Note: The mainteinance of the scripting examples is discontinued since I no longer have an interest to continue doing so. The pages will remain here, for now, but that might not be the case in the future. You are free to download all the material on these pages and set a up mirror, or even continue the maintenance of the material by enhancing the examples yourself.

All the material in these examples are for the mIRC version 6.03. It is very likely that some or most of these examples won't work in future versions.

Scripting a clone scanner

Clones are multiple connections run from one single machine. Clones are more powerful than botnets because they don't have any lag when communicating with each other. Of course the weakness of clones is that they can usually be detected very easily. Most of the time clone connections share the hostname (the part in address that comes after @).

The $ialchan identifier is the answer to this question. The syntax is $ialchan(<wildcard address>,<channel>,<N>) If the N is 2, it returns the 2nd match, if N is 3, the 3rd match etc. If the N is 0, it returns the number of matches. This will be used in conjunction with $address(<nick>,2) since it returns the address in the right form (*!*@<host>). Both identifiers require a working Internal Address List (IAL).

Example script

; $1 = Channel, $2 = Nick
alias clonecount {
  return $ialchan($address($2,2),$1,0)
}

; $1 = Channel, $2 = Nick
alias clonescan {
  var %count = $clonecount($1,$2)
  if ( %count == $null ) {
    echo $color(join text) -t $chan * Clone scan: No connections from $address($2,2)
  }
  else {
    var %x = 1
    var %clones
    while ( %x <= %count ) {
      %clones = %clones $ialchan($address($2,2),$1,%x).nick
      inc %x
    }
    %clones = $replace(%clones,$chr(32),$chr(44) $+ $chr(32))
    echo $color(join text) -t $chan * Clone scan for $address($2,2) $+ : %clones
  }
}

on *:JOIN:#: {
  if ( $clonecount($chan,$nick) > 1 ) clonescan $chan $nick
  if ( ($clonecount($chan,$nick) > 4) && ($me isop $chan) ) kick $chan $nick Too many clones!
}

First there is $clonecount identifier which returns the number of clones for specified channel and nick. Then there is /clonescan alias which echos the results of clone scan to the channel window. It loops through all clones and get their nicks using the .nick property of $ialchan The replace function on the alias just replaces every space with a comma and a space to make the output look more clear. The echos of the alias try to be as standard as possible so that they can be used on any client which uses mIRC's internal settings. Finally there is the on join event which does two things. If there already is a clone on channel, it runs /clonescan If there are more than four clones on the channel, it kicks the newest clone out as its purpose most likely is to cause trouble. Naturally you can change the number of allowed clones. Remember that there still are useful and reasonable purposes for clones. When user reconnects after disconnection, the server might think the old connection is alive which causes a clone on the channel. Also multiple users can sometimes connect through one machine if there is a local area network (LAN) or remote login (telnet or ssh) option.


Last updated 2003-04-05, Janne 'Geetee' Nikula, jn-mirc@zkelvin.net