Automating Super Hunting

Introduction

For those of you that haven't done super hunting before, I'll give you a quick rundown of the usual methods.

  1. Look at killboards to see people using supers
  2. Add them as contacts and watchlist them
  3. Run locator agents on them periodically to check where they are
  4. Spread dictor alts around the area
  5. If you see one log in, start moving dictors to where they are, or where they might move

That's most of what super hunting is, building up an intel database and sitting around waiting to see if you can catch one of them moving.

Automating it

1. Initial intel

There are lots of ways to improve this; you can read the killmails semi-live from eve-kill and zkill using their websocket/redis streams respectively.

2. Watchlisting

You can do this manually for small numbers. There are multiple tools out there that sit in the grey area of automating evegate to insert the contacts; I wouldn't recommend using these tools, but they exist.

3. Locator Agents

This is our first step where someone has to log into the game We can automate reading the results by asking for an API key and reading the locator agent results over the Notifications API, but someone still needs to log in and kick it off.

4. Placing Dictors

You can use mapping tools like GARPA or dotlan to help you figure out where the bottlenecks are, and other tools to keep track of where your alts are logged out, but you've still got to use a human to move them.

5. Watching the Watchlist

This usually requires a human to sit there and watch for alerts in the bottom right of the screen; they can clip it out or detect motion and play a sound if it happens, but they still need to read it usually.

This is the one we'll be looking at in more detail today.

Watching the Watchlist

So, why am I looking at this part today? I'm no longer actively doing any of this since we've shut down PIZZA and turkcrew; what spurred me to look back at how we did super hunting?

There was a post on reddit today by a self-proclaimed master spy and he posted a screenshot. The screenshot is the part that interested me.

At the top right of the screenshot we've got this:

I don't know if this comes from any kind of working web application, or if it's some kind of ruse, but I'm going to assume that this feature exists: a way to alert you out of game the second a supercarrier you're hunting logs in.

Client modification?

The first thing I assumed here was that it was some kind of tool OCRing the EVE Client, or some kind of python injection reading the contents of the client memory. On a hunch I asked a nice guy called Entity what he thought, and how he'd do it, since I know he knows his stuff when it comes to the EVE client. He said that you don't even need to mess with the client to read that, it's readily available in the logserver.

The EVE Client's Log Server

The log server is a tool that ships with the EVE Client, if you run it it'll show you the logs for your client as you're running it, this is usually used to give CCP debug information when you think something's broken, but you can run it all the time if you want to.

So I went to try it out and see what kind of events I get in the logs when a watchlisted contact logs in.

I had to wait a couple of minutes, then wingspan did the honour of being the first person on my watchlist to log on, as you can see in the log server I get these lines:

10606    2015.09.25 23:05:49:058 Read:  Packet::Notification (Address::Node(nodeID="1159143",service="None",callID="None"),Address::BroadCast(broadcastID="OnContactLoggedOn",narrowcast="[]",idtype="clientID"),241 bytes,[(0, <MarshalStream "~\x00\x00\x00\x00,\x08,\t%\x04H'\xa1\x05">)],{-  
10607    2015.09.25 23:05:49:058 'sn': 0}, None)  
10608    2015.09.25 23:05:49:058 BroadcastStuff::Notify( OnContactLoggedOn ,...)  
10609    2015.09.25 23:05:49:061 BlueAsyncRes::Initialize: cache:/Pictures/Characters/94447432_128.jpg  
10610    2015.09.25 23:05:49:061 Opening cache:/Pictures/Characters/94447432_128.jpg (C:/Users/Andi/AppData/Local/CCP/EVE/c_program_files_(x86)_ccp_eve_tranquility/cache/Pictures/Characters/94447432_128.jpg)  

That tells me that I'm getting an OnContactLoggedOn broadcast, and then my client loads the picture for character 94447432, which is Chance Ravinne, the guy who logged on in my watchlist.

It would be trivial for me to write a program to read these logs and relay people logging on to any other service, perhaps to an IRC channel, an alliance-wide broadcast, or a text message to my phone in case I'm watching TV.

This cuts the boring human part out of super hunting, and lets a computer send you an alert when there might be dank frags around, it's only possible for groups with a lot of technical knowledge and, since Phoebe, nets a whole lot of kills.

tl;dr

You logged your titan on for the first time in 9 months and there was a dictor on top of you within 30 seconds? Don't worry, it was probably just a server sending someone an alert on IRC; he's not actually a huge no-lifer.