Feature Spoof system

[Night Wolf]

Dear all,

I've seen several servers using spoof systems throughout those years and it made the otservlist react to it making it better and better within time. We still have lots of tutorials out there, specially for older versions, that can be easily converted to newer TFS.
Despite being very controversal, below I'll share with you a code that allows you to spoof otserverlist. It was made by a very skilled programmer that worked with me and it's highly customizable. My goal by sharing this is to invite the community to re-think how our lists works and see if @xinn will be able to come up with any alternative solution to identify how servers should rank in his list.

How does it work?
This fakes the information that is sent to the port that broadcasts amount of players online, which means by using this and configuring it correctly you may show 5K players when in fact your server only has 1 person online, making you be at top of otservlist (yeaaa, free advertising without being scammed in XX euros).

What you need to configure:
It's all in config.lua so you can easily turn on/off but I wouldn't recommend you to change that much, the default values I'm showing here are what worked for us for about a year without being caught. Yes, that's right.. if you ever paid to advertise in otservlist you probably ranked below my fake server.

-- Spoof
spoofEnabled = true -- turn on/off the system
spoofDailyMinPlayers = 40 -- the minimum amount of players that will show (real + spoof)
spoofDailyMaxPlayers = 150 -- the maximum amount of players that will show (if real > than this number then the spoof will automatically turn off)
spoofNoiseInterval = 10 * 60 * 1000 -- delay to insert a noise in our data, this is to confuse the otservlist algorithms and approaching the spoof curve to a real player growth
spoofNoise = 10 -- size of noise in the maximum amount of spoofed characteres
spoofTimezone = -1 -- this is to make a higher chance of increasing the spoof number in peak hours and higher chance of decreasing outside of it. Configure accordingly to your timezone in comparison to GMT.
spoofInterval = 120000 -- spoof number will change once every spoofInterval milliseconds
spoofChangeChance = 70 -- 100% of the updates will change the spoof number
spoofIncrementChange = 3 -- 1 out of spoofNoise requests will decrement the value. Also known as the chance to growth.

The whole system can be found in this branch:

Adding spoof system · andersonfaaria/[email protected]

Allows you to fake online players number in otservlists.

github.com

 

[gudan garam]

I'm pretty sure otservlist would be able to detect that instantly.

The status protocol will for sure send the spoofed amount of players online, but you can't forget the fact that there is an opcode on the status protocol that outputs the entire list of players online (their name and level).

What you are doing here is saying, hey there are 1200 players online, on two requests that the status protocol returns this information, but on the other hand, there is a request that returns every online players name and level, and that will be lower than the 1200 you just returned.

Am I missing something?

 

[Caduceus]

So how many otservlist list bans are pending, due to this post.

 

[zxmatzx]

So how many otservlist list bans are pending, due to this post.

Unfairly? I think not a single one...

 

[Night Wolf]

I'm pretty sure otservlist would be able to detect that instantly.

The status protocol will for sure send the spoofed amount of players online, but you can't forget the fact that there is an opcode on the status protocol that outputs the entire list of players online (their name and level).

What you are doing here is saying, hey there are 1200 players online, on two requests that the status protocol returns this information, but on the other hand, there is a request that returns every online players name and level, and that will be lower than the 1200 you just returned.

Am I missing something?

Someone just told me that on discord but I find it hard to believe that they check this info as well, as I said, we used this for almost a year and did not get banned.

Post automatically merged: May 6, 2020

Worst case scenario you just need to generate randomly fake levels and randomly summing a level in them

 

[gudan garam]

Someone just told me that on discord but I find it hard to believe that they check this info as well, as I said, we used this for almost a year and did not get banned.

Post automatically merged: May 6, 2020

Worst case scenario you just need to generate randomly fake levels and randomly summing a level in them

Well, I'd imagine they'd check that, holy.

I guess otservlist is just a way of its owner to make a few bucks every month xD

Also, there are a few resources here on otland that, if combined with this, could result in a fully working spoofing system.

 

[Night Wolf]

I guess otservlist is just a way of its owner to make a few bucks every month xD

Who would imagine, right?

Post automatically merged: May 6, 2020

Also, there are a few resources here on otland that, if combined with this, could result in a fully working spoofing system.

let's combine efforts and make this happen, that way we can make a PR in forgottenserver to be even more alike global.
Cipsoft have implemented spoof years ago

 

[gudan garam]

Who would imagine, right?

Post automatically merged: May 6, 2020

let's combine efforts and make this happen, that way we can make a PR in forgottenserver to be even more alike global.
Cipsoft have implemented spoof years ago

My mind trying to proccess this:

let's combine efforts and make this happen, that way we can make a PR in forgottenserver to be even more alike global.
Cipsoft have implemented spoof years ago

yes!
wait...
what??
what the hell
oh I get it HAHAHA

I'm high, sorry

 

[Onimusha]

nice work, i gonna use it to bring my server to the top list in the first day

 

[Zainox]

@Night Wolf but if this system give to you fake players online. Whats happen when a player visit your site and see your "who is online"?

 

[Night Wolf]

@Night Wolf but if this system give to you fake players online. Whats happen when a player visit your site and see your "who is online"?

you can edit your own site to pick the info of REQUEST_PLAYERS_INFO instead of REQUEST_EXT_PLAYERS_INFO

 

[PuszekLDZ]

just put it 4 fun to check, at my "test server" - and it not working
otservelist.org - nope
otslist.eu - nope
ots-list.org - nope


edit: how much time it will take? maybe thats a problem im testing it for 1h now

 

[Night Wolf]

just put it 4 fun to check, at my "test server" - and it not working
otservelist.org - nope
otslist.eu - nope
ots-list.org - nope

It may be the cache or because I've tested it last year, perhaps they have changed by now to check also in REQUEST_EXT_PLAYERS_INFO in protocolstatus.cpp as @gudan garam said.
In that case what you will need to do is to create a table to generate random names/levels to output along the real players. To make it more realistic, it would be good to randomly giving levels to some of those people and perhaps even saving this table to database to avoid a check between days.

if (requestedInfo & REQUEST_EXT_PLAYERS_INFO) {
        output->addByte(0x21); // players info - online players list

        const auto& players = g_game.getPlayers();
        output->add<uint32_t>(players.size());
        for (const auto& it : players) {
            output->addString(it.second->getName());
            output->add<uint32_t>(it.second->getLevel());
        }
    }

this is the part where it outputs the players and levels.

 

[PuszekLDZ]

It may be the cache or because I've tested it last year, perhaps they have changed by now to check also in REQUEST_EXT_PLAYERS_INFO in protocolstatus.cpp as @gudan garam said.
In that case what you will need to do is to create a table to generate random names/levels to output along the real players. To make it more realistic, it would be good to randomly giving levels to some of those people and perhaps even saving this table to database to avoid a check between days.

if (requestedInfo & REQUEST_EXT_PLAYERS_INFO) {
        output->addByte(0x21); // players info - online players list

        const auto& players = g_game.getPlayers();
        output->add<uint32_t>(players.size());
        for (const auto& it : players) {
            output->addString(it.second->getName());
            output->add<uint32_t>(it.second->getLevel());
        }
    }

this is the part where it outputs the players and levels.

can You show me how to do that "table" with random players?
im rly curious of that spoof

or just show me the way to that what to follow

 

[Night Wolf]

std::unordered_map<std::string, uint32_t> spoofPlayers;
spoofPlayers["Night Wolf"] = 20

now you just add another for below the real one to output this info


for (auto it : spoofPlayers) {
output->addString(it.first);
output->add<uint32_t>(it.second);
}


That's just an example to explain you the mechanics, but you'll need to add those 'random' players in the void Game::updateSpoofPlayers()
and get this table info in protocolstatus.cpp

 

[leuofiridia]

Let supercharge it!
TODOs:

• Make the spoof players evolve over time, even "killing" some of them and losing levels, this stuff
• Integrate on Gesior/MyAcc, including showing random registered accounts with fake brazilian/latin american or poland/sweden names on the character info page.
• respond to exiva inside the game
• Accept money transfer and parcels

 

[oen432]

Let supercharge it!
TODOs:

• Make the spoof players evolve over time, even "killing" some of them and losing levels, this stuff
• Integrate on Gesior/MyAcc, including showing random registered accounts with fake brazilian/latin american or poland/sweden names on the character info page.
• respond to exiva inside the game
• Accept money transfer and parcels

Create fake accounts and characters (now you can parcel and transfer money to them), every few minutes (crontab) run PHP script that will add EXP, change items, add deaths, maybe even change outfit once in a while. Then add these characters to this spoof system.

Good luck telling apart fake and real players.

 

[Mister Budex]

OTLand community should help newbie OT hosters to find useful scripts & systems which would make players game play more interesting, it should give instructions how to setup the server and website and not to teach them how to fake players with some random systems by adding its online players which would leand to OTServlist banishment, Xinn is more then 10 years developing its site most of his tools are for tracing spoofers and you're teaching newbie how to spoof it ? what a shame

 

[Night Wolf]

OTLand community should help newbie OT hosters to find useful scripts & systems which would make players game play more interesting, it should give instructions how to setup the server and website and not to teach them how to fake players with some random systems by adding its online players which would leand to OTServlist banishment, Xinn is more then 10 years developing its site most of his tools are for tracing spoofers and you're teaching newbie how to spoof it ? what a shame

You totally missed the point bud(ex) (couldn't hold myself to this one lol); otserverlist is the face of servers because it's the oldest and usually the only page most of players look too. Xinn had the chance to improve it (many chances actually) but he choose to completely ignore the community and force everyone that wanted to use his list to follow his rules or to adapt their sources. (you can check this discuss further on this thread): Very important - Rules change on otservlist.org (https://otland.net/threads/very-important-rules-change-on-otservlist-org.247531/)

My goal by sharing this is not to destroy otserverlist but rather to point it how failed is the list design that we rely on.
For @xinn , he'll probably make a new rule or make another post saying that now who wants to use his list will need to send the unique ip addressed, names and level, but this is fakeable as well. No matter what he does, we will understand how it works and fight back.
The maxim in 'information security' is: if your protection relies in people not finding out how your code works, then you can already throw it away.

He could put effort into changing this, in ranking servers by votes that is a information he would have control of, but no. He forced people to adapt and follow his rules otherwise get banned. Part of the reason why open tibia is being considered dead is also a symptom of the completely arbitrary bans he have been doing in otservlist. If everyone starts using this, otservlist will adapt or die, and then we can move on to better alternatives.

 

[oen432]

Xinn is more then 10 years developing its site

Please, this site is lacking updates for years, all that Xinn is doing is just taking money for ads and banning servers.