How to find cheaters in GS logs (shadowbug/trade dupe)

In light of helping Mu community in the battle with cheaters, I share the strings I use to find cheaters in my servers.

Enter your GS logs and search for theese strings:

Before using Jewel of Soul : [Box
[Box Of Luck] [Ser
shadowbug box (kundun+1 => kundun+2 mostly)

Before using Jewel of Bless : [Ring
[Ring of Ice] [Ser
[Ring of Poison] [Ser
shadobug ring (exc. ring +0 => exc. ring +7)

Before using Jewel of Bless : [Invi
[Invisibility Cloak] [Ser
shadowbug cloak (bc) (BC1 => BC6)

Before using Jewel of Bless : [Devil
[Devil Square Invite] [Ser
shadowbug invitation (ds) (DS1 => DS4)

Return, because trade canceled while it's not [in-trade1]
it's a notice that something funny might be happening, sometimes accidently happens so check logs for more

error-L3 : pTransaction(1) status error
it's a 100% sure trade dupe, ban/delete both accounts

I'd like comments and more strings.

EDIT: with red is if you're using standart english .wtf file, green if using UberMU .wtf file, the dupe log is similar in both .wtf files

Thank you!!! Very Good Guide

I'm glad to hear that :) First day I started looking for shadowbug I banned 155 accounts!!! And that's only for Shadowbugging BOX! I didn't look for shadowbugging invitations, cause i didn't want to bann everyone on my servers..

dont hav a more easy way?

don't think there are a more easier way instead if someone comes up with a programm to find them like the dupe check program , at least i think ^^

Quote:

---

Originally Posted by murckan

don't think there are a more easier way instead if someone comes up with a programm to find them like the dupe check program , at least i think ^^

---

Mmmmm...

I know a bit about JAVA programming and such a tool would be both extremely usefull and easy to write... I'll think about it...

For now, I'm just very happy with those strings, great work! :thumbup:

just mind that you don't load the whole log into the ram, cause i'd hate to load 350MB .txt files into 250MB free ram..

Quote:

---

Originally Posted by murckan

don't think there are a more easier way instead if someone comes up with a programm to find them like the dupe check program , at least i think ^^

---

DaRKav's log analyser does it fine.
and StrEagle, nice guide ;)

its good idea.. but its not automatically..
Some server have automaticlly ban the users and block they vaults :D

Quote:

---

Originally Posted by StrEagle

just mind that you don't load the whole log into the ram, cause i'd hate to load 350MB .txt files into 250MB free ram..

---

Thats what they invented swap file for. Well, swap file and HEX editors ofcourse, which can easily load a 300Mb file :icon6:

Darkav's analyser would be great too, but haven't seen that one around here unfortunately..

And -=PsyKick=-: great, thank you so much for sharing that with us. Now, how the fuck does that help us? If you don't provide any insight in how they do it, why comment?

Frag STFU BITCH

Here is a simple fortran program I wrote to read logs. Basicaly it searches for specific text string in text files. It can process a 300MB in seconds. It can be used to check logs for any game. I used it to check MU logs only. The .rar file includes the code in fortran, the compiled .exe, instructions in spanish and in english with some sample searches (LOGS MIGHT BE VERSION DEPENDENT!!!).

For example: search for all jewels of bless that are used then I open the file with excel and specified spaces as column separators that way all serials were in the same column!!!! Then order by serial and you are done. You can do this for souls, life, boks, medals etc.

You can also search for all times a item was created in the machine. Check for duplicate items being made +10/11/etc or wings creation.

To track items serials: Just put the serial number and see every time the item is traded, used in the machine, sold to NPC, etc. Very good to track items that are stolen by hackers.

Hope you enjoy it.

Image PC Routine Line Source
LOGREADER2.exe 0040F9E9 Unknown Unknown Unknown
LOGREADER2.exe 0040F801 Unknown Unknown Unknown
LOGREADER2.exe 0040E9D4 Unknown Unknown Unknown
LOGREADER2.exe 0040EE3D Unknown Unknown Unknown
LOGREADER2.exe 00407EFA Unknown Unknown Unknown
LOGREADER2.exe 004022F9 Unknown Unknown Unknown
LOGREADER2.exe 0042D0A9 Unknown Unknown Unknown
LOGREADER2.exe 00424844 Unknown Unknown Unknown
kernel32.dll 77E7EB69 Unknown Unknown Unknown

Not working.

NOMBRE DEL ARCHIVO A REVISAR (INPUT FILE)
20050629_Mu97_1.txt
PALABRA 1 QUE QUEREMOS BUSCAR (STRING 1)
CBMix
PALABRA 2 QUE QUEREMOS BUSCAR (STRING 2)
Used box of ElradoraBox
OPCION DE BUSQUEDA (0=PALABRA 1, 1= PALABRAS 1 Y 2, 2= PALABRA 1 Y NO 2, 3= PALABRA 1 Y/O 2) (SEARCH METHOD)
1
NOMBRE DEL ARCHIVO DE SALIDA (OUTPUT FILE)
search.txt

What is incorrect there?!

Quote:

---

Originally Posted by dnb

Image PC Routine Line Source
LOGREADER2.exe 0040F9E9 Unknown Unknown Unknown
LOGREADER2.exe 0040F801 Unknown Unknown Unknown
LOGREADER2.exe 0040E9D4 Unknown Unknown Unknown
LOGREADER2.exe 0040EE3D Unknown Unknown Unknown
LOGREADER2.exe 00407EFA Unknown Unknown Unknown
LOGREADER2.exe 004022F9 Unknown Unknown Unknown
LOGREADER2.exe 0042D0A9 Unknown Unknown Unknown
LOGREADER2.exe 00424844 Unknown Unknown Unknown
kernel32.dll 77E7EB69 Unknown Unknown Unknown

Not working.

NOMBRE DEL ARCHIVO A REVISAR (INPUT FILE)
20050629_Mu97_1.txt
PALABRA 1 QUE QUEREMOS BUSCAR (STRING 1)
CBMix
PALABRA 2 QUE QUEREMOS BUSCAR (STRING 2)
Used box of ElradoraBox
OPCION DE BUSQUEDA (0=PALABRA 1, 1= PALABRAS 1 Y 2, 2= PALABRA 1 Y NO 2, 3= PALABRA 1 Y/O 2) (SEARCH METHOD)
1
NOMBRE DEL ARCHIVO DE SALIDA (OUTPUT FILE)
search.txt

What is incorrect there?!

---

Let's see:

* Are all files (input, output and code) in the same folder?
* Did you compile the code yourself or you just run de exe?
* If you just run the exe what system are you running it? I compiled the code in a AMD XP 2400+ with with Windows XP. The code was also tested by other people using different PC on WXP.
* If you compiled the code what compiler are you using? I used the compiler included in Compaq Visual Fortran (F90). From what I could google on the error message this seems the most likely cause of the error. Apparently F95 compilers are more restrictive when it comes to READ/WRITE than the old F90. Did you get any other message, something like "input conversion error, unit 1 or 2"? I'll try to compile the file with a F95 compiler later and see if the same error pops up.

Quote:

---

Originally Posted by FragFrog

Thats what they invented swap file for. Well, swap file and HEX editors ofcourse, which can easily load a 300Mb file :icon6:

Darkav's analyser would be great too, but haven't seen that one around here unfortunately..

And -=PsyKick=-: great, thank you so much for sharing that with us. Now, how the fuck does that help us? If you don't provide any insight in how they do it, why comment?

---

Hi FragFrog, DaRKav has a "trial"version for download (20 loads)
cant remember the link though ^^ I didnt get it myself, i use my own
crappy xls creation ^^

Look at his site for it

/Keep

http://www.wingrep.com

Try that program to search multiple large files.

hehehe your killing yourselves for the string search program. how about using the built-in command in the OS. "FIND" then dump the results to a text file.

OOO.. how come i havent seen this before.. lolz.

now all everyone needs is a good Search and replace tool. (???) i mean those text file searchers which searches massave amounts of files in a folder and subfolder for phrases or egrep syntax...

this would be a nice topic to follow if people started to post egrep statements.. for searching hackers and stuff.

btw: hackings skills i had one of those.. command line search and replace files. but deleted it.. if it is command line u can output it to a file by using the msdos TYPE command

actually i've been using this "FIND" since day 1 of my server. its quite handy since you can filter file or files then directly dump the result to a separate file so that you can further scrutinize them. this file can search through text files quite fast. for further help, just go to DOS prompt then type "find /?" for the command details.

btw, you can output the result to a file by adding this string at the end of the command line ">> output.txt" double arrow means "append to file" single means "replace existing file"

Quote:

---

Originally Posted by HackingSkills

hehehe your killing yourselves for the string search program. how about using the built-in command in the OS. "FIND" then dump the results to a text file.

---

So many things we still have to learn. Wish I knew this one before. Still wingrep does just that.

Using the FIND command as suggested by HS you can try the following:

FIND /I "after using jewel" *.log >jewels.txt
FIND /I "used box of" *.log >boxes.txt

Then open the txt file with excel and select spaces as column separators. Then sort by serial number. And find your jewel and boks dupers.

To find items that are used more than once in the Chaos Machine use this one

FIND /I "cbmix" *.log >machines.txt

But note that for some combination types you can use an item more than once if the combination fails.

To track items stolen from a hacked account do this:

* Search logs for hacked account name (account not character name).
* Get serial for stolen items.
* Search for serial items to track them after n numbers of trades.

thx bro

for those who dont know how to find the lines...

download the Attachament file extract anywhere do right click "edit" and edit the "<LOG NAME>.log" at the end of the line, input the log name close, save, and execute, after executed this show you the names of the duper, go and ban him!

Quote:

---

Originally Posted by karak

for those who dont know how to find the lines...
download the Attachament file extract anywhere do right click "edit" and edit the "<LOG NAME>.log" at the end of the line, input the log name close, save, and execute, after executed this show you the names of the duper, go and ban him!

---

error-L3 is not only generated when dupping. For example I go and I want to trade with some one who is AFK and the trade gets canceled due to time-out, I try to do this several times then the logs will show a L3 error and I didn't dupe anything.
Or as I have seen, your friend gives you a bless and then you want to give it back to him but he refuses to accept it so he cancels your trade requests. No dupe and error-L3...

Have you seen the LAMB?:thumbup:

Lamb?

Quote:

---

In light of helping Mu community in the battle with cheaters, I share the strings I use to find cheaters in my servers.

Enter your GS logs and search for theese strings:

Before using Jewel of Soul : [Box
[Box Of Luck] [Ser
shadowbug box (kundun+1 => kundun+2 mostly)

Before using Jewel of Bless : [Ring
[Ring of Ice] [Ser
[Ring of Poison] [Ser
shadobug ring (exc. ring +0 => exc. ring +7)

Before using Jewel of Bless : [Invi
[Invisibility Cloak] [Ser
shadowbug cloak (bc) (BC1 => BC6)

Before using Jewel of Bless : [Devil
[Devil Square Invite] [Ser
shadowbug invitation (ds) (DS1 => DS4)

Return, because trade canceled while it's not [in-trade1]
it's a notice that something funny might be happening, sometimes accidently happens so check logs for more

error-L3 : pTransaction(1) status error
it's a 100% sure trade dupe, ban/delete both accounts

I'd like comments and more strings.

EDIT: with red is if you're using standart english .wtf file, green if using UberMU .wtf file, the dupe log is similar in both .wtf files

---

cool thanks pro

NICE, tks

For trade dupe, this error appears this:

[528]00:22:01 [boladao23][iyan] error-L3 : pTransaction(1) status error C:\Work\
WebZen\░╘└╙╝

This is trade bug?

[fortaleza][-=KINGS=-] error-L3 : pTransaction(2) status2

and how to find hack speed in Log?

does anyone know wat error-L2 means?

my server is a 97d+99 version. dupe is only error-L3 ptransaction(1). in my server, more than 3 lines i ban the user. for erase items dupped, i use antidupe.

heh notepad even cant open mu .log files since they ari biger than 1gb

how do we find speedhack or auto kill? and what program is the best to open big txt file>>

how do we find speedhack ? say pls

Quote:

---

Originally Posted by StrEagle

In light of helping Mu community in the battle with cheaters, I share the strings I use to find cheaters in my servers.

Enter your GS logs and search for theese strings:

Before using Jewel of Soul : [Box
[Box Of Luck] [Ser
shadowbug box (kundun+1 => kundun+2 mostly)

Before using Jewel of Bless : [Ring
[Ring of Ice] [Ser
[Ring of Poison] [Ser
shadobug ring (exc. ring +0 => exc. ring +7)

Before using Jewel of Bless : [Invi
[Invisibility Cloak] [Ser
shadowbug cloak (bc) (BC1 => BC6)

Before using Jewel of Bless : [Devil
[Devil Square Invite] [Ser
shadowbug invitation (ds) (DS1 => DS4)

Return, because trade canceled while it's not [in-trade1]
it's a notice that something funny might be happening, sometimes accidently happens so check logs for more

error-L3 : pTransaction(1) status error
it's a 100% sure trade dupe, ban/delete both accounts

I'd like comments and more strings.

EDIT: with red is if you're using standart english .wtf file, green if using UberMU .wtf file, the dupe log is similar in both .wtf files

---

Can u post your wtf file? To compare here

how to find hack speed in Log? please say :((((((((((((((((((((((((

I think, only true config CommonServer.cfg (Speedhack block and etc.) than search with MuLogAnalyzer Line "Speedhack" =)
Really i don't know (

i use this

Code:

---

find /N "error-L3 : pTransaction"

---

instead of this. error-L3 : pTransaction(1) status error


are they the same???!?

http://forum.ragezone.com/attachment...dupe-trade.jpg