Banning Insight (Consistently Updated!)

[Deffiliate]

@Maxi

 

I believe the mirror mode is awesome, and glad to see it's bypassing these client detection flags.

My question is at what level do you think Jagex monitors script behaviour/ patterns and the general playing habits of ur character? Because as a script writer i feel it's also up to us to make our script behave realistically.

Edited March 24, 2015 by Deffiliate

[Elaatl]

@Maxi

 

I believe the mirror mode is awesome, and glad to see it's bypassing these client detection flags.

My question is at what level do you think Jagex monitors script behaviour/ patterns and the general playing habits of ur character? Because as a script writer i feel it's also up to us to make our script behave realistically.

Yeah I think so the more human like the script is the better it is but its not only the script its allso how people use the script same method, same place, to many hours and so on

[Mystere]

I have something in mind to ask, lets see if i can explain good xD

So mirror and osbuddy are injection, right?

Can jagex detect mirror injection if we play on osbuddy instead on web browser?

because

Mirror inject on Osbuddy and Osbuddy in Jagex is that right?

If we bot on Mirror but directly in browser there more chances to jagex caught us?

Dont know if you understant what im trying to ask.

Maybe i'm wrong, idk xD

Il post my experience later about mirror don't have time now

Edited March 24, 2015 by Mystere

[Cruel]

I have something in mind to ask, lets see if i can explain good xD

So mirror and osbuddy are injection, right?

Can jagex detect mirror injection if we play on osbuddy instead on web browser?

because

Mirror inject on Osbuddy and Osbuddy in Jagex is that right?

If we bot on Mirror but directly in browser there more chances to jagex caught us?

Dont know if you understant what im trying to ask.

Maybe i'm wrong, idk xD

Il post my experience later about mirror don't have time now

 

I can personally tell you I've Mirror botted using both the web browser and OSBuddy. I have seen no differences in the ban rates between the two. The way I look at is they obviously don't care if you are using OSBuddy. If anything it may be a better camouflage than the plain web browser, but it's definitely not any more harmful.

[Maxi]

@Maxi

 

I believe the mirror mode is awesome, and glad to see it's bypassing these client detection flags.

My question is at what level do you think Jagex monitors script behaviour/ patterns and the general playing habits of ur character? Because as a script writer i feel it's also up to us to make our script behave realistically.

 

All we can do is make assumptions based on logical thinking. If we stick with the tier system, it's likely that they have all sorts of monitor detail levels where the higher level tiers use more computational resources and therefore only used for a very small group of characters. In general, the first tier will most likely be things like hours of play time, break times and activity. This costs very little resources to track and compute. For example, a new account, that is playing 10 hours a day doing only activities that have a very high banrate, no quests or talking etc. Second level tier might then actually compare behaviour of the activities.

 

Imagine a woodcutting script that performs the same actions in the same order: bank, walk to first tree, chop first tree, walk to second tree, chop second tree, walk to third tree, chop third tree, eat rinse and repeat. Anti-ban is only checked between certain actions, making that an easy to detect pattern as well. Then when a bird nest appears, it will immediately grab it. When a tree spirit appears or an ent, it will immediately react to it.

 

Normal players tend to perform their actions by a similar pattern. But these patterns are different every once in a while and most certainly will be different from other players. The key in making scripts less detectable is breaking patterns but also trying to achieve a certain difference between different players based on a profile. The more difference there is between two players using two scripts, the less likely it is their machine learning technology is able to identify another player using the same script as using that same script. 

 

But then again, it is possible that once you get in to a higher level tier, they start creating profiles based on mouse movements. These profiles can be compared and identified as similar. So that means there is definitely work on our side to be done as well to make key elements of our bot perform different for each player as well, like mouse, keyboard and interactions. I think if both parties can improve on this, together with the mirror client, we might make a jump ahead in the cat and mouse game on which we have  been behind for some time now.

[Cruel]

All we can do is make assumptions based on logical thinking. If we stick with the tier system, it's likely that they have all sorts of monitor detail levels where the higher level tiers use more computational resources and therefore only used for a very small group of characters. In general, the first tier will most likely be things like hours of play time, break times and activity. This costs very little resources to track and compute. For example, a new account, that is playing 10 hours a day doing only activities that have a very high banrate, no quests or talking etc. Second level tier might then actually compare behaviour of the activities.

 

Imagine a woodcutting script that performs the same actions in the same order: bank, walk to first tree, chop first tree, walk to second tree, chop second tree, walk to third tree, chop third tree, eat rinse and repeat. Anti-ban is only checked between certain actions, making that an easy to detect pattern as well. Then when a bird nest appears, it will immediately grab it. When a tree spirit appears or an ent, it will immediately react to it.

 

Normal players tend to perform their actions by a similar pattern. But these patterns are different every once in a while and most certainly will be different from other players. The key in making scripts less detectable is breaking patterns but also trying to achieve a certain difference between different players based on a profile. The more difference there is between two players using two scripts, the less likely it is their machine learning technology is able to identify another player using the same script as using that same script. 

 

But then again, it is possible that once you get in to a higher level tier, they start creating profiles based on mouse movements. These profiles can be compared and identified as similar. So that means there is definitely work on our side to be done as well to make key elements of our bot perform different for each player as well, like mouse, keyboard and interactions. I think if both parties can improve on this, together with the mirror client, we might make a jump ahead in the cat and mouse game on which we have  been behind for some time now.

 

 

Thank you for taking the time to post this. Really good stuff.

[crazykid199]

 cool stuff yo

[justanotherkid]

if anyone wants, they could test whether being reported inc chances of ban buy making several accounts that bot the same thing but have all the bots report one of the bots 

 

EDIT: not that im lazy but my botting computer only has 1 bot running because i'm not VIP and so can't use different proxies XD

Edited March 25, 2015 by justanotherkid

[irwtonrs1]

Don't forget that Jagex tracks you through the random.dat file. If you haven't deleted your random.dat file, even on a new account that is only used on the mirror client, they can still relate that account to your previous accounts. It's also possible they have more tricks like these on their sleeves with their cache. Deleting both your cache and your random.dat is a smart move and might make a difference when starting a new account.

 

Edit: The random.dat is a file that contains a UID (Unique Identification Number). This file is set by Jagex and related to all the accounts you play from that one computer. It is assumed that Jagex does not ban based on your IP but based on this UID. What we should do in the future, is write a tool that makes the OSRS client use a different random.dat (spoofed) file for each account to make sure accounts are not linked to each other through the random.dat file. This should definitely make a difference when it comes to their tracking system when making new accounts.

I don't understand how you can say they most likely do not ban based on IP. I honestly think the IP in which you are botting on is a HUGE factor when it comes to getting banned. 

 

Within the past few days I had all of my proxies switched over to a new subnet. None of the IP's I was given have been distributed to anyone except me while under the control of this particular supplier. Whatever these IP's have been used for since their existence is obviously unknown, but they have not been used for Runescape while being sold under this specific seller. 

 

 

This past Monday, I started botting 5 accounts using 3 of the IP's. Today when I woke up around 1:30PM EST, I checked my VPS to see that one of the accounts had gotten disabled. The IP that this account was running on was the IP that was most recently put to use. I see absolutely no reason this account should have gotten banned other than the fact the IP was flagged in some way. What I have now done is taken 1 account that has been botting fine for the past few days and stuck it on the IP I think is flagged. If this account is the only account disabled tomorrow, there is literally nothing else that could be causing it to get caught so quickly other than it being the IP.

 

Before having my IPs switched to the IP's I currently have, there were these 3 IP's that I ran accounts on that legit would last for extended periods of time before eventually just getting caught. I had multiple accounts last at least 3 bond uses. These account's ran every single day for 12 hours a day doing the exact same thing. Whenever I wanted to add more bots, I needed to get more proxies. Obviously, I purchased proxies from the same place yet every time I'd try to run bots on these new IP's, the accounts would get banned within a day. So I continuously had the IP's changed but with no improved results, everything would get banned. Yet anything I ran on these other 3 IP's nothing would happen to them. So for about a span of 2 months, I really only used the same 3 IP's because every other IP I tried using, accounts would get banned within a day on them. 

 

Anyway, this shit is so confusing. But I really think a major factor comes down to IP's. I just don't see how else I could possibly get banned this quick. Like I said above, I have 1 account running on what I believe to be a "flagged" IP, and I'm almost guaranteeing that tomorrow when I wake up and check the VPS the only account that is going to be disabled is going to be that one.

 

I really wish you'd guys could hurry up and introduce proxy support for mirroring. I really want to run 2 of my accounts on a "flagged" IP, one account running via mirroring and one account via standard mode and see the outcome. 

[Cruel]

I don't understand how you can say they most likely do not ban based on IP. I honestly think the IP in which you are botting on is a HUGE factor when it comes to getting banned. 

 

Within the past few days I had all of my proxies switched over to a new subnet. None of the IP's I was given have been distributed to anyone except me while under the control of this particular supplier. Whatever these IP's have been used for since their existence is obviously unknown, but they have not been used for Runescape while being sold under this specific seller. 

 

 

This past Monday, I started botting 5 accounts using 3 of the IP's. Today when I woke up around 1:30PM EST, I checked my VPS to see that one of the accounts had gotten disabled. The IP that this account was running on was the IP that was most recently put to use. I see absolutely no reason this account should have gotten banned other than the fact the IP was flagged in some way. What I have now done is taken 1 account that has been botting fine for the past few days and stuck it on the IP I think is flagged. If this account is the only account disabled tomorrow, there is literally nothing else that could be causing it to get caught so quickly other than it being the IP.

 

Before having my IPs switched to the IP's I currently have, there were these 3 IP's that I ran accounts on that legit would last for extended periods of time before eventually just getting caught. I had multiple accounts last at least 3 bond uses. These account's ran every single day for 12 hours a day doing the exact same thing. Whenever I wanted to add more bots, I needed to get more proxies. Obviously, I purchased proxies from the same place yet every time I'd try to run bots on these new IP's, the accounts would get banned within a day. So I continuously had the IP's changed but with no improved results, everything would get banned. Yet anything I ran on these other 3 IP's nothing would happen to them. So for about a span of 2 months, I really only used the same 3 IP's because every other IP I tried using, accounts would get banned within a day on them. 

 

Anyway, this shit is so confusing. But I really think a major factor comes down to IP's. I just don't see how else I could possibly get banned this quick. Like I said above, I have 1 account running on what I believe to be a "flagged" IP, and I'm almost guaranteeing that tomorrow when I wake up and check the VPS the only account that is going to be disabled is going to be that one.

 

I really wish you'd guys could hurry up and introduce proxy support for mirroring. I really want to run 2 of my accounts on a "flagged" IP, one account running via mirroring and one account via standard mode and see the outcome. 

 

They are working as fast as they can I promise. That would be a great test though. Keep us updated on what  goes on.

[mustafa66]

not banned yet botting for 2days

[Isolate]

What we should do in the future, is write a tool that makes the OSRS client use a different random.dat (spoofed) file for each account 

Looks Familiar :P

[Maxi]

I don't understand how you can say they most likely do not ban based on IP. I honestly think the IP in which you are botting on is a HUGE factor when it comes to getting banned. 

 

Within the past few days I had all of my proxies switched over to a new subnet. None of the IP's I was given have been distributed to anyone except me while under the control of this particular supplier. Whatever these IP's have been used for since their existence is obviously unknown, but they have not been used for Runescape while being sold under this specific seller. 

 

 

This past Monday, I started botting 5 accounts using 3 of the IP's. Today when I woke up around 1:30PM EST, I checked my VPS to see that one of the accounts had gotten disabled. The IP that this account was running on was the IP that was most recently put to use. I see absolutely no reason this account should have gotten banned other than the fact the IP was flagged in some way. What I have now done is taken 1 account that has been botting fine for the past few days and stuck it on the IP I think is flagged. If this account is the only account disabled tomorrow, there is literally nothing else that could be causing it to get caught so quickly other than it being the IP.

 

Before having my IPs switched to the IP's I currently have, there were these 3 IP's that I ran accounts on that legit would last for extended periods of time before eventually just getting caught. I had multiple accounts last at least 3 bond uses. These account's ran every single day for 12 hours a day doing the exact same thing. Whenever I wanted to add more bots, I needed to get more proxies. Obviously, I purchased proxies from the same place yet every time I'd try to run bots on these new IP's, the accounts would get banned within a day. So I continuously had the IP's changed but with no improved results, everything would get banned. Yet anything I ran on these other 3 IP's nothing would happen to them. So for about a span of 2 months, I really only used the same 3 IP's because every other IP I tried using, accounts would get banned within a day on them. 

 

Anyway, this shit is so confusing. But I really think a major factor comes down to IP's. I just don't see how else I could possibly get banned this quick. Like I said above, I have 1 account running on what I believe to be a "flagged" IP, and I'm almost guaranteeing that tomorrow when I wake up and check the VPS the only account that is going to be disabled is going to be that one.

 

I really wish you'd guys could hurry up and introduce proxy support for mirroring. I really want to run 2 of my accounts on a "flagged" IP, one account running via mirroring and one account via standard mode and see the outcome. 

They ban IP's but not based on the actual IP. They ban the ip's based on the uid in the random.dat file. It helps them track accounts that are related to each other. They then used that information to ban ip's and accounts.

[irwtonrs1]

They ban IP's but not based on the actual IP. They ban the ip's based on the uid in the random.dat file. It helps them track accounts that are related to each other. They then used that information to ban ip's and accounts.

Can you elaborate a bit more? I don't quite understand the whole UID thing.  

[Eri]

who cares?