Close
Showing results 1 to 8 of 8

Threaded View

  1. #4

    Default

    What you are trying to do doesn't work because this is disallowed for security reasons.
    If everyone could start the game just by passing a simple flag, without any real login, that would be sick!
    Sadly, this is a bit more complicated.

    The battle.net launcher is using an OAUTH2 mechanism system to authenticate a user, this is a well known standard and is considered secure, there is a good sum-up of how it works (this is a little bit simplified) :

    1 - The first time you start the battle.net launcher, you write your credentials into the login dialog, this happens only one time or until you explicitly disconnect later on.

    2 - The launcher sends an authentication request (usually POST) to the blizzard authentication server with the provided credentials over HTTPS (aswell a standard nowadays, it helps to prevent any MITM attacks by encrypting data, never use HTTP)

    3 - The authentication server returns what we call a "token" if the user successfully logged, this token is a UNIQUE string that has been generated for that user, it allows any blizzard API to differentiate a valid (logged) user to a non-valid (not logged) user. This token has an expiration date which is in general very close.

    4 - The token being valid, the launcher shows up and you can now start a game, you click the "PLAY" button and it starts it by providing the token which is used to authenticate you with the WOW API servers, without the hassle to manually type your login/password nor the issues related to transmitting them clearly.

    5 - You can play.

    A side note : the token is being stored locally on your computer and expires after a finite amount of time, every time you start the launcher, it checks if the token is still valid, if so it automatically logs you and refresh the token with a greater expiration date, if not (eg : after quite a long time) you then have to type your credentials again, else someone getting one of those tokens could do many things with your account, that doesn't make the system 100% secure tho but it helps a lot.

    This is also the reason (and because of how they designed it) you sometimes can start wow and login successfully to it while you can't by using the launcher, they are communicating with different servers so while one (eg : b.net authentication server) is in maintenance, the other (eg : wow API servers) aren't necessary OFF (or when the authentication servers are saturated).

    So now let's get straight into your problem, if you absolutely want to add that kind of automatic authentication to your wow multiboxing software for your users without asking them to clearly state what their password is (that would be insecure), your best bet is to do some wireshark analysis over the network and try to understand the authentication payloads the battle.net launcher is receiving (probably in JSON) and then make use of that shiny generated token.
    You will also have to understand how that token is being used to start the wow.exe instance (with the process parameters) and maybe there are some additional steps that you'd need to deduce and understand.

    But it's a lot of work, you probably want to avoid doing that.

    -Intoxx
    Last edited by intoxx : 07-21-2020 at 11:19 PM

Posting Rules

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •