Disclaimer: This tool is provided strictly for educational and research purposes. It performs read-only network traffic analysis and does not manipulate game outcomes. Usage may violate platform terms of service. The authors assume no liability for misuse. Gamble responsibly.
Aviator Signal Pro V3 is a browser userscript that intercepts and analyzes WebSocket traffic between the client and Spribe game servers. By decoding binary SmartFoxServer (SFS) packets in real-time, it surfaces insights about game state transitions, server behavior patterns, and statistical anomalies — presented through an injected overlay dashboard.
This is not a cheat tool. It performs passive, read-only observation of publicly transmitted network data to study crash game mechanics and server-side patterns.
|
|
|
|
Browser WebSocket ──► Intercept Hook ──► SFS Binary Decoder ──► Event Parser
│
Dashboard UI ◄── Risk Engine ◄── State Tracker
The intervention risk score is computed from multiple weighted signals:
| Heuristic | Trigger Condition | Interpretation |
|---|---|---|
| Low multiplier streaks | 2+ consecutive rounds under 1.5x | Suggests statistical bounce is likely |
| Instant crash detection | Multiplier <1.15x | Flagged as potential "house harvesting" |
| Panic trigger detection | Server commands: panic, forceCrash |
Direct server intervention detected |
| Post-drop high multipliers | High multiplier following mass player exit | Possible manipulation pattern |
| Player exodus monitoring | 30+ drops or 10% lobby loss mid-flight | May signal impending crash |
| Extended flight duration | Multiplier exceeding expected curve | Increasing house exposure risk |
Incoming Packet
├─ Is it a suppressed type? (chat, playerUpdate, onlinePlayers) ──► Discard
├─ State change? (betting → flight → crash) ──► Update state tracker
├─ Tick anomaly? (delta < 20ms or > 200ms) ──► Log + flag jitter
├─ Mass exodus? (30+ drops or 10% lobby) ──► Trigger alert
├─ Panic command? (panic / forceCrash) ──► Flag intervention
└─ Unknown command? ──► Log as anomaly for review
The script injects a draggable, resizable overlay directly onto the game page with the following zones:
| Zone | Contents |
|---|---|
| Live Zone | Current multiplier (color-coded: growing / crashed / waiting) and signal indicator (SECURE TO BET or HOUSE ALERT) |
| Metrics Zone | Intervention risk progress bar, lobby size, active drops, tick deltas, house exposure estimate |
| History Track | Visual crash log — color-coded: red (panic/bad), orange (caution), green (safe) |
| Latency Tracker | Packet gap and size monitor with jitter highlighting (<30ms = critical, >200ms = warning) |
| Anomaly Logs | Filtered console for errors, decoded server strings, and flagged anomalies with timestamps |
A recurring anomaly observed before crashes is the PING_RESPONSE packet:
{
"p": {},
"c": "PING_RESPONSE",
"a": 13
}| Field | Value | Technical Purpose |
|---|---|---|
c (Command) |
PING_RESPONSE |
Standard heartbeat acknowledgment in real-time protocols. Server confirms it is alive and synchronized. |
p (Parameters) |
{} |
Empty — no additional payload. Typical for basic health-check ACKs. |
a (Argument) |
13 |
Likely a sequence number, action code, or echo ID. Could map to game phase flags or RTT measurement values. |
The userscript suppresses routine messages (chat, onlinePlayers, b, myB) to reduce noise. PING_RESPONSE is not in the suppression list, so it gets flagged. However, the timing of these packets — not their existence — is what makes them analytically interesting.
Several technical hypotheses explain why PING_RESPONSE packets cluster before crash events:
1. Game State Transition Sync
Crash games operate in phases: Betting → Flight → Crash. Servers often send health-check ACKs before triggering critical state transitions to ensure all clients are synchronized. The ping response may be the last "normal" message before the crash signal, especially if batched in the same WebSocket frame.
2. Server Load & Rebalancing Signals
High player counts or network congestion can alter ping patterns. A specific a value (e.g., 13) might indicate the server is performing RTP (Return to Player) rebalancing — a common iGaming mechanism for maintaining house edge targets. This could precede manipulated crash points.
3. Latency-Based Player Filtering
Pre-crash, servers may prioritize pings to identify and drop lagging players, ensuring only active clients witness the crash event. Abnormal RTT values (>200ms) could correlate with server-side decisions about crash timing.
4. Protocol-Level State Flags
In SFS-like systems, specific a values can signal internal events. The value 13 (0x0D in hex) might represent an end-of-sequence marker or reseed trigger for the crash RNG.
Note: Correlation does not imply causation. Pings are frequent (every few seconds), and not every
PING_RESPONSEprecedes a crash. The script's binary parser may also misinterpret compressed data, producing spurious logs.
The Aviator Scanner source code is not publicly available. After careful consideration, we have chosen not to release the userscript publicly due to ethical concerns. While the tool is designed for passive, read-only network analysis, public distribution could encourage misuse against gambling platforms or facilitate violations of their terms of service. This repository serves as documentation and research only — detailing the methodology, architecture, and findings for educational purposes.
If you are a security researcher or academic with a legitimate use case, feel free to reach out to discuss access.
Deprecated — This tool was originally built in 2024 and is now nearly 2 years outdated. It is no longer maintained, and the prediction models have not been updated to reflect changes in game mechanics or platform behavior. It remains in the repository purely for archival and reference purposes.
The original version of this project was a Python GUI application that used 20 statistical and machine learning models (Monte Carlo, LSTM, XGBoost, Random Forest, etc.) to predict crash values. See the full legacy documentation: legacy-README.md
Legacy screenshots
This project is licensed under the MIT License with an ethical use clause. See LICENSE for full details.
This software is provided for educational purposes only. It should not be used for illegal, unethical, or manipulative activities, including interfering with online gambling platforms or violating their terms of service.
Built for research. Use responsibly.