is (was?) possible to make a lot of $$$ by botting the AH
You will be relieved when you're finally banned

Tips:
Paid bots typically have higher GPH than free bots
Longer runs (Core of Arreat) are likely safer than shorter runs (Sarkoth)
Main accounts have been spared in many circumstances even when botting accounts are banned (both botting)
Your WoW/SC2 Account will NOT be banned if your D3 account is
Write your own scrips/profiles or modify existing ones...it's easy, fun, and you might actually learn something!

Conclusion:
Warden isn't doing much right now, so most of the banned botters couldn't have been detected client side. Blizz seems to be banning based on easily calculable serverside activity, including: queries/time (almost guaranteed for AH bots), max gold collected, max gold/time played, games/time, exp/time, max games created, elite kill total/time, etc. I personally think they are simply calculating your total gold earned/time played (every bot I know of is powerleveled and then immediately put to work), where any value over 200k total gold/hour is flagged and then monitored more closely for specific botting activity (most players are banned while botting). This could also explain why mains/mules are being spared...those are the accounts that are actually used to do OTHER things, so their total gold/time is below the threshold. AFK/reconnecting bots might be worthwhile if true.

Can definitely use some more info on Warden if you guys have it

There's not much to say. ZoiD is spot on in that Warden is about as basic as it gets right now. As far as I can tell from looking at it very quickly it gets loaded from Blizzards servers encrypted, it uses their own "custom" library format called BLL2 which is basically a PE32 translation. The client receives a request from the server, loads the warden module at an arbitrary address, then calls an export in it with the request from the server. The current warden module iterates through every piece of mapped memory. SHA1 hashing, using some seed, a number of bytes at offsets requested by the server. The hashes are then truncated to 32 bit and passed back to Blizzard. Blizzard then associates your account with these hashes. There's another scan mode that generates an XOR of the read data and some seed sent by the server. Right now I've only seen this one module. Although it supports 3 "different" commands.

I looked at it for 15 minutes before I got bored. What the warden module actually does can change at any time. If you're using private stuff you don't have to worry about Warden.

Nice list! *+1 rep*

I think no. Got several ppl in my fl with more than 800 h playtime & > 380 M collected.

Warden is scanning your PC for running programs outside of Diablo's memory space

wait this is a myth? i thought it was a standard feature to run hashchecks on popular bots. granted itd require some effort on blizzards part to keep up with the latest bots to do this so i can see how it COULD be a myth...

From what i know, they WOULD do it, but aren't allowed anymore because people sued, because this behaviour can be categorized as spyware.

oh good... so i dont have to worry about my userland bot being flagged now


anyway thanks for this post... it reduced much of my warden ignorance