The confessions of a Final Fantasy XI hackerFollow

The confessions of a Final Fantasy XI hacker.
---------------------------------------------

I haven't told anybody about this until now, but I'm quitting FFXI now, and figure I might as well...

I'm the guy sitting at the Qufim Island cliffs all day, pulling up Black Sole. I'm the guy clearing the AH of all the under-value items. I'm the guy sitting in Jeuno 24/7, crafting the same synth over and over.

It started when I heard of these "botters" that didn't have to be near their computer to make gil. I became fascinated by the fact that an individual could make gil without doing anything, and began to research various scripting languages. From that point on, my FFXI career was based on making money doing "nothing."

My research lead me to find scripting languages like AutoIT and ACTool. My first few attempts at scripting were failures. With no scripting/programming experience, I had initially decided that I wast best of using scripts created by other more-experienced individuals. It wasn't long before I ran into a FFXI botting community (forums.cameroncole.net). The ACTool scripts there were all open-source, and fascinating to read through. The idea that a program could read pixels on the screen, and perform procedure based on what it read was fascinating. After viewing the source code of several others' scripts, I eventually managed to put together my first bot: the Auction House camper/scroller. There were two ways to use the script... You could "camp" a single item with it (bidding a low amount on a single item every [xx] seconds) or "scroll" a category (bidding [xx] gil on every item, which would allow you to snatch any underpriced items posted by players looking to make a quick sale).

I used all of the common fishing bots, NM hunting bots, synthing bots, etc. for a while but eventually became more greedy, and wanted more gil at a quicker rate. I started playing around with memloc editors any packet sniffers. I sat in various areas, playing around with the software... trying to figure out how to do anything interesting. My first small find was the ability to ride a chocobo anywhere. I would edit the Playerstatus memory location to contain the value '33'. This would trick the FFXI client into thinking I was on top of a chocobo, and would allow me to have a constant flee effect at any time. I used this trick to hunt treasure chests for a while but that was mainly a novelty.

I continued messing with my memloc and packet sniffing tools for about a month. One day while idling in Jeuno, I noticed something strange in my inventory: a piece of furniture called "." with +0 storage. Initially, I wasn't sure what it was or how it got there, but I eventually realized it had somehow gotten there from the memloc editing I was doing. I tried to figure out what exactly I had done to receive the item, but had no immediate success. A few days later I was in Sarutabaruta, and I tried setting my Playerstatus value to 6; the is the value for 'fishing'. Nazaar casted his fishing rod, and I soon received the message "Something caught the hook!". What could it be? I had no bait or rod equipped, but something bit my hook? I tried reeling in, but got the message "Your rod broke". It was disapointing, but I tried again in hopes of catching some kind of rare fish. I repeated this for a good half hour or so, but the rod broke every time. I wasn't too disappointed, as this was just another one of my many failed attempts at finding anything interesting.

Eventually I noticed that there were now several "." furnishings in my inventory. Along with the "." furnishings were several random beds; everything from Bronze to Royal (The Royal Bed sells for 2 million on Garuda)! I realized that the strange items were coming from fishing without a fishing rod.

I asked a friend to watch me while I fished with no equipment, but he only saw me standing. I set my Playerstatus to '33' to run around on my chocobo, and he asked "How are you fleeing as WHM?" Not only was my hack quick and simple, but it was also completely safe! I didn't have to worry about being reported by Vana'Diel's vigilantes.

I immediately started working on a script that would keep setting my Playerstatus to '6', and would reel in if something caught the hook. Within an hour, I had a fully working bot. I would sit in Port Jeuno for hours on end; casting my invisible rod, and fishing up expensive beds. For months, I inflated the economy by selling the beds to the Duty-Free vendor in Port Jeuno.

I heard of an upcoming update that would make the fishing system more complicated. Reading the Playonline website, I saw that the fishing system was in fact being entirely re-worked, and that players would now have to actively fight fish before being able to reel them in. I had a feeling that one of two things would happen once the update went live: It would either close the hole and leave me with nothing or possibly open up something even better. I wasn't going to take my chances so I built up a stockpile of furnishings. I had nearly 100 Noble's and Royal beds in my inventory before the update.

When the update went live, I was anxious to see how it would affect my hack. I downloaded the update as soon as I could and immediately went to Port Jeuno to test the hack. The results were disappointing. Square Enix had unintentionally patched the hole. My money making days were over.

At that point it was too troublesome to go back to the legitimate way of making gil.


Many of you will think this story is just BS, and I don't blame you. I'd probably think the same if I were you. I've taken some screenshots of some items, for anyone in doubt. Have a look:

http://www.gamerszion.com/ffxi_hacked/1.gif - One of my Gold Beds. I was the first person to ever view this bed in-game. Search for it in the Allakhazam item search.

http://www.gamerszion.com/ffxi_hacked/2.gif - Gold bed again.

http://www.gamerszion.com/ffxi_hacked/3.gif - Gold bed again.

http://www.gamerszion.com/ffxi_hacked/4.gif - Throwing away one of my "."s

http://www.gamerszion.com/ffxi_hacked/5.gif - I don't remember how I did this. I just saw it in my screenshot folder.

http://www.gamerszion.com/ffxi_hacked/6.gif - Selling my Royal Beds on the auction house.

http://www.gamerszion.com/ffxi_hacked/7.gif - Dismounting my chocobo in Jeuno.

http://www.gamerszion.com/ffxi_hacked/8.gif - "." shows up in the "Item" section of my auto-translate.


Anyway, not much reason to post this except to amuse and entertain. Perhaps some of you will find it interesting.

Thanks for all the good times in Vana'Diel, and /farewell.

-Ron (Formerly Garuda's Nazaar)

Edited, Aug 18th 2009 6:05am by Nazaar

Just sad >< I sometimes wish this game was only on ps2 so there would be no cheaters . All the bots , tricks, scams all invlove people on PC version of the game .

Although I understand why you did this ( if it is indeed true ) , it really sucks for all the people you screwed over by it . I know for you the challenge was in beating the system and testing your computer knowledge rather than playing the game . I just hope in the future you think of others you hurt while doing things like this and use your computer skills for good instead of evil :p

Hackers are not "Hackers" Crackers are bad. Hackers or Hacks are not malicous.

it's story like this makes me don't wanna farm anymore...whether it's real or not i just feel stupid going to farm hours and hours just for for 10-20k or camping some stupid NM while some people found a easy way and have unlimited gil to spent on already ridiculous expensive item.i really want to know what's the reason for quitting the game since you have billions and billions of gils.(i assumed)maybe you could sell all the gils to IGE you can make a fortune.

Eh...posts and players like this make me cry at night when I go to bed.

Wow, I'm rather surprised that SE does not even attempt to detect third parties tempering with the memory! I can only hope that others don't find out new ways to exploit this fact, which woud turn it into another Diablo II... X_x That game was a mess of hacked/duped items until the 1.10 patch.

I might have to start writing SE, pushing them to start implementing detection methods. I am already getting angry enough at those campers that use packet sniffers or whatever to find and claim their prey so easily.

Wtf? FFXI for the console is easier to hack cause you just have 32 megs of ram to look around in, AND the memory addresses don't move around as much. The PC is a PITA, ffxi takes up 300-350 megs of ram, thats just the start of it..... God I hate noobs that post on forums.

Back to topic at hand..


That is where you went wrong and I can't blame you. There are people who don't cheat that run into the same trap. I remember when I was leveling monk in the mid 40s and there was sooo much gear I just _had_ to have... Getting home from work to farm 5-10 hours was like working two jobs at once.

I just came to accept that luxary items were going to be expensive, and I wasn't rich :) I think when I hit 75 my total net worth was less than a million at least.



No you won't be the first and you won't be the last, you are not that special I can guarentee. This is the second place you went wrong, you used your God given talents for your own misguided means.



I don't see your adventure into world of 'nix to be much better than this one. See, if you miss the point of computer security and take advantage of it for your own gain they have a place for you.. prison.

The whole goal with this sort of thing is called full disclosure. Money in ffxi relates to real life money due to RMT. So you you are obligated to two groups of people and are obligated to do two things when you find an exploit.

To meet your obligated to SE, the first thing you do is call a GM and report what you found.

Your second obligation is to us, the players, to force SE to fix it. Software companies typically have a track record of being lazy about fixing security issues. The only way to force them to fix problems is to threaten going public with your information. Tell the GM or person you report to they have 30 days to fix the problem before it is reported.

I'll give you a chance to redeem yourself. I don't wanna violate allakhazam's policies here so if I overstep my bounds in what I say feel free to edit this last part of my post administrators. Just understand what I am about to say in of itself doesn't make an exploit. Japanese people use such an exploit on my server as a matter of fact, and the only way to stop them is for NA players to figure it out and start doing it too. Once NAs abuse bugs, things get fixed.

You gotta find what I call the mapLoc, it contains monsters x y cordinates and their heading and a bunch of other junk. It is pretty easy to find, you just search for the monster index, monster id, monster name. This will also be the higest occurance of the monsters name in memory. Usually in the 1000:0000 - 3000:0000 range.

Let me run out to west saru real quick and get you an example. There pointers that point to it.. but at this time all it would do is help noobs write voke bots, and finding that is a lot harder than finding this so.. And the best part is, this information all changes/become invalid the moment you zone or relog so..

Looking at a Tiny Mandragora mobindex 06h, mobid 01074006h

 
     
    01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16  
00  70 EB B8 03 A6 D7 B6 C2 C2 CB 9D 3F 8E C9 1A C4 
10  00 00 80 3F 00 00 00 00 45 F1 0E 40 00 00 00 00  
20  00 00 80 3F 79 29 B8 C2 F8 9A 9E 3F A8 FE A1 C4 
30  00 00 80 3F 00 00 00 00 45 F1 0E 40 00 00 00 00  
40  FF FF FF FF 00 3E 8E BC 66 7E 2E 39 00 E0 B2 BC 
50  01 00 00 00 00 00 08 42 00 00 00 00 00 00 00 00  
60  FE 82 F3 43 06 00 00 00 06 40 07 01 54 69 6E 79 Tiny 
70  20 4D 61 6E 64 72 61 67 6F 72 61 00 00 00 00 00 Mandragora 
80  00 00 00 00 00 00 00 00 00 00 80 40 00 00 80 40 
90  20 D4 95 1E 
 

As you see the mobindex is at 65h, mobid is at offset 69h, and the mobs name in normal ascii right after at 6dh.

The interesting part to note is what you see at offset 90h. People have noticed for some time that only exist when the monster is alive.

What that is, is a pointer that points to a datastructure that only exists when the mob is instanced. If the mob vanishes that pointer goes to 0. There is all sorts of mobs in memory that are not instanced like dead HNM and even world shifter NPCs. The structure points to information that contains what model the monster is, what it is doing, etc.

So in theory, lets say you found a crawler in the maze or a NM that spawned in a really small area where you could see it pop without seeing any other mobs around it?

Write a script that reads that pointer 10 times a second until its not null, and have it start spamming a /targetnpc /ja "Provoke" <t> macro. Now to make this interesting make sure your screen resolution is at 256x256, turn off sound and all effects/chat filters, virus scanner, background programs etc.. If you are on wireless disconnect and plug straight into the cable modem.

My testing method is a little crude... but I think the results are valid sort of...

There is a delay on hitting ctrl or alt before macro palette comes up.. so its important that you are already holding down ctrl or alt when your macro starts spamming 7 or whatever. Make sure it sleeps exactly 0.1 or 0.05 seconds so you can measure.

First test for me was hitting that macro every 0.1 seconds on crawlers. I would see..

>> /ja "Provoke" <t>
...A command error occured.

If I saw 3 of them I assumed the delay was .3 seconds, if I saw 7 I assumed .7 seconds.. The thing about it is though.. my macro may be spamming but as you all know SE misses macros so.. Its possible the delay was longer. I did the same test by bringing provoke up on the JA menu, and counting there.. It seemed to either give less error messages or it can target the mob faster :P

Either way.. there is a delay between when my computer knows about a monster and I can target it. That delay is a LOT longer than network delay, in fact if I could make that delay 0 I would beat every NM spawn on everyone that wasn't cheating every time. (Wow, omg, some people do win NM spawns everytime, no matter who is there?)

What about HNM... my first test was on King Behemoth. The results here were TOTALLY suprising. My script failed on him and I didn't understand why...

You know, the normal, 100 people in behemoth's dominion all standing real close, receive buffer maxed and so forth.. King Behemoth spawned RIGHT IN FRONT OF ME. I saw an entire SCREEN full of

>> /ja "Provoke" <t>
...A command error occured.

But I didn't see any messages saying my target was claimed... I didn't understand.. two seconds of spamming the macro wasn't long enough? You mean from the moment my client knew about King Behemoth it took over two seconds before I could target it?

My machine isn't slow folks.. p4 2.8ghz, 512 megs of ram, geforce4, etc.. I was even at lowest possible resolution. Playonline config tool tells me my latency is 160ms to pol.

I have two theories on the subject.

First theory is that we receive two sort of updates from SE. A pulsed update that happens a few times a second that includes a very limitied amount of information, just x,y cordinates of monsters and players in the area. I think the second type of packet is more of a streaming nature that includes what something looks like and what it is doing. The more lag in an area the more going on, the highest the difference between the two types of updates. If this is so, it is trival to fake that information for the purpose of making the monster targetable ASAP.

The other possiblity is SE instead just says... spawn this mob at 10:00 vanadiel time.. and in that case its trivial to beat that..

Anyway, help me figure this out man. SE won't do anything. These people have been reported almost every day for months and no one does anything. I mean, all it takes is on GM to stand there and SEE the HNM spawn claimed to know.. but they don't care. Even if we dont' get a working exploit, if other people try my test above and get consistant results maybe the common knowledge will get someone at SE thinking.

Its possible this is even a bug that only happens on NA ffxi for whatever reason. Who knows.

If true then that's incredible, and sad.

I would like to applaud you, but it wasn't right to continue doing it once you realized that you could make so much profit.

You didn't even have to sell the item, you could have simply thrown it away and left with the satifaction that you knew you could do it, that's really all that you were after anyway.

I agree with the post earlier that you will not be happy in a life where you do this all of the time.

PS. Pretty smart though, kinda reminds me of that movie "Catch Me if you Can"

Sounds alot more like a script kiddy than a hacker... Reguardless, kinda lame.

Wow, Bleach! Hahaha, nice e-pee pee! You da man.

*opens Bleach's locker, gives him a high five, stuffs him back in the locker and closes the door*

Good luck in the dark bedroom of your life.

Hypocritical, to say the least.

What have you accomplished by saying any of that? You were trying to put another person down, and then you yell at them for putting someone down.

You know, you could have just left the first part of your post, without all the meaningless, hypocrital, demeaning banter, and it would have actually been an informative post.

If you want to contribute at all to this community, don't post crap like that, it sure as heck doesn't help your image, nor does it help the community.


~Drakko

Edited, Fri Apr 8 11:04:08 2005 by ANTDrakko

That's what hackers do. They show their "superiority" over everyone else by breaking the rules of whatever they happen to be doing. These l33t skills can include, but are not limited to: being morbidly obese, living in one's parents' basement, and perpetual virginity.

Also:



I wouldn't brag about that too much. If u want to test graphical latency u should upgrade to a Dx9 card to cut the rendering time of the mobs down. See what the actual difference is between when the server pops a mob and when we actually see it pop.


Wth are u hackers doing posting here, don't u know the lines Episode 3 started yesterday. You've already lost the best seats; better get going.

Edited, Fri Apr 8 11:25:48 2005 by MrBojanglesJr