.

[XiaBot]

.

 

[rsjg]

Hi I'm really excited about this bot! I'm preparing for the release 23nov so I'm about to order a tablet I should order the Amazon fire hd 8 8th generation right?

Thanks!

 

[XiaBot]

.

 

[Madmaniac]

Quick question:
Does XiaBot have "dismiss random event" capabilities? Adding scripts to allow such would likely minimize detection, since Jagex likely watches the rates of ignored randoms.

 

[rsjg]

It's great to hear you are interested and, yes, that's the one. If you have any trouble, let us know and we'll take care of it.

My amazone fire hd 8 2018 is on its way! Will be delivered 22nov so right on time for the release! And thanks looking forward to use this unique bot!

 

[Fast Coins]

Ok, so how does it work?
I need to install an apk on Android side, I guess? Also have a jar file I need to run on Windows, then choose my skill and "start" it? So the android program listens for that "start" event (along with different parameters) from the server, I suppose.

I need to be in certain spots for this program to work, right? And it is strictly doing the skill, that is, no banking, walking etc?
This all seems really flimsy if only color-detection is used, especially the combat ones. If it screws up... you are done.
I could see a use when doing bank-standing stuff, maybe.


Who is this bot for, exactly?

 

[XiaBot]

.

 

[Fast Coins]

Thank you for the reply.

The procedure is essentially as follows:
Launch Bot on PC --> Connect Tablet to PC (With Account Ready For Training) --> Select Your Training Method on Bot GUI --> Click Start

After a few seconds, you should see the bot running on the tablet as well as the GUI light up green, signaling that the bot is running. At this time, it's no longer necessary for you to have the GUI open, so you can close it out if you'd like. You can also disconnect your tablet from your PC and plug it into a more reliable charging source such as a wall socket.

Something that controls the "clicking" must be on the tablet side of the things. Does the Bot on PC transfer something to the tablet? Why does it have to be initially connected to PC?
Also, say I have 10 bots/ tablets. Each time I want to switch a task (or stop it) I need to connect it to the PC?

 

[XiaBot]

.

 

[its got alcohol]

how do i use this. i want this.

 

[XiaBot]

.

 

[HandFarmer]

A few red flags I've identified:

1) Extremely simplistic bot scripts which literally have like 3-4 clicks that can easily be simulated by some touch recording software.

2) As a programmer, the fact that you don't realize running TeamViewer and your own private app are essentially the same as far as detection goes is troubling. If the osrs mobile app has the capability to detect running apps or processes, it doesn't matter if it's teamviewer or xiabot that is running, it can be detected if it is not completely obsfuscated at a system level (aka rooted).

3) The language and excuses you used for "input heuristics" being a main reason that you can only program the bot on one platform is troubling. I understand if you're using point and click logic based algorithms that only work with a very specific resolution (aka device). That is a small hurdle, but the scripts available are literally so simple any mediocre programmer could simply rewrite a tiny part of the code and get it to work on an entirely new device (if resolution is not a defined parameter of the program, which it should have been from the start foe obvious scaling reasons). "Input heuristics" for mobile devices is as simple as a capacitive wire grid detecting where a voltage drop occurs from touch and processes the location of the voltage drop to accurately pass off x and y coordinates to the system for interaction...

4) You mention it is nothing like teamviewer, yet it needs to be remotely executed and terminated from a secondary device? Honestly, and I'm going to be brash here, what the actual fuck. This wreaks of novice programming or malicious intent. Does it access any remote server even if it is on a LAN? What protocols are used to communicate between host and client device? Again, don't pretend this is for "detection security". This is negligent of all security rules, especially when you could have made the apk run on the mobile device because I'll say it again, if Jagex has detection of running processes it does not fucking matter what is being ran, they will have anti bot heuristics that establish those processes (even if named complete nonsense in the process list or randomized per client) based with other things like play time, actions done and more to ban the fuck out of people. Opening ports or allowing unauthenticated communication over existing ones is the biggest fucking security hole in any private or public network and frankly you should be ashamed when it is so obviously avoided with no drawback.

5) The bot runtime of 20/24 hours a day is obviously problematic for anybody who knows the heuristics (here we are with this word again) of bot detection are indipendent of device/OS used. But this is just a small detail, maybe they actually dropped the ball on detection for mobile users.

By no means take this as an attack. You could actually spin this in a positive direction if you are indeed authentic. If you have an actual working product that's great, but your language and understanding of simple computer and networking systems is heavily flawed to the point that it makes you look like you have no idea what you're talking about, which can obviously deter customers. The use of "computer jargon" is mostly vague to the point of ignorance and makes the whole project suspect, including the implementation of the most basic scripts imaginable that are exhibited for a short duration of time. Perhaps you can put us all at ease by refraining from misuse of technical jargon and actually clearly refute the few red flags I cared to mention about basic programming and networking. I look forward to your short and concise response, we don't need any more novels and deflection.

Could just be a case of a novice programmer "fluffing" themselves up. And Jagex may have really dropped the ball in mobile detections.

Edit: By the way, OSRS has no app permissions for android. This means it leaves them legally liable for reading any process lists.

 

[XiaBot]

.

 

[HandFarmer]

Oh man, this level of bullshit is really getting annoying at this point. You almost entirely disregarded the objective facts I've stated and continue to show incompetence, as detailed below.

Agreed. The majority of training methods and activities in OSRS are done through very simple and repetitive actions. That's how the game is played, not sure what your point is.

Actually, scripts can get very complex. You show a salamander script that does 3-4 clicks and delays a specific time. Which is why I made comments about touch recording software being able to easily mimic that. Surely you can see the difference between clicking 3-4 buttons which are always in the same place and something as complex as an active combat bot or even a zulrah bot. Why are you trying to argue that your salamander bot video you showcased isn't weak as fuck?

The reason I was critical of TeamViewer in the previous post stems from a different method of detection, which is through the heuristics of the input. TeamViewer's input signature is very distinguishable.

I really tried to fucking save you from embarrassing yourself, but here you are again just spouting nonsense jargon and industry buzz words that make no sense in the context you're using them in. What do you even mean by input signature? Please explain because I'm having a hard time understanding you at this point. The input data that is passed when in relation to a mouse are coordinates and what switches in the mouse are being hit (left click, right click). Whether this is passed through the native device or a remote host via port is of little relevance.

To your point, another way to detect a bot could be though searching the process list for the bot string. It's well-documented that Blizzard (Warden) uses this method, in addition to others, for bot detection. In summary, Warden conducts active RAM scans and polls the process list, which makes it very difficult to read/write the game's memory contents without staying undetected. This has been taken into account since the XiaBot process essentially mimics the appearance of various core Android processes, which, even if identified in a process list, wouldn't be conclusive evidence of any wrongdoing. We do not touch the native memory heap of OSRS, nor do we hook into any of it's methods.

Didn't I already explain the process list is a potential way of detection? Why are you just repeating what I say?

'Mimicking' the process of a core android system function is useless to any real detection by the way. I'm guessing you just renamed it and called it good anyways, LOL. Luckily the OSRS app does not require read or write privileges.

Naturally, this bot detection methodology is fairly intrusive and many governing bodies, including the Electric Frontier Foundation, classify Warden as spyware. Henceforth, Blizzard makes sure to include a clause in their End User License Agreement:

"Consent to Monitor. WHILE RUNNING, THE PLATFORM (INCLUDING A GAME) MAY MONITOR YOUR COMPUTER OR MOBILE DEVICE'S MEMORY FOR UNAUTHORIZED THIRD PARTY PROGRAMS RUNNING EITHER CONCURRENTLY WITH A GAME OR OUT OF PROCESS."

I'm almost 100% certain that OSRS doesn't use this method of detection because they make no reference to this in any of their legal documents.

It's nice to look at the EULA, but as the app requires no permissions, which I already stated in my previous post with an edit yesterday after being interested in it myself, the OSRS app does not appear to have that functionality. So therefor it is not reading contents on a phone (to my knowledge).

Currently, the main priority is to establish stability with our first platform before spending time and resources on other devices. We haven't even released the bot yet, all we want to do is have a successful launch right now. After we have received sufficient feedback towards additional training methods/supported devices, we will prioritize accordingly. The resolution difference plays a part, but this doesn't take much time to adapt. The input heuristics in Android contain several different variables that range greatly from one hardware manufacturer to another. This was observed during the early stages where we tried out dozens of different mobile devices.

This is so painful to read. Even after I explain the heuristics of capacitive touch sensors that literally every mobile touch screen device uses. It's like you're not paying attention at all and think you can just say "input heuristics" over and over again to attempt to appear competent. To somebody who actually knows the underlying fundamentals of the technology in these devices it's painfully obvious, you do not. So why are you trying to deceive everybody? Cite examples as I have or concede. I don't think anybody reading this with capability of googling is convinced by you.

As you might have guessed, it takes a considerable amount of time and effort to manually generate human input and accurately build our models from the aforementioned data.

Input this, input that, DATA, HEURISTICS. Spare us already! No, it actually takes little to no time to "manually generate human input". Literally touch a spot on the screen, WOAH MANUAL HUMAN INPUT. And if you're generating human input manually, did you just confirm that you use a touch screen recorder?

Regardless, given the nature of the bot, your device has to essentially be dedicated to the game. I certainly know I wouldn't be using my main phone as my bot platform because I'm usually using it for other things. I'm sure many other people out there feel the same way. Therefore, it seems to make the most sense to have a dedicated device for the bot that's as cheap and accessible as possible, like the Amazon Fire HD 8. If people want other devices to be supported, we can always adapt to that.

I mean yeah, if you're using 1 to 1 input that isn't in a virtual environment or container, it would be beneficial to have a dedicated device so you can use your normal devices. This is pretty obvious...

If you took the time to observe the setup tutorials, you would see that ADB is required for this bot to work. This should give you a fairly obvious indication of what's happening. No LAN or WAN network protocols are being used. No network ports are being opened. We understand security is a serious concern, but you need to relax.

For the love of...AND I QUOTE:
"When you start an adb client, the client first checks whether there is an adb server process already running. If there isn't, it starts the server process. When the server starts, it binds to local TCP port 5037 and listens for commands sent from adb clients—all adb clients use port 5037 to communicate with the adb server. (Android Debug Bridge (adb) | Android Developers)"
Server < Daemon < Client
You quite clearly have no fucking idea what you're talking about at this point. I'm dropping the mic.

In addition to providing a solid proof of concept, the betas were treated as opportunities for us to really flex the power of the bot in regard to hours played and undetectability. However, just because you have the ability to run your bot almost indefinitely and probably get away with it, doesn't mean you should. In regard to responsible use, it's important to not get complacent and believe that you are 100% bulletproof because this is usually when things start to go wrong. We will be creating guidelines surrounding responsible use before release, just like basically every other bot out there.

Weird flex. This is a yikes from me, dawg. Hard pass, and I encourage anybody to use a free touch screen recording app instead of whatever the fuck this is going to turn out to be which even the "developer" lacks knowledge of the basic protocols they're using.

Here's a dude literally bragging about running a fletching bot for 10 days staight that he recorded on mobile with a free app. 07 Mobile afk fletching bot / will work as moneymaker aswell
Cya.

 

[XiaBot]

.

 

[HandFarmer]

LMAO

If you aren't comfortable using ADB, I'm not sure what I can do to help you. No custom ports are being opened, no custom protocols are being used, no crazy unauthenticated communications are being passed back and forth.

ADB is fine, you had no understanding of how it worked or that it used ports. Hardcore fail. And now you try to brush it off by making it seem like I was the one who was wrong .

No LAN or WAN network protocols are being used.

Here's the literal definition.

TCP (Transmission Control Protocol) is a standard that defines how to establish and maintain a network conversation via which application programs can exchange data.

What is TCP (Transmission Control Protocol)? - Definition from WhatIs.com

And again, from ADB themselves,

When the server starts, it binds to local TCP port 5037 and listens for commands sent from adb clients—all adb clients use port 5037 to communicate with the adb server.

It's just pathetic, honestly. Don't pass yourself off as some sort of developer. This is all smoke and mirrors with redundant and useless industry buzzwords. But I guess shouting 'heuristics', 'algorithms', 'input data' and whatever else is enough to confuse and trick most of the public, isn't it?

Active sand/rock crabs can happen if this is what folks want. NMZ is supported right now, which should cover most people who want to train combat. Sorry you were disappointed in the salamader script, is that not how the skill is trained? Zulrah could happen too, but this would take time.

NMZ scripts are clicking a few things every so often...just further proving you really aren't grasping the concept that you are only doing things which require very little to no skill. Hence why I mention a touch screen recorder app multiple times as that takes little to no skill as well.

The way it's passed is of little importance, look at the click from an application perspective.

You really aren't able to understand that a mobile device operating system and computer operating system use the same coordinate operated inputs with press/hold switches (or left and right click)? You realize android is based on linux right?

You don't need Android permissions to do that, but thanks for looking out for me.

I assume you need permissions to scan process lists and memory. I'm not an android developer, though.

You explained the general framework of how the electrical current runs through the device when you touch the screen. Look at the click from an application perspective and you will see that the patterns vary greatly from one another.

They don't differ at all on a functional level. The application perspective is the same as linux as android operating systems was/are created from modified linux kernels. They still operate on an x,y coordinate grid and switch mechanisms...with android it is tap/hold based on a capacitive grid instead of using a mouse with left or right click switches. You're making non arguments now after being outed. Ever heard of Samsung SideSync? Look it up.

No. All the human input was generated by a human.

LOL? Obviously. The point was that the generated data is a tap of a screen so you saying it "takes a considerable amount of time and effort to manually generate human input and accurately build our models from the aforementioned data" is false. As you mentioned in your own words,

"The majority of training methods and activities in OSRS are done through very simple and repetitive actions. That's how the game is played, not sure what your point is."

It's so contradictory I hardly need to point it out.

If you don't want to use XiaBot, you certainly don't have to. Good luck.

Good luck trying to acquire customers after clearly demonstrating you're not really a developer and can only make simple scripts that a free touch screen recorder can do better and easier.

You're trying to sell something that is literally free, and the free versions of existing apps do it better and can be customized more by the user with less hassle and are not device specific...what value are you adding with your service? Taking out the 10 seconds it takes somebody to record their mobile taps?

You keep moving the goalposts as soon as you're shot down with provable and verified technical arguments. It's time to stop pretending.

 

[XiaBot]

.

 

[HandFarmer]

I lol'd at "click algorithm". You actually said click algorithm non-ironically looool

You can try and take shots at me now because you're threatened, but I have used rooted androids remotely connected to computers where the touch funcionality worked perfect using a mouse on the computer.

A more modern and less buggy comparison Samsung SideSync. Ever heard of it? Argument over, you lose.

 

[XiaBot]

.

 

[HandFarmer]

SideSync is essentially reverse TeamViewer. This can be detected very easily, just like the others. Take care.

You run a literal ADB daemon on the client devices and talk about detection...are you ok in the head? You still don't realize you were making non arguments the whole time and continue to do so?

Dang man, I just feel bad at this point tbh. You really have very little to no idea what you're talking about.