We are writing a bot for the agar.io browser game

All probably already aware of such a wonderful web game as Agar.io .
Once again losing to her more lucky rival, I quietly cursed to myself and decided to somehow crack this toy in order to finally get an advantage in it! As a result, I managed to create a detachment of game bots that seek to find me on the map in order to join my game cell.

We get into the game client

First you had to understand how everything works.
The game is written in javascript and communicates with the game server via a web socket.

The main game script is in the main_out.js file .
The code there is of course obfuscated and in every possible way tries not to let itself run from where it should not:

if ("agar.io" != h.location.hostname && "localhost" != h.location.hostname && "10.10.2.13" != h.location.hostname) h.location = "http://agar.io/";

Having expanded the file in a readable form through the Chrome debugger, the question arose: how to wedge into the logic of the game?

First, I decided to create a local copy of the files and connect to the server, disabling cross-domain verification in the browser:

#файлы игры
/css/bootstrap.min.css
/js/jquery.js
/index.html
/main_out.js
/quadtree.js
#запуск Хрома без same origin policy
chrome.exe --disable-web-security

This worked for AJAX requests for gaming regions, but further attempts to connect via a web socket were rejected. A different approach was needed.

Replacing files by url

A working solution was downloading a real game client, but replacing the necessary files for the browser with your own. To do this, install the wonderful Fiddler Web Debugger program and specify the necessary paths in the AutoResponder tab:



This approach obviously requires keeping Fiddler running during the game session.

Trying to trick the server

I want to praise the authors of the game - nothing is sent to the server that could be changed in its favor (for example: your size :)). The client sends only the coordinates of the mouse, where he would like to move his cell and reports on the desired actions (for example: split).

The server, in turn, does not send the client "extra" data for it. For example, when I increased the scale of the game map, the server still sent only that window of objects that I should have seen within my cell:



It would seem that all paths are closed: the server does not trust clients with any important information and calculates everything on its own.

But then you can trick the server into its rules: create a flock of bots that will constantly sacrifice themselves, increasing my mass. But how can bots find my cell on the map? The server API itself helped out: if you constantly send him, for example, the coordinates (0, 0), then the game cell will always follow this part of the map without stopping until it reaches the goal. Instead of zeros, you just need to send my current coordinates to the bots and they themselves will come to me for dinner!

We write bots in the current window

The client code simultaneously receives data and redraws the objects on the screen. One could open 20 tabs controlled by bots and one of my game tabs. But then it would be necessary to somehow transfer my coordinates to neighboring tabs. Plus, drawing each tab would slow down the entire browser (I tried - it is). Therefore, it was decided to create new game sessions directly in the current tab, but turn off the connection with the display for them:

//запускаем новые копии игрыvar isBot = true;
for (i = 0; i < botsCount; i++) {
	//нужно делать паузу перед новым ботом,//чтобы сервер не отклонил слишком частые соединения
	setTimeout(function(){
		game(window, r, isBot, botsUrl, M);
	}, 500);
}
//не даем эти копиям рисовать на экранеfunctionpaint() {
	if(bot) return;
	//...
}

It was also necessary to add the code so that when the bot dies, it automatically starts a new session.

Work results

Bots are created. And they find me on the map!



However, everything is not so rosy.

Firstly, the server scatters players in the game rooms. Therefore, with me on a card of 50 bots get 2-3. The rest "play" in other rooms, following the coordinates from the neighboring Universe.

Secondly, someone else can eat bots! Therefore, they manage to come to me somewhere a couple of times a minute.

And finally, thirdly, the bots are small. Walking towards me, they are not gaining much mass. Therefore, from a certain stage, their contribution to my victory becomes minimal.

findings

The authors of the game managed to create a wonderful network code that does not break from banal hacking. However, the game is not protected from bot-keeping and having a little understanding of the client code, you can create a small technical advantage over the rest.

If you decide the question so that the bots are connected to the desired card, then there is the opportunity to seriously push their less tech-savvy rivals.

I reached my little goal:


Maybe thanks to bots, maybe I was lucky myself.

[ Customer Final Code ]

Thank you for your attention and good luck in the game!