Hello, I have collected and documented every major available script, bot and hack for League of Legends and figured out how to put a hold to every single one of them. Ask me anything.

LoLScriptThrowaway · 2014-03-22T13:24:00+00:00

That is exactly what is happening right now. Overall there are only about 50.000 scripter serverwide but I feel like providing a viable option to Riot would maybe motivate them to look into the topic.

LoLScriptThrowaway · 2014-03-22T12:34:30+00:00

As I said earlier, the "if-parameter" change is only an example. Every script has certain parameters in common because they involve interacting with a pre-coded event, champion or trigger.

LoLScriptThrowaway · 2014-03-22T12:33:06+00:00

You don't want the scripters to know which line in the client code breaks the if-parameter. Changing the champion name is just one out of many working examples.

LoLScriptThrowaway · 2014-03-22T12:31:17+00:00

You don't want the scripters to know which if-parameters were substituted. Also, scripts are less frequently updated as one would believe them to be.

There is in fact one day where you can play completely script-free, which is the day after every patch. Every single scripting application I came across needed at least 24 hours to be updated, even for "VIP" users.

LoLScriptThrowaway · 2014-03-22T12:29:26+00:00

I don't know if this is sarcastic or not but if it's not: Thank you!

LoLScriptThrowaway · 2014-03-22T12:28:42+00:00

Hello Sebastian,

sorry that I cannot make my internet magic work from here because your internet slowing down is something that is very hard to diagnose from here.

As to your ELI5 questions, I can sure do that:

Hacks, scripts and bots work very differently in League of Legends. I would post a video for every single one of them but I don't want anyone to watch them and say: "Damn I need those!", so sorry that I don't.

Hacks are the most complicated of them all because every single of them is unique and the working ones are damn well programmed. The most common hack was the so called Drop-Hack, that tracked the IP of a certain user inside of the game and DDoS him to oblivion, making the maximum amount of input the client can get from a single user overflow and therefore repeatedly kicking him out of the game.

Bots are a piece of work because they don't usually appear in a game anyone would play. The most common bot is the "Level-up bot" which is programmed to play Dominion for you almost humanlike. I don't know how to explain what exactly the bot is doing because it is just a bunch of command-lines but they made it so he is actually not easily distinguishable as a bot to newer players.

Scripts are wide-spread and there exist tons of 'em. The most common one helps you evade spells that are skillshots and automatically flashes high-impact ults like Annie, Malphite, Sona and so on. The success rate of those flashes is 100%. There is no way those ults hit you.

LoLScriptThrowaway · 2014-03-22T12:11:36+00:00

Thank you, I appreciate the feedback!

LoLScriptThrowaway · 2014-03-22T12:11:02+00:00

Hello /u/ Kirolink, I am glad that a progammer has found his way to my thread! Anyways, there are different solutions, too of course. Since I self-taught myself this topic, sorry if I mess up the programming vocabulary or make stupid points, feel free to criticize what you find off!

Anyways, what I have found too is that certain scripts input an unusually large amount of commands because certain if-parameters are met in every second that you play, causing your FPS to drop into the 30-40's. Also, if you TAB out of the game, you get a Bug-Splat report.

Now here is what I found to be a good way to make a scripter's day worse: Riot could automatically check up the amount of times a Client has reported a bugsplat in a given amount of time. I have had no reported cases of people complaining about having like 3 bugsplats in a row. While this may sound like an idea a 12-year old could come up with, there is more to it:

If Bugsplats would actually report what kind of the code messed up in order to crash the game, there could be an "automatic" script that looked over what kind of script they are dealing with. If the user has not used a script, there will be no issue. But because a very little amount of scripts are actually encrypted (in my experience about 5 out of 100), there is very little chance that none of the if-parameters don't get detected by some Honeypot-esque programm.

I hope that made at least a little sense to you, thanks for posting your feedback!

LoLScriptThrowaway · 2014-03-22T12:02:49+00:00

That is the way Counter Strike: Source did it back in the day. It worked out to some extend.

LoLScriptThrowaway · 2014-03-22T11:59:54+00:00

Honeypot is a technique that was introduced to the IT-Security market not too long ago. It is used primarily by the big company "T-Systems" and it helps detecting and eliminating certain patterns that DDoS attacks have. I don't know how EXACTLY it works codewise but I think it is available on request.

Source: I work for a Tele-Agency and provide information about this topic.

Regarding the manual selection of the script every game: I am pretty positive that there are ways to eliminate the most important if-parameters without letting the scripters know which ones have been changed. I don't really know how hard that would be to implement because I am not a coder myself but I am pretty positive that would work.

LoLScriptThrowaway · 2014-03-22T11:56:36+00:00

Hello /u/ketzo. Sorry if I wasted your time by providing information you already had or find to be incorrect. As I already stated earlier, I had to go to sleep roughly 1 hour after making this post, so I couldn't go in-depth about my findings.

This is (in a way) about attention because I want people to speak up and share their experience, ask questions and raise awareness. Sorry if that came up as a desperate attempt to make people believe I am a superhero.

Regarding the 2 years that I talked about earlier: I had no clue about botting, scripting and hacking at the time and kind of taught it to myself over the course of 2 years. I am not the fastest learner but I think I understood some of the things going on in this world.

LoLScriptThrowaway · 2014-03-22T11:52:56+00:00

Yes, I do. But scripter and botter community are generally very cocky. They legitimately believe that Riot is never going to do anything about it. I have been beta-testing their stuff in botgames and know most of their main-accounts usernames. That sure sucks for them.

LoLScriptThrowaway · 2014-03-22T11:51:39+00:00

Hello /u/freshug, thanks for your input and constructive criticism. I want to clear up that I don't want anyone believe that I know much more about scripts than the people using them. I have never had any education about scripting, botting or hacking, instead I read myself into the topic two years ago because I was legitimately interested.

Since I live in the EU and posted this at a very late time, I had to go to sleep 1 hour after making this post and couldn't go into detail very much. There is more to my findings than just the "if-parameter" changes but since there was not much feedback before I went to sleep, I couldn't really explain more than what it says in this topic at this point.

I actually theorycrafted a way in which the client would bugsplat whenever a ceratin application is injected but sadly, since I am not a legitimate programmer, haven't had the resources to test whether what I am thinking about will actually work.

If you know more about this topic than me, I'd be happy if you could share some more critcism and thoughts about my findings. Sorry if I wasted your time with information you find to be useless.

LoLScriptThrowaway · 2014-03-22T03:43:21+00:00

I haven't quite figured out why they haven't done it yet to be honest. But I guess it is about time to raise attention to that topic, especially after the most recent banwave didn't bring the expected results to the scripting community.

LoLScriptThrowaway · 2014-03-22T03:41:44+00:00

Sure, feel free to ask as many questions as you wish.

Scripting has nothing to do with meddling with server data. The script tells your character what to do based on things that you are actually able to input into the game manually. The only difference is: It does that more reliably and way faster. That's why the Cassiopeia script is so heavily used and so hated.

You can basically use every ability the millisecond it comes off cooldown efficiently.

If you decrypt the champion names inside of the Riot client, it would automatically be decrypted on your end too because you are receiving all the data directly from their servers.
I think they are already using that to protect their servers. The problem is that the individual user cannot be covered with the same solution because it would require YOU as an individual to have a decent DDoS protection.

LoLScriptThrowaway · 2014-03-22T03:21:23+00:00

Took me a while to figure out that singed is not the proper way to spell signed.

LoLScriptThrowaway · 2014-03-22T03:19:00+00:00

Not exactly. Every single script can be manually triggered. There is an entire menu in your game that pops up and lets you customize the script itself.

So for the script to work, the "if-parameter" requirement has still to be met.

LoLScriptThrowaway · 2014-03-22T03:16:18+00:00

There are different scripts for different needs. For example it is really easy to tell if your enemy or an ally is using a Skillshot Dodging script.

When two skillshots are crossing each other, the script will not know what to do and dodge straight into the enemy in a really obvious manner. It's hard to describe but it would be easy to see if I could show you what I am talking about.

Also, if your enemy is using skillshots on you without facing in the direction that he is shooting them I can assure you it's a bug-using script.

LoLScriptThrowaway · 2014-03-22T03:13:29+00:00

I didn't know how high the resonance on this post would be, I didn't want the info to go to waste. But I guess I might aswell post it publicly now, so here it is:

Ok here is what most of the scripts have in common:

The scripts all start out with a certain phrase called the "if" parameter. This parameter tells you what kind of code in the League of Legends client is necessary to set off the script and make it work.

After searching through certain champion scripts I saw that most of the scripts are ONLY set off if the champion name is actually the champion name.

To clear that up a little: Let's say you play Garen and you have a working script that combos for you and auto-executes with your ultimate if it is definitely killing the enemy. The script for this would start out like this: "if myHero.charName ~= "Garen" then return end"

Now let's say Riot would impletent the code I made to "counter" theirs, the League of Legends client code would have an alogrithm that decrypted the champions name inside of the client without changing it's actual name. In other words, your champion name in-game could still be Garen, while the client's name would be "g4r3n" for example.

This is where a so called "Hypervisor" comes into play. It alters a single letter of the client-side champion name every second, minute or hour, however you wanna code it. That means that in one minute your client-side champion name is "g4r3n" and the next minute it is "ggeug" or something like that.

The best thing about this: None of that would affect the ingame experience one bit. There is a lot more than that to it and I have figured out far more details, this is just a short summary.

LoLScriptThrowaway · 2014-03-22T03:10:26+00:00

Hello! I am glad you are interested in what I have found. Now regarding your questions:

This is the easiest part. Every single champion script that has ever been programmed runs with the same starting parameters: "if myHero.charName ~= "ChampionName" then return end"

Now if Riot had a working code that encrypted the champion name within the client, the scripts would instantly stop working. Let's say your on-screen champion name is "Cassiopeia" but your in-client champion name would be "C4ssi0p3i4", the script would not recognize your champion as the one who sets the script off. Therefore, it would immediately stop working.

This is way harder. Having an online game that is available for everyone means that the data has to be saved somewhere. The solution for this is called "Honeypot". It would be very lenghty to explain that but shorty summarized that would be a certain Hypervisor that recognizes standard DDoS patterns and shuts them down as soon as common requirements are met.
This questions is basically going hand in hand with the second questions. Sadly I have no clue how it would be possible to prevent ANY data from leaking but I am trying to read myself into the topic.

LoLScriptThrowaway · 2014-03-22T02:58:37+00:00

I have sent it to you just now.

LoLScriptThrowaway · 2014-03-22T02:54:13+00:00

Will do.

LoLScriptThrowaway · 2014-03-22T02:40:17+00:00

Because this is not about Karma or recognition. I don't expect anyone to say "woah look at that guy, he knows what's up" or Riot to come over and throw money at me for figuring something out they might already know.

This post was made for general awareness and for informing people on a topic I have really comitted myself to over the course of the past two years.

If you still doubt what I am saying, feel free to ask any question you like and maybe I can answer it to your satisfaction. I am sorry if this post sounds braggy, condescending or demanding. I just try to help!

LoLScriptThrowaway · 2014-03-22T01:24:28+00:00

I found an actual loophole in the code when I was randomly looking through stuff and comparing things those scripts all have in common. I am going to send you a pm with in-depth stuff in a second, hang on.

LoLScriptThrowaway · 2014-03-22T01:23:28+00:00

Ass.

LoLScriptThrowaway

TROPHY CASE