anti pk bot

im sure you all know what the pk bot is, has alot of nice hack features ive made a small script to catch most of them "some have fixed bots" but most of the pk bots say something in chat, which in all the cluttered letters it says w.k25.com

ive made a simple perl script that greps world2.chat and looks for dwAuAGsAMgA1AC4AYwBvAG0APgA
which in base64 it means w.k25.com

it searches for dwAuAGsAMgA1AC4AYwBvAG0APgA and copies them over to a file named cheat.txt that file is then moved to the root folder to be read at a later time, i use mine with cron and its a bit more complicated than this but heres the script for those that want to play around with it and explore more, im also going to work on a script that translates all log files to english or sort the cluster of symbols to make them readable.

its nothing special just for fun and maybe help others with it.

cd /PWServer/logs
grep -e 'dwAuAGsAMgA1AC4AYwBvAG0APgA' world2.chat > cheat.txt
chmod 777 cheat.txt
perl -npe 's/src=/player /g' cheat.txt
mv /PWServer/logs/cheat.txt /root/
echo "Cheaters Logged."

modify this and run it which ever way
if you name the file cheat.sh and place it into the root folder just type in terminal
./cheat.sh
simple as that again its not as complicated as the one i made but it works

a thanks to robb for giving us an example on how to catch dupe, without him i wouldnt have looked up sed.
a thanks to das for showing me perl is better than sed xD.

Quote:

---

Originally Posted by softsoldier

a thanks to das for showing me perl is better than sed xD.

---

When did I say that? .-.

You pretty much just used perl -npe instead of sed...

I do somewhat remember saying that Perl was designed to be a text parsing language though...

Quote:

---

grep -e 'dwAuAGsAMgA1AC4AYwBvAG0APgA' world2.chat > cheat.txt

---

fail...

Quote:

---

Originally Posted by wikipedia

Base64 encoding converts 3 octets into 4 encoded characters.

---

you might miss a lot of those statements because they actually might look completely different because of different prefixes. only a letter more before the searched string can fuck up the whole detection.
A more clean way would be using the awk line processing functions or perl to convert the base64 to readable characters and grep over the output to get the most useful result.

maybe sed can do the job too, im not sure

thats quite process intense.
Theres normally 3 or 4 words before and after the "w.k25.com" which is given out by the program.

If anything we should expand the base64 to include 1 of these words either side, that way we wont get "man im sure this guild is using the w.k25.com bot" and could even make the process automatically ban people using mysqlimport command.

Using the script i found quite a few that say "<2><w.k25.com><2:0>" so it does work and can be refined further.

As for it being converted in multiples of 3, im not even sure you can put prefixes on the chat it gives out. Even if you can we just have to fine the base64s of the 3 multiples and grep 3 times.

well you get

Code:

---

chat : Chat: src=7056 chl=2

msg=qgChADwAMgA+ADwAdwAuAGsAMgA1AC4AYwBvAG
0APgA8ADIAOgAwAD4AuAD8ANAAwgBQAEsAuQDSADIA
LgA1ADYAsADmAKoAoQA8ADIAPgA8AL8A1QDWANAAsg
C7ALwA9QC5AKUAuwD3AKMArAC/ANUA1gDQALcAwADT
APkAvADTALEAtgCjAKwAywCyALwA5AC8ANMAtQDjAK
EA

---

id probly grep the world2.logs > cheat.txt
after all the transfers is finished, grep cheat.txt and try to convert everything after msg= to readable text for easier reading.
i did have a few people saying something like using the trumpet
i wasnt sure if i should have added the <2><w.k25.com><2:0> to it,
anyways after im done with a few things ill upgrade it and see what happends.

my point is, that depending on what the text before w.k25.com looks like, the base64 encoding for "w.k25.com" may be completely different based on the way base64 works.

I don't think you can change the text before it.

The only problem with importing the lines into the forbid table for automatic banning is the date/time section. I cant get it to split up the way i want it to, needs some text formatting command.
Unless theres a way to import a file into mysql using a procedure?

you can produce mysql query strings with some awk pattern matching functions... complicated stuff but it is possible i think

That seems like a very long way around a kinda small problem.
All i need is the first comma in the each removed.

Edit: managed it with sed -i 's/,//'

Ok, doesn't quite display the reason correctly as im not sure how to plug binary in from a .csv-like text file but all the same it does work.

Code:

---

cd /PWServer/logservice/logs
grep -e 'dwAuAGsAMgA1AC4AYwBvAG0APgA' world2.chat > forbid.chat
chmod 777 forbid.chat
sed -i 's/ /,/g' forbid.chat
sed -i 's/=/,/g' forbid.chat
sed -i 's/,,,/,/g' forbid.chat
sed -i 's/,,/,/g' forbid.chat
sed -i 's/msg/100,345600,Autobanned for using k25 hack,32/g' forbid.chat
sed -i 's/,/ /' forbid.chat
mysqlimport -u root --local --force --columns=ctime,@x,@x,@x,@x,@x,@x,userid,@x,@x,type,forbid_time,reason,gmroleid,@x --fields-terminated-by=, dbo forbid.chat
rm forbid.chat
echo "Hackers banned."

---

Change /PWServer/logservice/logs to your log folder if its not the same.
Change 345600 to the duration to ban for.
Change 32 to the GMroleid you want to name for the ban.
Change dbo to your database name if its not dbo.

Obviously this shouldn't be used by people who don't reset their log files every so often as the log files will just get huge and cause lag when you try to use any script on them.

Enjoy and improve if necessary.

this software not work on my client. lol

Somebody could easily replace ur clients exe with one that works with this program though.

ok nice work rbb, im assuming this wouldnt work too well with cron, unless it ignores previously recorded id's and stuff, i didnt even know the forbid table could be used for banning, i just assumed it was a broken peice of the server.

if you run it when you reset your log files it can be done with cron.

if not then it will do a few more queries than it needs but do no harm due to the primary key.
might be some bugs though.

ill touch it up, to my needs, thanks, its funny sed didnt work in the past for me but now it works with no errors.

id probly make it run like every 30 mins and backup current logs like i did with my database backup
of course for those that dont have one "i just bought a second server"
heres a script for a nice backup

Code:

---

#!/bin/sh
echo
echo "copying gamedbd"
cp -r /PWServer/gamedbd/dbhomewdb /root/backup/
echo
echo "copying uname"
cp -r /PWServer/uniquenamed/uname /root/backup/
cd /root/backup/
echo
echo "compressing backup"
tar -cvf backup.tar dbhomewdb
tar -cvf backup.tar uname


HOST='server ip ftp'
USER='username'
PASS='password'
FILE='/root/backup/backup.tar'


ftp -n $HOST <<END_SCRIPT
quote USER $USER
quote PASS $PASS
put /root/backup/backup.tar /backup`date +-%H:%M:%S--%h_%d_%Y`
quit
END_SCRIPT
exit 0

---

its a nice and simple script for backing up the database for most servers, id probly do the same for the logs
i bought a webhost server it has unlimited diskspace, bandwidth and database's no hidden fee's so far 1and1 ^^ and im using every last bit of it why let it go to waste am i right? xD

edit it to your needs of course

Quote:

---

Originally Posted by rbb138

Somebody could easily replace ur clients exe with one that works with this program though.

---

i have unique script to grep any bots from server side, before i banning 10-20 players for 1 days. 1 years tested

ah forget it, you can try this

wisper

/asdfksdfsdf test
asdfksdfsdf is offline

and you will not get chat log xD

Quote:

---

Originally Posted by rbb138

That seems like a very long way around a kinda small problem.
All i need is the first comma in the each removed.

Edit: managed it with sed -i 's/,//'

Ok, doesn't quite display the reason correctly as im not sure how to plug binary in from a .csv-like text file but all the same it does work.

Code:

---

cd /PWServer/logservice/logs
grep -e 'dwAuAGsAMgA1AC4AYwBvAG0APgA' world2.chat > forbid.chat
chmod 777 forbid.chat
sed -i 's/ /,/g' forbid.chat
sed -i 's/=/,/g' forbid.chat
sed -i 's/,,,/,/g' forbid.chat
sed -i 's/,,/,/g' forbid.chat
sed -i 's/msg/100,345600,Autobanned for using k25 hack,32/g' forbid.chat
sed -i 's/,/ /' forbid.chat
mysqlimport -u root --local --force --columns=ctime,@x,@x,@x,@x,@x,@x,userid,@x,@x,type,forbid_time,reason,gmroleid,@x --fields-terminated-by=, dbo forbid.chat
rm forbid.chat
echo "Hackers banned."

---

Change /PWServer/logservice/logs to your log folder if its not the same.
Change 345600 to the duration to ban for.
Change 32 to the GMroleid you want to name for the ban.
Change dbo to your database name if its not dbo.

Obviously this shouldn't be used by people who don't reset their log files every so often as the log files will just get huge and cause lag when you try to use any script on them.

Enjoy and improve if necessary.

---

Injecting it straight to the forbid table can have serious downsides, it can also cause issues when banning players as the ban may not be lifted, also if the player is logged in they wont be force logged and again can cause issues with the ban system. Best bet is to make a new table called "ban" or whatever and have a java applet that reads the ban table and uses the forbid class which also kicks the user out of the game and safely injects the data.

Quote:

---

Originally Posted by nofxpunkerbrian

Injecting it straight to the forbid table can have serious downsides, it can also cause issues when banning players as the ban may not be lifted, also if the player is logged in they wont be force logged and again can cause issues with the ban system. Best bet is to make a new table called "ban" or whatever and have a java applet that reads the ban table and uses the forbid class which also kicks the user out of the game and safely injects the data.

---

Code:

---

LogInfo info = null;
GMService gs = new GMServiceImpl();
info = new LogInfo(character, "", "Ban of the Role(anti-pk-bot)");
gs.forbidRole((byte)100,32,-1,character,40,"You have used cheats",info);

---

using that in jsp will do a proper ban with kickout where 100 is the forbid type, 32 is the banning GM and character is the charid/accid, depending on forbid type.

the loginfo will automatically be sent to logservice and can be found in your logs later.

Ah almost forgot, 40 is the time in seconds

Quote:

---

Originally Posted by rbb138

That seems like a very long way around a kinda small problem.
All i need is the first comma in the each removed.

Edit: managed it with sed -i 's/,//'

Ok, doesn't quite display the reason correctly as im not sure how to plug binary in from a .csv-like text file but all the same it does work.

Code:

---

cd /PWServer/logservice/logs
grep -e 'dwAuAGsAMgA1AC4AYwBvAG0APgA' world2.chat > forbid.chat
chmod 777 forbid.chat
sed -i 's/ /,/g' forbid.chat
sed -i 's/=/,/g' forbid.chat
sed -i 's/,,,/,/g' forbid.chat
sed -i 's/,,/,/g' forbid.chat
sed -i 's/msg/100,345600,Autobanned for using k25 hack,32/g' forbid.chat
sed -i 's/,/ /' forbid.chat
mysqlimport -u root --local --force --columns=ctime,@x,@x,@x,@x,@x,@x,userid,@x,@x,type,forbid_time,reason,gmroleid,@x --fields-terminated-by=, dbo forbid.chat
rm forbid.chat
echo "Hackers banned."

---

Change /PWServer/logservice/logs to your log folder if its not the same.
Change 345600 to the duration to ban for.
Change 32 to the GMroleid you want to name for the ban.
Change dbo to your database name if its not dbo.

Obviously this shouldn't be used by people who don't reset their log files every so often as the log files will just get huge and cause lag when you try to use any script on them.

Enjoy and improve if necessary.

---

i have try this and working perfect at my test server

I just was bored and noticed that your version does have a lot of disk I/O, you can reduce that greatly with that:

Code:

---

cd /PWServer/logservice/logs
grep -e 'dwAuAGsAMgA1AC4AYwBvAG0APgA' world2.chat |sed  's/ /,/g'|sed  's/=/,/g' |sed  's/,,,/,/g' |sed  's/,,/,/g' |sed  's/msg/100,345600,Autobanned for using k25 hack,32/g' |sed  's/,/ /' >forbid.chat

chmod 777 forbid.chat
mysqlimport -u root --local --force --columns=ctime,@x,@x,@x,@x,@x,@x,userid,@x,@x,type,forbid_time,reason,gmroleid,@x --fields-terminated-by=, dbo forbid.chat
rm forbid.chat
echo "Hackers banned."

---

im not sure, but maybe you can even pipe the strings directly to mysqlimport and get around using the harddisk at all

we got SSDs so its not something i though about :x

my solution is better

// With this ID you get in linux shell
tail -f world2.chat | grep --line-buffered "dwAuAGsAMgA1AC4AYwBvAG0APgA" | awk '{print $8}' | tr -d 'src=' >>/log.txt &

Make a program to read the log file and you can use parameter cool.
getting ID you play in a jsp to ban real-time

log.txt ->
http://"+ipPort+"/iweb/k25.jsp?id=


No need to use SSD: x

Quote:

---

Originally Posted by rbb138

That seems like a very long way around a kinda small problem.
All i need is the first comma in the each removed.

Edit: managed it with sed -i 's/,//'

Ok, doesn't quite display the reason correctly as im not sure how to plug binary in from a .csv-like text file but all the same it does work.

Code:

---

cd /PWServer/logservice/logs
grep -e 'dwAuAGsAMgA1AC4AYwBvAG0APgA' world2.chat > forbid.chat
chmod 777 forbid.chat
sed -i 's/ /,/g' forbid.chat
sed -i 's/=/,/g' forbid.chat
sed -i 's/,,,/,/g' forbid.chat
sed -i 's/,,/,/g' forbid.chat
sed -i 's/msg/100,345600,Autobanned for using k25 hack,32/g' forbid.chat
sed -i 's/,/ /' forbid.chat
mysqlimport -u root --local --force --columns=ctime,@x,@x,@x,@x,@x,@x,userid,@x,@x,type,forbid_time,reason,gmroleid,@x --fields-terminated-by=, dbo forbid.chat
rm forbid.chat
echo "Hackers banned."

---

Change /PWServer/logservice/logs to your log folder if its not the same.
Change 345600 to the duration to ban for.
Change 32 to the GMroleid you want to name for the ban.
Change dbo to your database name if its not dbo.

Obviously this shouldn't be used by people who don't reset their log files every so often as the log files will just get huge and cause lag when you try to use any script on them.

Enjoy and improve if necessary.

---

Code:

---

root@ubuntu:/PWServer/logs# mysqlimport -u root --local --force --columns=ctime,@x,@x,@x,@x,@x,@x,userid,@x,@x,type,forbid_time,reason,gmroleid,@x --fields-terminated-by=, db_user forbid.chat
mysqlimport: Error: 1045 Access denied for user 'root'@'localhost' (using password: NO)

---

help :mellow:

Quote:

---

Originally Posted by TheBow

Code:

---

root@ubuntu:/PWServer/logs# mysqlimport -u root --local --force --columns=ctime,@x,@x,@x,@x,@x,@x,userid,@x,@x,type,forbid_time,reason,gmroleid,@x --fields-terminated-by=, db_user forbid.chat
mysqlimport: Error: 1045 Access denied for user 'root'@'localhost' (using password: NO)

---

help :mellow:

---

-.- it doesn't get easier then that...

Quote:

---

Originally Posted by Ozuru

-.- it doesn't get easier then that...

---

:?: help pls

TheBow, saying help wont get you anywhere you gotta be specific and oz lol some people dont install mysql-client to their servers "dunno why" but it happends.

Quote:

---

Originally Posted by softsoldier

TheBow, saying help wont get you anywhere you gotta be specific and oz lol some people dont install mysql-client to their servers "dunno why" but it happends.

---

-.-'

All of the daemons that have seperate -client and -server packages all require the -client for the -server...

So yes, everyone does have it if they installed the server...

with 1.4.4 the ban system is different, it doesn't depend on forbid table anymore so for banning you will have to look into GRoleForbid class in Java and create something from that.

Quote:

---

Originally Posted by nofxpunkerbrian

with 1.4.4 the ban system is different, it doesn't depend on forbid table anymore so for banning you will have to look into GRoleForbid class in Java and create something from that.

---

my server 1.3.6 :*:

Quote:

---

Originally Posted by TheBow

my server 1.3.6 :*:

---

use 1.4.5 :thumbup:

Quote:

---

Originally Posted by hrace009

use 1.4.5 :thumbup:

---

:lol: i don't have.. send to me :P:

Quote:

---

Originally Posted by TheBow

:lol: i don't have.. send to me :P:

---

search it!

Quote:

---

Originally Posted by hrace009

search it!

---

:D: impossible.. need contact for real file