TG Daily interview: Chat with a World of Warcraft bot programmer

  • Earlier this month, we ran a preview of an exclusive interview with Mercury, a developer of a World of Warcraft bot - a cheat program to accelerate the player's progress within the game. In this full interview, Mercury talks to TG Daily editor Humphrey Cheung about his motivation to create WoWglider, how it works and avoids detection, and his future plans for the bot.

    TG Daily: Were you an avid World of Warcraft player before writing the program - and what inspired you to write it?

    Mercury: Definitely. I'm one of the many lifelong Blizzard game owners out there. I started with Warcraft and have played all of their titles. When WoW was finally released, I got it immediately and I've been a fan since. The inspiration behind Glider was really what it's for now - to catch up to level 60 without spending so much real time. I'm in a small guild and my guildmates reached 60 while I was still in the mid-50's. I wanted to get to 60 as well to come along on the instance runs, but I had no time to grind it out between work and social life. When I did finally log in for a few hours on weekends, it was frustrating to see them orgranizing pickup groups for Scholomance and the Blackrock dungeons. I'd be off killing Shardtooth Bears and Crystal Rumblers solo. The original version was very unstable and simplistic, but it allowed me to get my warlock up to 60 pretty fast.

    My Canadian guildmates knew what I was up to and they encouraged me to turn it into a more well-rounded product so I could sell it. After I showed a few friends the rough version, they all collectively badgered me into marketing it. I promised my guildies that if I sold enough copies of Glider, I'd fly up to Toronto and buy them a round of beer, which I plan to do in January.

    TG Daily: Did any other programs give you inspiration or a template for developing Glider? Where did you learn the programming skills required to write the program and is Glider a full-time gig?

    Mercury: None in particular. I ran across a few tools that did some game automation, but nothing struck me as very professional. This was back in April, mind you, and things have changed a bit. But even then, our idea was to use my technology and my partner's marketing/design to position it as a very professional, clean app. So avoiding links to "hax0rs!!11" sites and keeping the design clean was the closest we had to a template.

    As for my own skills, I've been a full-time developer forever. I started with C, switched to C++ when it came out - that should date me - and just went from there. It doesn't take an enormous amount of talent to make something like this, but you do need to have a solid understanding of software development in general, like understanding business needs, prioritizing issues, source control, and so on.

    And, no, Glider's not a full-time gig. I've lowered my contracting hours to have more time for Glider, but it's still not making that kind of money. A big part of Glider is still the fun factor of working with the game and the users on our forums.

    TG Daily: How popular has Glider been? Do you have any estimates on how many times it has been downloaded?

    Mercury: It's been fairly popular, but not a huge, smashing success. In other words, I've never had to get more bandwidth or upgrade my small server. Without looking at the logs, and I don't want to reveal hard numbers, I'd swag it's been downloaded for evaluation around 3000 to 5000 times since the hard launch in late July 2005.

    How does WoWglider work?

    TG Daily: How does the program detect a mob and kill it? Are there areas in the game where Glider works very well and others that it doesn't work well? I can imagine that instances and mobs that do spellcasting or stunning might be a problem.

    Mercury: Glider finds monsters in the game just by reading the program's memory, which changes from patch to patch. When it finds something that it wants to kill, from your instructions, it sends keystrokes and mouse input into the game. It reads memory to see your health and mana, the monster's health, what it's doing, et cetera. It works pretty much you would, pressing keys and moving around in response to what's happening in the game. So it'll rotate to the monster, press Tab, see if the monster got targeted, then start casting spells.

    As the fight goes, it keeps an eye on things and acts just like you: it'll use Hamstring when monsters get low if you want, it'll use Shield Bash if they start to cast spells, etc. It doesn't do anything you wouldn't be able to do, like find stealthed monsters or teleport or anything like that.

    And, yeah, certain monster types and areas are very problematic for it because it's not as smart as a human. Stuns really ruin some classes and effects that move you, such as fear-casting banshees or punting Silithus snakes, wreak havoc on it, since it simply sees the distance between you and the monster increase and thinks the monster is running away, not you.

    In keeping with the original reason for designing it, we don't worry that much about those monsters. The whole point of Glider is to get a character to 60 with minimal effort. So if those demon-summoning healer stun-caster guys are too tough, then go find some bears and wolves to kill. It's a tricky balancing act to keep Glider growing in a good way, but not try to make it the be-all, end-all tool that can magically wreck anything. There's a real human (hopefully!) picking the areas and monsters to work, so pick some good ones.

    TG Daily: I know just enough programming to get myself into trouble. Does Glider shoot keystroke information into the WoW program or does it throw it into the operating system, which then goes into the client?

    Mercury: Yeah, just into Windows. Injecting input into the game is more detectable and also creates more opportunity for an abnormal situation that could be detected as side-effect. For instance, the game client could simply ask Windows which application currently has the input focus while processing a keystroke. If that window is not the game, then it knows right away that there's some serious funny business going on.

    TG Daily: In your experience, does Blizzard change the memory locations with every patch?

    Mercury: Yes, but this isn't intentional. Any time you change a lot of code or move things around, the physical locations in memory change. It's a non-issue for the developer, since your compiler and linker take care of that for you. But for somebody looking in on the outside, it creates work. It would be convenient for them to provide an API that we can call to get pointers to the structures we need, but I have a feeling that it won't happen soon. ;)

    Avoiding Detection

    TG Daily: One of the things I've see with bot programs is that they try to appear more human (to lessen the chance of being banned). What are some of the technical measures that Glider tries to do?

    Mercury: Avoiding detection is rather exciting, to be sure. Since Blizzard does not want bots running at all, it's a violation to use them. Detection is cleanly divided into two methods: software and human. Avoiding human detection is fairly difficult because, let's face it, if another player gives Glider a Turing test in the game, it's not human. Rather than attack that problem at its strength (I'm a big Art of War fan), Glider tries to attack it at its weakness by not causing a player to become curious at all.

    We try to add little mannerisms here and there, like jumps and random strafing and bits of randomness to combat. For instance, if you tell Glider to use the Bloodrage skill with your warrior, it will sometimes use it before shooting the gun, sometimes after. If it's charging, it'll sometimes use it after the charge - and sometimes not at all. We try our best to make it not set off that first curious look from another player, but it's very difficult.

    Of course, a good part of avoiding player detection is, ironically, detecting players. Just like if it was your 10-year old nephew, Glider will alert you if there is another player following around for too long. So you can configure to play a sound clip at high volume so you can come and investigate - or simply log off. When it comes to suspensions or bans, discretion is more than just the better part of valor.

    TG Daily: How difficult is it to stay one step ahead of Blizzard? Also, can you empathize with the GMs who try to catch botters?

    Mercury: Staying one step ahead of Blizzard is just about impossible because you never know what they're going to do next. The technical nature of the game is that the Warden, which is where Blizzard's hack-detection code lives, is dynamically updated. The code itself doesn't even exist in the game client, but is sent down when you connect, just like your spellbook is. Given that agility and the fact that the game can update any time on a regular or hotfix patch, it's tricky. With all of the focus on the Warden lately, it wouldn't surprise me at all if Blizzard decided to bury a few simple checks in the game code itself. Some clever engineering would make that virtually impossible to find, as nobody can disassemble the entire enormous game client. XOR a few values together to make disassemblers miss the pointer reference and you've got some very stealthy flag-setting happening in the guts of, say, an item trade. So we have to make sure that Glider won't get picked up by anything that simple, which means we can't do a lot of things, like putting code into the game directly or altering its data structures.

    For us, staying ahead is really about the business decisions for Blizzard. What we do is figure out what's easy for them to detect, such as by changing a simple parameter in the Warden or adding a small bit of code. Then we make sure Glider is not detected as passively as possible, such as using regular Windows security to limit the game's access or randomizing process names. The trick here is that Blizzard has a finite amount of development and test resources, so we want to make it bad business to spend that much time altering their detection code to find Glider, since Glider's negative effect on the game is debatable. A number of people, including myself, are still playing WoW and have even activated second accounts solely because of the opportunity to use Glider to create a level 60 character of another class. When the Blizzard project managers sit down with the issues list, we want Glider to slip down the list behind other work.

    The bottom line is that Blizzard can detect anything that's available to the public with enough effort, since they control the client. So rather than attack that strength, we attack the weakness and try to make it a bad idea or make their changes very risky, since they don't want to risk banning or crashing innocent customers.

    As for GM's, it must be an interesting part of their jobs. Being a WoW GM seems like it would be one of the toughest jobs in the world, since they're effectively a level 1 help desk for gamers - and playing a game that they probably love. I imagine a GM has a little more fun when shadowing a suspected botter than simply helping someone get their lost Arcanite Bars back. I know I would. We don't see them as "the cops" or "the enemy" or anything like that. They're just guys doing their jobs.

    Do humans play like robots?

    TG Daily: Do you think there is any truth to human game-playing become robot-like? I know that when I solo around.. it's basically charge, heroic strike X 5 or more, bloodthirst and finally execute. I also tend to go to the same areas and kill the same mobs.

    Mercury: Definitely, for the leveling part of the game. Every player has a set progression of moves and they only change gradually as you gain new skills, talents, and gear. Once you have your optimal set, you rarely deviate. I knew I had to do something to automate it after the nth Immolate/Corruption/Curse/Drain pull.

    TG Daily: Looking through the WoWglider forums, when GMs starting teleporting players you added teleport detection. In addition, it looks like you added GM whisper detection also. Regarding the cat and mouse game that is played by Blizzard and the GMs, how have your countermeasures evolved?

    Mercury: If it's a cat and mouse game, then the cat must be one of those new hunter pets with stealth, since we never see it coming. But one of the few advantages we have is our size. So when we learn of a change in the detection procedure that GM's follow or a change in the Warden code, we can react very quickly. Compared to the game, Glider is a tiny, tiny piece of code. I can apply a change, test it, document it, and deploy it in a matter of 20-30 minutes. Blizzard has to move much slower.

    TG Daily: Would you recommend this program to people who are just starting WoW? I can definitely see the use of this for people who already a level 60 and don't want to do everything over for an alternate character.

    Mercury: Your answer is the same as mine. In the FAQ on our site and when anyone asks, I always discourage new players from using Glider. All that 1-60 content is pretty fun, for both factions. And skipping it with Glider is just a shame. If anything, I'd say not to use Glider until you've leveled a character of both factions to 60. Those last few levels can get pretty grindy, though, once you've exhausted your quests, so maybe a bit of skip is in order.

    I really think if Blizzard had some way of allowing a veteran player to level new characters faster, they would have higher retention of subscriptions - and probably no Glider to contend with. Those players have already done all the basic stuff, they just need a new 60 for their guild's MC raid or to play around in BG's. A fresh level 60 character in all greens isn't really that valuable, but takes a lot of work to make.

    Could bot programs actually help Blizzard?

    TG Daily: You mentioned that some people have set up an extra account, which means up to $15 per month - depending on subscription plan - more for Blizzard. While it may be a bit of a stretch, could bot programs actually help Blizzard's bottom line?

    Mercury: In the short-to-medium term, I actually think they do. The plus side of having Glider or any other bot out there is that some people who would have quit will continue. And some of those people will create secondary accounts so they can party or avoid banning. On the other hand, it's possible that someone may burn out faster and quit from botting, but my experience shows that to not be the case.

    The downside of it is the impact on non-botters in the long-term: if the botting population becomes too big, other players become more aware of them and think badly about the game. With the huge population base in World of Warcraft, it would take several armies of botters to do that, but it could happen after a long time. Part of our recent price increase was to slow down the rate of Gliders being introduced into the system, which it has done.

    TG Daily: While it seems the main purpose of Glider is to level up the character, do you think people are also using it to grab gold for let's say their level 40 or level 60 mount. My warrior is up 54 and I'm sure it's going to take countless hours to get the 900 gold needed for the epic mount.

    Mercury: Plenty of people use Glider to farm money for mounts or other characters, definitely. We don't discourage that just because it's not the primary use. A gamer's tendency to adapt a tool to his or her own personal use is pretty natural.

    Personally, I hate farming at all, even with Glider. So I always do my best to aggressively sell and market items I find while getting to 60. So far I'm two for three on having my epic at 60.

    TG Daily: You've stated in the FAQ and also in the forums that it will never be used to kill other players. Since the program doesn't directly attack other players, what do you think Glider's real impact will be on people who don't use bots?

    Mercury: Honestly, I don't think Glider is going to have much of an impact on people who don't use bots. For people who are looking to have the best gear, do big raids, and compete aggressively in PvP, Glider is not that useful after a point, other than to make fresh 60's. You're never going get two-shotted by a guy decked out in epics and say, "Man, that guy must be using a bot!" Until Glider has a 40-man raid mode, which I must admit would be insanely cool and will never happen, it will have a very real ceiling on the direct advantage it confers.

    If you're real casual, then a player using Glider does have a competitive advantage over you as far as leveling speed. It's the same advantage a hard-core player would have, though, or someone who really did have a 10-year old nephew they could press into grinding duty.

    And, to be honest, we are changing the PvP policy of Glider because it's becoming more of a conflict with detection. A player who ignores an attacking player looks very suspicious, so we're building in some limited means to fight back. It will never beat a remotely competent player, but it will at least appear to be a very unskilled player. It was a pretty tough decision to make, but avoiding detection is job #1.

    Future Plans

    TG Daily: What do you plan for future versions of Glider?

    Mercury: For small changes, it's hard to say. There are so many great ideas on our Suggestions forum that picking any of them is hard because you can't do them all. I'm sure general polish and intelligence will continue to be the theme.

    The big change we have as far as new development is the addition of custom classes. Specifically, that's allowing Glider to dynamically load a .NET class (written in C# or VB.NET). Then Glider would call into the class and let it handle combat with a little object model of the player, nearby monsters, etc. This will allow skilled players to create their own combat routines with absolute control of the fight and post-fight resting. Glider users are very m ustrious, so this should make for some exciting new techniques.

    TG Daily: Has anyone at Blizzard tried contacting you about the program?

    Mercury: Not yet. ;) The only evidence we have that Blizzard even knows we exist is that a version of Warden was released in late September that scanned your running processes for a signature of Glider's executable. For people running Glider under the default configuration, that resulted in a lot of bans and a change in our detection strategy to be more aggressive in ruling out Warden's options. Other than that, no contact.

    Related stories