How I got the key to Diablo III Beta

In YouTube thisIsHorosho videos recently began to appear keys to the Diablo III Beta. In the 7-minute video for a second, the key is shown, who first activates it, then it wins. This is how the key looks like on a still frame:


Have you thought about the same thing about me?


Only 10 keys.
')
Key 1
I did not know about the first key, and probably nobody knew. Someone was lucky.

Key 2
The simplest bot was ready for the second video, which once every 10 seconds updates the page with the added video and, if a new video appears, the modal window in the form of an alert reports this. It turned out that after 4 hours youtube detects the bot and asks him to enter recaptcha, and then every hour asks to enter it. It is not very convenient, but I didn’t really want to spend time and write in a normal way, as I expected the second key to appear somehow differently, for example, in green letters. I missed the second key, but when I saw the same gray numbers and letters, the same font, the same size, on the same white background and even the same three lines, I decided to make a normal bot.

Key 3
By the third video, the bot used youtube api, the quota for the number of requests for which it was allowed to scan every 5 seconds for 12 hours.

The algorithm was simple:

1. Every 5 seconds do GET to http://gdata.youtube.com/feeds/api/users/ThisIsHorosho/uploads?max-results=1&fields=openSearch:totalResults,entry/id and get the total amount of the user's video and the link to the latest video .
   
2. If the number of videos has changed, then from the last link we get videoId: 3J1CYzzZjNc
3. Make a GET to http://www.youtube.com/get_video_info?video_id=3J1CYzzZjNc and get the url encoded parameters
4. We take the parameter url_encoded_fmt_stream_map - this is url encoded direct links to videos of different formats and quality. The link only works for the IP from which the request came. You can get a nice link http://oo.preferred.lhr14s07.v2.lscache8.c.youtube.com/videoplayback?sparams=cpid, id,ipbits,itag,ratebypass,source,expire&fexp=906929,907720 , 904821 & itag = 18, & ip = 88.0.0.0 & signature = BA6D9C66CA9DF74931C899ABC3816E6FFB3AF2B5.326CFD03BDE8430990DEE9E8DC62046FAC43C62B & sver = 3 & ratebypass = yes & source = youtube & expire = 1332983106 & key = yt1 & ipbits = 8 & cp = U0hSR1lTUV9FUENOMl9RTVVCOmNpbEFrX1hXTllx & id = dc9d42633cd98cd7
5. A bot, downloading a movie, starts analyzing the video using the vlc library, which understands mp4 from the box, flv, webm.
6. Scanning the frames after 1 second, we find and save those on which the serial number is supposedly located. We scan in 4 streams, each its own 1/4 part of the video.
7. User, i.e. I can only see the screenshots found and enter the key

So, an alert popped up, announcing the release of a new video, I logged in to battle.net, after 10 seconds the video was downloaded, after another 10 a screenshot with a serial number appeared:

I introduced it and ... it was already used. Error analysis showed that youtube api data is updated with a delay of up to 5 minutes! When the bot discovered a new video, it was already too late. Some of the other bots or users of the F5 strangers are lucky.

Key 4
By the fourth video, the bot was finalized: now it uses about 100 proxy servers (1 stream per proxy server), which scan gdata every 5 seconds. Tests showed that about 20 proxies just instantly report the release of a new video, the rest pull up in a minute, it was excellent. Unlike gdata, direct links appear immediately for any IP, so here without a proxy, the bot simply downloads video in 20 streams (it worked even in 1000 streams, youtube turns out to allow). The download speed has increased. The scanning algorithm was improved: the bot firstly scans the second part of the clip in 4 threads (in all previous videos the serial key appeared at the end of the clip), and then in 4 threads the first part. For reliability, the scanning step was reduced to 500 ms, other parameters were also slightly weakened.

So, an alert popped up, announcing the release of a new video. I did not have time to go to battle.net as the video had already downloaded (10 seconds) and a screenshot with a serial number appeared:


I was glad that I took into account the possibility of his appearance in two lines. With shaking hands, I somehow wrote and activated it! It took about 20 seconds. It was very lucky with the scan, the algorithm almost immediately showed the serial number, while the full scan lasted 30 seconds. In this video, as it turned out, there were two keys that seemed consistent, I entered the second one. Congratulations to the one who activated the first!

5 more keys left
You can modify the algorithm: run the scan with the start of the download, the algorithm becomes more complicated, but you will win 10 seconds. You can also recognize the serial number and automatically enter it in battle.net. Then the key can be entered even in 5 seconds.

Everything was written in Java using HttpComponents (http-protocol) and VLCj (video processing)

PS Diablo III is cool

UPDATE
It was interesting to write the bot itself, so I regard the time spent 20 hours as time spent on entertainment, and not as 20 hours, during which one could earn much more money than the key itself costs. In my free time I relax or study something new, but I do not work, but here is pleasant with useful. The game has not yet passed.

Algorithm
I specifically did not immediately specify the algorithm for determining the serial number for two reasons. Having learned an absolutely accurate algorithm, the authors of ThisIsHorosho will quickly make the key unrecognizable, and I will do a disservice to those who also write the bot. Although I admit that there are no such people, but as the same, judging by the comments, in 3 minutes serials are introduced, really press F5 while waiting ...

Well, since there are many questions about the algorithm ... The main thing is that the algorithm must be very fast. The main idea is immediately visible from the screenshot with the serial number.

1. We take a picture from the frame and save it with a size of 640x320, VLCj allows you to save pictures with any resolution, even if the video has a different one. All points close to the color of the text are black, everything else is white. As a result, we get black and white pictures. A couple of these pictures are inserted in this article.
2. For each screenshot, we consider the statistics of white and black dots. We declare the background to those where the number of white points is more than 92%, and 94% was enough in the tests, but this is with a margin. On the frames with the background we are looking for a serial.
3. We retreat from the frame from the edges by 30 pixels, since the serial appears closer to the center, but never from the edge. The remaining field is divided into 20x20 squares, in each of which we count the number of black dots.
4. Squares with the number of black dots from 10% to 60% are declared squares with letters - this is taking into account the fact that the letter can only half fall into the square and with some margin.
5. Frames containing a continuous sequence of at least 6 squares with letters horizontally and 3 squares vertically are declared frames with a serial number. Save them to the folder.

As a result, only pictures with text similar to the serial number appear:


In practice, there are not many of them, so finding the right one is easy.

Work with VLCj
Working with VLCj is very simple. First, I read the documentation at www.capricasoftware.co.uk/vlcj/tutorial1.php , then I played a little with the MediaPlayer class, but it was somehow buggy, in general, I stopped to call direct functions from the LibVlc library - it is faster and more buggy.

First create the library
LibVlc libvlc = LibVlcFactory.factory().create();

Then we create an array of 8 pieces AnalyzerThread (of type Runnable) (each 1/8 of the video time), which we transfer to Executors.newFixedThreadPool (4) in this order: 4, 5, 6, 7, 0, 1, 2, 3. Those. first, the second part of the video will be scanned, and then the first. Each AnalyzerThread has this code:

 System.out.println("Run section " + num); libvlc_media_player_t p_mi = null; libvlc_media_t media = null; try { // prepare //libvlc_instance_t instance = libvlc.libvlc_new(0, new String[0]); libvlc_instance_t instance = libvlc.libvlc_new(2, new String[]{"--vout", "dummy"}); p_mi = libvlc.libvlc_media_player_new(instance); libvlc.libvlc_audio_toggle_mute(p_mi); media = libvlc.libvlc_media_new_path(instance, fileName); libvlc.libvlc_media_player_set_media(p_mi, media); libvlc.libvlc_media_player_play(p_mi); Thread.sleep(msPlayerWait); libvlc.libvlc_media_player_pause(p_mi); // start snapshoting int block = blockFrom; for (long msTime = msFrom; msTime <= msTo; msTime += msInBlock, block++) { String path = snapshotPath + File.separator + "snap-" + String.format("%03d.png", block); libvlc.libvlc_media_player_set_time(p_mi, msTime); int r = libvlc.libvlc_video_take_snapshot(p_mi, 0, path, picWidth, picHeight); if (r != 0) System.out.println("SNAPSHOT FAILED: block=" + block + ", returnCode=" + r); else analyzeImage(path); } } finally { if (p_mi != null) libvlc.libvlc_media_player_stop(p_mi); if (media != null) libvlc.libvlc_media_release(media); if (p_mi != null) libvlc.libvlc_media_player_release(p_mi); System.out.println("Close section " + num); } 

The analyzeImage function just determines whether the key is in the screenshot or not, if it is, it saves it in a special folder.