So i’ve been browsing twitch to find interesting addons and i stumbled upon an addon called “Floatindicators” (browse it twitch or curse). This is the provided description:
“Bring back disabled friendly nameplates in dungeons and raids. No more restrictions for style them.
Addon can show colored names , colored lines, circles with duration swipe over friendly nameplates to highlight various boss mechanics.
Also addon allow you to show buff and debuffs of friendly units via small icons with timers.”
Before doing anything, i have a simple question: Does this addons respect the Blizz ToS ? Is this bannable ?
It might not be okay to use it, but Blizzard will never ban for using addons. They will generally only protect or disable whatever API the addon is using (which they already have done so on the 8.2.0 PTR)
Doesn’t sound like anything game-breaking just from the description that you gave, so I think it’s completely fine, since a lot of addons like that exist. The only times that Blizzard has intervened are when boss addons for example give a very significant advantage.
An example would be a nearby players radar that used to be a standard feature of these addons, basically it would show a “minimap” kind of like a radar where it showed players near you, how far they were, and the radius that you set with the command as a green circle around you. Kind of difficult to explain, but it gave a tremendous advantage to dealing with some mechanics, especially on Archimonde, who had beams that went all over the place, and the addon would basically find a safe spot for you and tell you which face to turn with the mechanic.
I spent a few hours looking at the code myself. It definitely breaks the UI Add-On Development Policy particularly relating to point #2 regarding obfuscation of code.
A few functions are declared in the ns table and referred to via numbers only, for example:
local club = ns[26587+36206](v.clubId)
local name = ns[26587+36206](v.name)
Of particular note in the “FloatIndicators\core.lua” file…
Line 1610 defines ns[62793] which calculates a 32-bit CRC of its input.
Line 3993 defines ns[5884], which the surrounding code implements the RC4 stream cipher algorithm.
Line 2196 is commented out string that would define ns[7536] to be a base64 encoded, RC4 encrypted payload.
Line 1202 defines ns[45678] which calculates a key used by the RC4 algorithm based upon whether or not the person using the addon is a member of a specific community/club.
All of these combined lead to a function defined on line 3599 (ns[1912]) which the surrounding area obfuscates (via a local named fffff) an access and call to loadstring, firstly to install whatever trick it’s doing to style friendly nameplates, and secondly to decrypt and execute the payload if the user is a member of a specific community whose club ID and name match a known value.
The payload itself is commented out so isn’t doing anything, but the fact that it’s encrypted and so clearly obfuscated is definitely a breach of the development policy.
![:slight_smile:](https://d1bg94bbsh66ji.cloudfront.net/en/wow/images/emoji/twitter/slight_smile.png?v=6" ":slight_smile:")