Updated on 2023-12-07

A few weeks after this article has been posted, as a strange coincidence, there has been an huge update which changed how the detection works on Android devices.

It might be bypassable using the same package name as apps that use Accessibility Service by default on some devices, however this should be investigated.

As every nerd I know, during my free time, I love playing videogames and I’ve recently decided to play Pokèmon again, focusing on the old generations. It feels like a real throwback to my childhood!

During the setup of the emulators, I’ve discovered the existence of PokeMMO.

What’s PokeMMO?

PokeMMO is a cross-platform^[1] MMO, created in August 2012, where it’s possible to play most of the Pokèmon games (Red Fire, Emerald, Platinum, Black/White, HG/SS) with thousands of players connected at the same time. It’s possible to trade items and Pokèmon, challenge other players or even sell in-game items through a system created by the developers called GTL ( Global Trade Link ); For all intents and purposes, it’s an international market based on the In-game currency, the PokeYEN, where all the players can sell or buy everything.

Since it makes use of the original Pokèmon ROMs, the storyline and the NPC interactions are not modified. The story is the same as the original game, it only implements specific differences such as:

• Change of the spawn location of wild Pokèmon
• Legendary Pokèmon can't be caught or kept for long time^[2]
• The battles against the NPCs are way harder

*^[1] The game is currently supported on Windows, Android, iOS, Mac and Linux.

*^[2] Currently the only legendary Pokèmon that can be caught and kept permanently in the game are: Suicine, Raikou ed Entei.

How does it work?

As already stated, at the beginning the game does not show any substantial difference except for the dialogs speed which is increased to allow a smoother experience. Once the 4^th gym has been defeated, it will be possible to use the GTL trading system mentioned in the previous section.

Arrived at this point, it immediately becomes clear that the price of some items listed in the GTL, not only requires to set up a strong team that is able to compete in the PvP aspect of the game but is also really high and requires more and more PokeYENs.

There are different ways to “farm” the PokeYENs, but all of them are inefficient if we compare them to the selling price of the most useful items and Pokèmon, therefore it was immediately clear to me that I needed to find a method to gain large amounts of PokeYENs with the minimum effort necessary and, above all, for free. Always keep in mind that the difficulties to face when creating the automation are as many as the interactions in the game.

My research lasted about 1 week, during which I read and studied the various documents and posts available on the official PokeMMO forum.

In the end I found the Holy Graal: Shiny Hunting!

Shiny?!

Shiny Pokèmon, introduced from the II generation of the game, are just different sprites of the same Pokèmon you would usually catch; generally they are recognized because when they join a battle they are “wrapped” in flash or stars.

It’s good to remember that a normal Pokèmon can’t become Shiny, just as a Shiny Pokèmon can never become a normal Pokèmon.

What makes them so special? They are hard to obtain.

The spawn rate of these entities is of 1/30000 for each encounter. Obviously, previous encounters don’t influence in any way the spawn rate: the chance that a Pokèmon Shiny appears will always be the same even if you already met the “classic” version thousands and thousands of times. In this case players generally aim for the Hordes Pokèmon.

A horde is a group of three or five wild Pokémon battled simultaneously in PokeMMO.

While walking and surfing in locations with hordes, players sometimes encounter a horde instead of a single wild Pokémon. Pokè Balls cannot be used in horde battles until only one member of the horde remains.

It’s common, during an “hunt”, to reach a really high number of encounters; On average, it’s estimated that a Shiny occurs between 18000 and 30000 encounters. Obviously, there is no way to determine the exact number of encounters required; many players have been looking for the Shiny version of their favorite Pokèmon even for YEARS , also due to the high cost of the specific methods required to find them such as Egg Breeding.

There are items and ranks, such as Shiny Charms (Used in-game, lasts 1 hour) and Donator Rank (Rank obtained for 7/15/31 days after making a donation with IRL money), that are able to decrease the spawn rate and therefore granting more chances to get a Shiny.

Below the affected spawn rates:

All the items and ranks can be bought paying by IRL money or in-game PokeYENs. It is obvious that the price in PokeYEN is high and, therefore, unattainable for novices unless you play for dozens and dozens of hours using other farming methods such as Gym Rebattles, PayDay or the ever-green Flipping_[1] of the Items/Pokèmon on the GTL.

*^[1] “Flipping” means buying something to resell at an higher price in order to make a profit.

Many people spontaneously decide to “hunt” these particular Pokèmon because they are the most expensive and sought after in the game economy.

A single Shiny, depending on the IVs (In-game stats such as Attack Speed, Damage, etc.) can be sold from a base price of 800000 up to 1999999999 PokeYENs! Catching a single Shiny can be game-breaking, because if sold it could yield a return of a large amount of money to the player, who can reinvest.

For additional information: PokeMMO Shiny Hunting Guide

Automating the hunting process

Once I’ve understood which is the most profitable (and hard) way to get PokeYENs, I’ve decided to get my hands dirty.

It’s easy to see that many players have tried to study, comprehend and find the best method to automate the process of hunting this kind of Pokèmon, or at least reduce the number of manual interactions required. Most of the bot implementations I’ve seen are aimed towards the Windows version of the game, automating the movements of the characters with specific macros.

What’s a macro? A macro is simply a group of procedures that are executed on the system automatically when specific triggers are respected. It’s able to interact within the game as a real player would, simulating the clicks of the keyboard and the movement of the mouse.

A macro can be easily written through tools such as AutoHotkey or some Python modules: pyautogui and pynput.

However, as found by the user pnqphong95 on his GitHub repository Pokemon-MMORPG-Bot, the admins were able to suss him out before he could finish catching the Pokèmon for his team.

His account was perma-banned.

The game’s moderators take the bot issue very seriously, and will promptly reject any un-ban request, as seen from several posts made by other players on their official forum: Ban Notice. Furthermore, while the game is running, there seems to be regular checks on the player to grant it’s authenticity.

Actually, during my tests, I’ve also noticed some anomalies that could be somehow related to the ban that the previously mentioned player received. Without any kind of Reverse Engineering, I’ve observed:

• Sudden movements of the player in other positions
• Input-lag after a high amount of interactions

It is clear that these hypothesis should be studied in depth, in order to determine their relevance in the detection mechanism of the game(if it exists). However, it seems safe to assume that the the Windows version has additional controls in place that effectively prevent/limit the use of these bots or report their anomalous behavior to the administrators, who manually verify everything.

The duration of the game session must also be considered because the game has implemented a mechanism of automatic disconnection from the server: the player will get disconnected if there doesn’t seem to be any kind of action for more than 10/15 minutes. Bots are usually connected for dozens of hours, if not days, so there’s probably a system that allows them to “list” all the sessions and order them by their length, banning on-sight any session that has an unexplained length.

They’ve also implemented a reCAPTCHA mechanism that gets suddenly displayed and it could be their latest verification method to establish if a player is “botting” or not.

So what now? Shall we forget about this project and start to waste countless hours of our lives to catch one of these Pokèmon? Absolutely no!

As a wise man said:

Success is not final; failure is not fatal: it is the courage to continue that counts

– Winston Churchill

What about the Android APP?

Excluding Windows, I had no other options except checking the Android port too. Although it looks virtually identical, I believe that the detection systems work differently for this version. Usually, when designing a cross-platform application in Java, the application itself is split into as many projects as the supported platforms, with the addition of a Java library for the core functionalities, where most of the work is generally done. For instance, in order to make our application running on Windows and Android, we should have:

1. A project for Android-specific features
2. A project for Windows-specific functionalities
3. A Java library shared between the first two projects, containing many of the essential features of the application.

Therefore, it is easy to assume that in the Android project, although many aspects are the same, the detection mechanisms changes.

Implementation of macros on Android

Well, after choosing our platform, it is time to start automating!

After some consideration, I have decided not to share my solution in a step-by-step way. I am convinced that the massive use of these tools by the players would be able to inflate the economy of the GTL, thus destroying the very meaning of the game.

I will therefore just give general information, and also attach a demonstration video.

Image Recognition

The technology I’ve used is Image Recognition, by which it is possible to search for specific images on the current screen of the device and then run macros.

By searching for items present only at specific times, it is possible to create automatic interactions that are not looped, thus generating many server-side errors, but only when certain conditions are met.

An example of the elements I was looking for:

1. The error message "There's no PP left for this move"
   • Used as a trigger to teleport to a Pokèmon center and then return to the previous spot.
2. The move "Sweet Scent" icon, inserted into the game hotbar.
   • Used as a trigger to start an encounter with a horde
3. NAME+LEVEL+HEALTH BOXES of the single encounter Pokèmon
   • Used as a trigger to escape from the fight with Pokèmon we do not seek.
4. NAME+LEVEL+HEALTH BOXES of the horde encounter Pokèmon
   • Used as a trigger to automatically escape from hordes that do not contain the Shiny Pokèmon we are looking for.
5. Player positions in the interested area
   • Used as triggers to take the character to specific places on the map, thus detecting wrong movements and fixing them.

An appropriate level of tolerance was found for each image used. The tolerance allows the image to be recognized and identified in the current screen even if some of the pixels do not match.

In general, any self “professional botter” should always keep in mind that:

• Being slow is always better! The goal is to always appear as a legit user.
• It is possible for an error to occur in the player's movement, especially when the movement is implemented without any pathfinding or state determination algorithm.
• Manual interaction is likely to be necessary if errors occur; it is not always possible to foresee all of them.
• In most cases, creating bots for specific actions is better than creating generic bots.
• Found a working solution? Don't scale it too much!

Below you will find a demo showing how the bot works; the screen was recorded in real time using scrcpy.

In 3 days, after about 32,000 encounters, I managed to capture my Shiny Pokèmon!

My solution also includes the auto increment on the Encounters Counter; other players would literally kill just for this functionality!

The APP I used to keep track of the encounters is Floating Counter.

I’ve also created a modded version of it to suppress the ads, you can download the modified APK HERE ( Password: www.balzabu.io ). Remember that no connection is required so you can turn off the “Network” permission if you want.

Extra: an un-bannable method?

Keep in mind that if you decide to use any kind of automation to help your character in the game, it’s possible that you get found and banned. For this reason I’ve decided to find other solutions that could simplify the hunting process without risking a ban.

Hotkeys

Hotkeys are a quick and easy way to associate certain actions in the game with specific keys or buttons. They are the best method to automate common tasks, such as having to use “Scent” to initiate an encounter with a horde or run away from a battle if the Pokèmon encountered were not shiny.

On computers, you can use these Hotkeys, simply pressing the corresponding keys while on Android devices you need to click on the visible element in the UI.

Although it is possible to set the hotkeys and order them as you prefer, after an extended period of use I noticed how they are particularly inconvenient on devices with slightly larger screens.

The best solution to this problem is using an external support such as headphones with Volume Up/Down buttons or external controllers. Using these devices we will have more physical buttons that we can press and then it will be possible to associate them with certain actions through APPs such as Buttons Remapper.

Pro tip: you can also use an handheld console such as the Retroid Pocket 3+.

The end?

I have to admit that this experience was very addicting, the risk of being banned added that semblance of fear that, to be honest, was very challenging and fun. After achieving my main goal, which consisted in catching a Pokèmon Shiny by simply looking at the device screen to make sure everything was working, I am enjoying all the other aspects of the game.

I am not going to sell the Shiny to make a profit, I decided to keep it as a memory of this first blog post.

I hope I’ve tickled your curiosity and if you made it this far, you’ll need to know that…We’ll meet back here soon! I have lots of things cooking that I think will be of your interest!

For questions or suggestions, contact: noc@balzabu.io.

Bye \O/ !