How does Jagex detect bot clients?

[GSC]

I really wasn't able to find a proper section for my question but I think it could be appropriate here since this could perhaps educate and help the users. It is pretty much common knowledge that Jagex can detect which client you're running. And it is speculated that this might be one of the ways they're detecting bots.

 

Quoting Maxi from the mirror mode topic:

 

The first strategy is done by detecting whether the RS client that runs is modified or not and whether it is running in it's natural environment. The way current way most bots work is by downloading the RS client and modifying the client to be able to communicate information of the game with the bot engine. There are ways around it, but the way RS currently has their system set up means that battling their strategies to detect bots on a code level are meant to break and would require a lot of updating. Basically using a bot these days or for example RSBuddy (a runescape helper, not a bot) just plain out tell RS that they are bots.

 

My question is how do they exactly discern which client you're running? Is it based on the behavior of the client (how it loads resources etc.)? If so, wouldn't it be possible to mimic other clients like OSBuddy? Or is it based on Jagex somehow monitoring the client's internal state and detecting the hooks? If so, wouldn't it be possible to defeat all their checks because you have full control over the code which is running?

 

Would a dev be willing to shed some light on this? Or is it too deeply involved in how the bot works?

Edited March 29, 2015 by GSC

[Czar]

There's a packet within the RS client which checks if the client has been modified (injected in our case) and that seems to identify the fact that the player is using a bot client. 

 

Then, as maxi said, the second strategy involves profiling using their fancy analyzers etc, I really don't know anything about that, but it seems the most likely answer.

 

EDIT:

 

and the way mirror works, is by copying the original runescape JVM, injecting it, then sending back the data, so the original jvm is not modified at all. Feel free to correct me if i'm wrong!

Edited March 29, 2015 by Czar

[GSC]

Thanks for the reply

 

There's a packet within the RS client which checks if the client has been modified (injected in our case) and that seems to identify the fact that the player is using a bot client. 

 

Don't we know how the RS client actually checks if the client has been modified? So wouldn't it be pretty straightforward to manipulate the checks to return values like the original RS client would? Jagex supplies us the original client so surely we should be able to know what to return.

 

Or are the checks overall so complex that something like mirror mode is simply more feasible?

 

Then, as maxi said, the second strategy involves profiling using their fancy analyzers etc, I really don't know anything about that, but it seems the most likely answer.

 

Are you referring to how they detect the scripts by their behavior? Or are they actually profiling how the client performs in some way? 

 

 

and the way mirror works, is by copying the original runescape JVM, injecting it, then sending back the data, so the original jvm is not modified at all. Feel free to correct me if i'm wrong!

 

Sounds good. Maxi said that even the mirror mode could be detected. If it modifies the original JVM in no way, how could it be detected unless Jagex decides to run some native code?

 

E: I'm asking a lot of questions here so don't feel pressured to answer. Just throwing it out there if anyone wants to clarify.

Edited March 29, 2015 by GSC

[Maj0r]

"Mirror mode" is a very clever idea from mangis, and knowing how it works I think it's very difficult if not impossible for Jagex to detect, even with native code.

 

The first method Maxi posted about has been hypothesised about for a long time, but back when this was originally discovered (~2009-2010) Jagex never used it in an attempt to identify bots (although this may not be the case with OSRS). Some of the methods of bot detection in older clients (3xx-4xx) are simple, such as ensuring the client window is focused when a user clicks (which it would be if a real user was clicking) and sending data about the position and timing of the mouse clicks (both of which OSRS still does). 3xx has no additional systems, but 4xx might (which is what the OSRS client is based upon, if anyone is unfamiliar with RS builds).

 

RS3 has a nice system jacmob created but OSRS does not have this implemented (at least, not yet).

Edited March 29, 2015 by Maj0r

[Sheeraano]

I thoughti t was thru alot of people doing the same movements , and gaining alot of XP. For example a lvl 3 fresh created. Have 44 hours since creation. Been playing for 40 hours of those.