In-Game Macro Kickbot Exploits Security Fixed

Méòw-moon-guard · October 20, 2023, 1:39am

After the drama of people managing to make a kickbot out of in-game macros a month or two ago, the latest PTR update has new macro restrictions in place.

On another topic

MACROS

Macros can no longer conditionally execute commands based on your party state.

Macros can no longer change equipment using /script, /run, or the Lua API. Equipment can still be changed using regular macro commands such as /equip.

Technical notes:

UI Macros have been restricted in a few ways. The general issue was there were several exploits to conditionally execute macro commands. These exploits tended to use un-restricted Lua API functions that happened to mutate states that various macro options/conditionals queried, or selectively register the globally available MacroEditBox for the event that would run commands

To address the state mutation, two methods were employed:

Converting APIs like PickupInventoryItem to be restricted when trying to change gear during combat.

Caching the state queried by the macro conditional when combat starts so that the state remains invariant while combat is in progress. Macro options that check party membership and composition uses the cached state approach.

To address selective event registration the MacroEditBox was removed from the global namespace and the event was replaced with a callback.

Humidcreek-earthfury · October 20, 2023, 1:50am

You’re a month late and needed to read that thread you linked a little bit more

Méòw-moon-guard · October 20, 2023, 1:50am

They added more restrictions with the recent PTR on top of that.

The initial fix last month was cleartarget restricting. The recent updates I posted above show much more than that, including possibly previously unknown ones.

Rita-velen · October 20, 2023, 1:52am

Stop breaking macros cheaters >:(

Hornwinkle-caelestrasz · October 20, 2023, 1:55am

Although I am no friend to the Night Elf , I am very pro wow, I am glad you found this and posted this, I had a strong suspicion

Méòw-moon-guard · October 20, 2023, 2:01am

Probably explains why some people are complaining of broken addons and macros this week.

Trustlvlfour-zuljin · October 20, 2023, 2:20am

I swear. These sweaty tryhards have really screwed it up for the rest of us normal add-on users.

Méòw-moon-guard · October 20, 2023, 4:18pm

The people who were using a paid rotation bot cheat moved over to in game macro exploits once the former got banwaved. Now Blizzard had to go in and patch out in game macros further after the abusers shifted around to that.

Not a coincidence the kickbot macro exploits occurred one month after the rotation bot banwave.

Opalunaiya-bleeding-hollow · October 20, 2023, 4:21pm

I was never clever enough to put together stuff like this. It always amazes me how far people go to cheat.