How Jagex will do it.

*UPDATE*

So in case any of you were wondering which method Jagex used it was "mix up the IDs." Actually if the information provided was correct "mixing up the item IDs" is the least of of our worries. Since now every item instance is an object in a giant array(list). Thank you Trent for providing the link to this leak.

So Jagex has made another idle threat...or is it idle? We currently know very little about how Jagex will do it but we do know that it is aimed at:

1. Reflection (Nexus client aka. rsbots.net):

http://services.runescape.com/m=news/c=S73Xvn335ro/bot-busting-and-bonuses-for-all

2. BCEL, or byte code injection: (RSbuddy and powerbot):

(http://services.runescape.com/m=forum/c=sX-40WHN8D0/forums.ws?15,16,791,63289799,goto,4


The problem with the threat that Jagex has made is that often in the past they have not been able to follow through. Also both reflection and bcel are native to the Java language meaning that as long as Jagex uses java their client can be exploited.

How Jagex has tried to prevent botting in the past:

In the past Jagex has tried to prevent bots from working by obfuscating the clients code after every update. Everytime the client was obfuscated the "hooks" used to get variable input changes. By the way this is one of the reasons you have to wait for bot developers to get their clients back online. Many bot developers have sped up this process by writing scripts to accomplish this for them.

Why is Java Different:

However, unlike most languages Java is interpreted before it is compiled meaning that a Java program can "read its own code" before it is compiled into byte code and then read by the JVM (Java Virtual Machine) and then by the physical CPU. This is how most clients exploit the Runescape client and this method is commonly known as reflection and is undetectable by Jagex. Byte Code Injection is slightly different in the way it works but accomplishes roughly the same thing. It not as subtle and in theory detectable (although Jagex does not detect it) but is much faster than reflection.

So how will they stop it?

This is the question that bot developers have been asking themselves for the past day. Currently there is no way to prevent a java programs variables from being read during run-time simply because of the way it is interpreted/compiled. However we should not assume that Jagex has not found a way to prevent it. In the past they have been on the vanguard of pushing the Java language to doing incredible things...just look at the graphics running in a browser...holy shit! ....... Still, I have my doubts.

Rewrite the client?

There is also the possibility that they change the language in which the client is written....I know, I know. How could they possibly change the code of an entire game like RS. They wouldn't the client is only responsible for sending user input and interpreting information sent from the server. In theory writing an entirely new client from scratch would be a monumental task, but mods did say the project was being worked on for months. Also Jagex has experimented implementing other languages into there game-engine such as open-gl and directx for rending graphics and for years now they have experimented with porting to game consoles (which are not typically very friendly with Java).

Applet to Application?

The disadvantages to this are very high...For one java is very browser friendly. There are not really very many languages that could be implemented the way java is in the browser..."Jagex I swear to God if you use flash I will come down to Cambridge and kick you all straight in the balls." Is it possible that Runescape may move away from its browser based client and switch to an installable binary? I hope not. They could of course accomplish the same while keeping it browser based by implementing ActiveX. However the problem with that would be compatibility since not all operating systems are capable of running the ActiveX plugin.

Other possibilities...


If all else fails Jagex may seek to write a proprietary plugin to run from browsers. The plugin would require players to download to play and would then load up the client. It's not completely unheard of after all Jagex has already written it's own server-side scripting language...(you may have noticed the .ws extension almost all of their pages)

*EDIT*

I thought I might add Wolfdog's idea up here as well because it is very insightful. Jagex code named the project: Cluster-Flutter. Wolfdog's interpretation of this is that Cluster stands for the vast database of items/objects (IDs) and Flutter stands for the randomization of these values. As each item has an object/item in the game has an object ID, and scripts call these objects, randomizing them could have a huge effect on botting clients. For example a flax picking script will click on any object with that shares the same integer value as flax. If Jagex was able to randomize these item IDs a scripts would begin to behave randomly and while one second they would be clicking on flax the next they would be attempting to "pick sheep."

 

Interesting post, you've covered the bases rather well

 

Wow, learned quite a bit reading through your post, you seem to be on top of your stuff.

My take is this...the Botting world is too profittable to just "give up" and abandon.

Seeing as how Runescape is Java based, I'm sure the developers over at RsBuddy/Rsbots.net/etc will figure a way to combat and implement their respective botclients.

Only time will tell, 4 days til we really see what Jagex has in store for us.

 

Interesting post. Thanks for sharing.

I like how you explained. But you, just like I do, we'll work a way around if they limit us in anyway.

 

This is an excellent post, I actually enjoyed reading it. Thanks for the post. Hope to get 80 - 85 dunge before this new update.

 

It will only impact the botting situation for a short period of time, before they are forced to /facepalm themselves.

Bots will always be around, regardless of their methods.

 

Examing the name, I now believe they will be implementing a regular ID change to ALL items in rs.

Cluster (remember, this is just my theory) is going to be variables (therefore ID's) of objects in-game

Flutter indicates the movement of these id's, possibly rapidly.



I dont see why this would not work, as getting the ID's for every object ingame if they were constantly changing would prevent bots (particularly injection and reflection) from working at a decent rate. Now, forgive me if I'm ignorant about a method or something Jagex uses. I've done some scripting for powerbot, but nothing on a HUGE basis, so I could be wrong.

Thoughts on ClusterFlutter?

OP: if you view this as relevant, please consider adding me to the OP

IF they developed certain aspects to the game, I believe this could easily be done. It would take work and some decent knowledge, but who knows.

 

You have to consider also though that if there is a game there will always be a way to cheat it, I mean you can go back through history and any form of competition has methods to cheat it. So no matter how try hard jagex is they will never stop botters.

 

I don't know why but this thread was briefly closed. One of the mods was kind enough to reopen it. Thanks!

 

Very interesting,

I think this is most likely.

 

Normally, Jagex's threats don't scare me however this one did. Especially because they claimed a direct attack on a specific botting code that many of us are familiar with. Normally Jagex's posts are filled with things like, "there is no such existence of said thing" or "we're trying out best to fight this" but this time its direct and specific. HOWEVER, in the end, Jagex is a company. Its a business who's owner's intent is to create revenue and income for himself. The use of bots may annoy people, but the ratio of people quitting due to bots vs. People who bot and pay for membership substantially leans towards those who use bots and pay for the membership. Jagex obviously knows this and it would be a stupid business move to kill off one of the main reasons that the company is bringing in revenue. I know this is off on a tangent from the intent of the original post so I'll finish off by saying that even if the complete removal of bots is possible, its a stupid business move.

 

Yes, I agree with this as well...I've made the joke before "If Jagex wanted to get rid of annoying botting clients and make money at the same time they should make a right click 'bot skill' option.

I really don't understand it maybe they believe that anyone paying money to bot care enough about the game to play it for real...What they may not realize is that for every botter's "main" account there are 5 to 10 gold farming bots (each of which pay Jagex money).

 

I question it.

http://sythe.org/showthread.php?t=1259963

 

are you implying they can now detect reflections? so any account that has opened up rsbots or rsbuddy clients will be banned? This is the biggest question I want answered.

 

They won't make a downloadable client because a big attraction for runescape these days is that you can just type in the website and play it. People these days are very scared of downloading things, they think everything has a virus.
They'd lose quite a lot of new people interested in playing the game. E.g. Randomly see the game on miniclip, click it and then it's asking for them to download and they'll usually just exit out. No matter how big the download is. I always do this I cbf, downloading it, setting it up etc.

 

No, I am not implying that. What I am saying is they will not have to detect reflection because they will no longer be using a client written in Java. Whether they actually switch to a new client or not remains to be seen. Also I like Wolfdog's idea about randomizing item and object variables...

Jagex can and never will detect reflection. Java reads down and the reflection class is higher up on the stack.

 

Very insightful. Thankyou for the post.
I really am excited and scared for the update though. I just hope it doesn't destroy my businesses.

 

I hope not to but I do have a bad feeling about this...my guess is that at least most botting clients will be down for weeks...at most maybe a few months. RSbuddy and Nexus clients have a good thing going and very strong communities backing them up. Even if they had to completely recode their clients to read in game data differently I don't they would let that stop them.

I'm confident that although this update will be annoying and a minor setback most botting clients will be operational by 5-10. If for some reason reflection and BCEL no longer become a viable way to glean data we may be looking at something closer to 2-3 months...Just because a visual client would take time and testing... before it would work.

 

Like you said, they have a very strong community of a lot of very talented coders. I think we will see the bots, if rendered useless, back up in around a month as a beta. If you look how long it take RSBuddy to update after a game update it is just a matter for a few hours - they appear to have a crack team. I think we all might have to play legit for a little while, but maybe this will calm down the banning some and when Jagex thinks all bots are dead we hit them with another bot wave just to make them /facepalm.

 

Wow thank you so much for this post! I didn't know at least 40% of the stuff you posted lol. I'm hoping that the bot programmers will beat Jagex once again -fingers crossed-