search

brianzhouzc / RocketBot

An automated Pokémon Go Bot
GNU General Public License v3.0
564 stars 316 forks source link

Rocket API flagging? (unsafe to use bots using rocketbot api) - Linked from nox dev #1191

Open athanatos1 opened 7 years ago

athanatos1 commented 7 years ago

Sorry if this is spam. I just feel that it is very important. In the reddit pokemongodev sub, they mentioned that the rocket API (which Necrobot is using) is not flag proof, and that Niantic can easily flag anyone using programs that use the rocket API and later ban them in a banwave. So, we're all likely to get all banned sooner or later as our accounts have probably been already flagged.

Some other third party tools use through MITM method to avoid having to use API calls, and others use one with unknown6 signature. I don't know anything about APIs, but does Necrobot already have unknown6 signature encryption or use proper signatures for API calls? If not, could we make it a number 1 priority to implement it? If we don't, all the coding for other features and bug fixes would be pointless if we're going to get flagged and banned in the 3rd banwave (probably after the Pokemon buddy update). There appears to be a pull request on the rocket API that implements unknown6 signature encryption, but the author Feroxrev seems to be afk as the pull request was 27 days ago and it still wasn't implemented. Here's the link: FeroxRev/Pokemon-Go-Rocket-API#128

I don't know if this helps, but here are some other links related to API: https://github.com/cyraxx/pogobuf https://github.com/cyraxx/node-pogo-protos https://github.com/AeonLucid/POGOProtos

Edit: Besides unknown6, I remember altitude was a problem but I'm not sure if it has been fixed

athanatos1 commented 7 years ago

This is also linked from nox dev

"

Yes, unfortunately, Rocket API is kind of a mess and FeroxRev has abandoned the project. I think Rocket API is broken in a lot of ways after looking at it. I've got a private fork of Rocket API that better emulates the 0.35.0 client. I basically ported over parts of https://github.com/Grover-c13/PokeGOAPI-Java API to .NET.

This would only be a band-aid since after looking at Rocket API, I think it's so broken that it a complete re-write might be needed to better emulate a real client.

I've been considering a few options: 1) Patch Rocket API and continue to fix this base. 2) Run a Java to C# converter, manually fix the code that didn't port over. This is a big effort initially. 3) Run a Java to .NET bridge (like JNBridge) so that we could use Grover-C13's API with NecroBot. 4) Wrap Grover-C13 in a web services interface call into it from .NET using web services.

Somehow interfacing with Grover-c13's code is appealing for several reasons: 1) It's actively maintained and they focus purely on the API. 2) Grover-c13 also contributes back to AeonLucid/POGOProtos regularly so I feel comfortable that they are "experts" in this area of better reverse engineering. 3) Their inventory management is way better than Rocket API. 4) They have gym attack code working (or semi-working). 5) Preliminary captcha code checks in place. At least they know when the server sends back a captcha challenge. "

Ultima123 commented 7 years ago

@1461748123 Isn't very active in the issue section.

Did they also mention why rocket API is not flag proof?

If the signature was invalid, would the request even be accepted? It would be a waste if we all were flagged. :(