mIRC Home    About    Download    Register    News    Help

Print Thread
Joined: Jan 2004
Posts: 1
B
Mostly harmless
OP Offline
Mostly harmless
B
Joined: Jan 2004
Posts: 1
I have recently been having problems with DCC download bots (Bottler, IRC-Ork, etc). I am trying to get rid of them. I am writing an Eggdrop script for on-join auto-detection of such users and I need a little information for one of the features I am adding.

Obviously, mIRC is the most popular IRC client. Most of these unwanted bot users will falsify a CTCP VERSION replies with something that resembles mIRC. However, many do it incorrectly. They respond with obvious bogus information like simply "mIRC 6.12". I have even seen people so lazy as to put just "mirc".

What I am doing is coding a malformed mIRC CTCP VERSION reply check. Users who reply with "mIRC" but do not fit the correct format will be considered a fake.

I was wondering if anyone had a list of all of the different LEGITIMATE mIRC CTCP VERSION replies. I want to be sure that visitors using older clients are not auto-banned on accident.

Here are a few VERSION replies that I have compiled (not all are confirmed):
mIRC32 v2.1a K.Mardam-Bey
mIRC32 v2.3a K.Mardam-Bey
mIRC 6.01 Khaled Mardam-Bay
mIRC32 v6.1b K.Mardam-Bey (private beta)
mIRC64 v7.0b K.Mardam-Bey (private beta)
mIRC69 v6.9b K.Mardam-Bey (private beta)
mIRC v6.12 Khaled Mardam-Bey

Please correct any information I have wrong. Also when was the change made to the mIRC code to force the version reply? Thanks.

Joined: Oct 2003
Posts: 273
E
EVH Offline
Fjord artisan
Offline
Fjord artisan
E
Joined: Oct 2003
Posts: 273
One thing you can do is, do two versions on them
spaced a few seconds apart, mIRC will only reply
to one version in 10 seconds, so if they reply to a
second version a few seconds later, it's not mIRC.

Joined: Feb 2003
Posts: 2,812
Hoopy frood
Offline
Hoopy frood
Joined: Feb 2003
Posts: 2,812
To answer your question:

All VERSION Replies from v4.7 to v5.91 looked like this:
[*]mIRC16 v4.7 K.Mardam-Bey
[*]mIRC32 v5.91 K.Mardam-Bey

And Replies from v6.0 and up look like this:
[*]mIRC v6.12 Khaled Mardam-Bey

There have been no versions released that state "mIRC64" or "(private beta)" in the reply.
Versions before 4.7 had somewhat inconsistant version replies, but should be banned anyway because they're rittled with bugs. smile

To put this into a faithful regular expression:
[*]/mIRC(?:16|32)? v\d\.\d+ K(?:\.|haled\s)Mardam-Bey/
or more critically
[*]/mIRC(?:16|32) v5\.\d+ K\.Mardam-Bey|mIRC v6\.\d+ Khaled Mardam-Bey/

Also, what EVH suggested is a keen idea.

- Raccoon


Well. At least I won lunch.
Good philosophy, see good in bad, I like!
Joined: Feb 2003
Posts: 810
C
Hoopy frood
Offline
Hoopy frood
C
Joined: Feb 2003
Posts: 810
Since you can't tell about future versions, I'd really go with what EVH has suggested first.


* cold edits his posts 24/7

Link Copied to Clipboard