*UPDATE*
So in case any of you were wondering which method Jagex used it was "mix up the IDs." Actually if the information provided was correct "mixing up the item IDs" is the least of of our worries. Since now every item instance is an object in a giant array(list). Thank you Trent for providing the link to this leak.
So Jagex has made another idle threat...or is it idle? We currently know very little about how Jagex will do it but we do know that it is aimed at:
1. Reflection (Nexus client aka. rsbots.net):
http://services.runescape.com/m=news/c=S73Xvn335ro/bot-busting-and-bonuses-for-all
2. BCEL, or byte code injection: (RSbuddy and powerbot):
(http://services.runescape.com/m=forum/c=sX-40WHN8D0/forums.ws?15,16,791,63289799,goto,4
The problem with the threat that Jagex has made is that often in the past they have not been able to follow through. Also both reflection and bcel are native to the Java language meaning that as long as Jagex uses java their client can be exploited.
How Jagex has tried to prevent botting in the past:
In the past Jagex has tried to prevent bots from working by obfuscating the clients code after every update. Everytime the client was obfuscated the "hooks" used to get variable input changes. By the way this is one of the reasons you have to wait for bot developers to get their clients back online. Many bot developers have sped up this process by writing scripts to accomplish this for them.
Why is Java Different:
However, unlike most languages Java is interpreted before it is compiled meaning that a Java program can "read its own code" before it is compiled into byte code and then read by the JVM (Java Virtual Machine) and then by the physical CPU. This is how most clients exploit the Runescape client and this method is commonly known as reflection and is undetectable by Jagex. Byte Code Injection is slightly different in the way it works but accomplishes roughly the same thing. It not as subtle and in theory detectable (although Jagex does not detect it) but is much faster than reflection.
So how will they stop it?
This is the question that bot developers have been asking themselves for the past day. Currently there is no way to prevent a java programs variables from being read during run-time simply because of the way it is interpreted/compiled. However we should not assume that Jagex has not found a way to prevent it. In the past they have been on the vanguard of pushing the Java language to doing incredible things...just look at the graphics running in a browser...holy shit! ....... Still, I have my doubts.
Rewrite the client?
There is also the possibility that they change the language in which the client is written....I know, I know. How could they possibly change the code of an entire game like RS. They wouldn't the client is only responsible for sending user input and interpreting information sent from the server. In theory writing an entirely new client from scratch would be a monumental task, but mods did say the project was being worked on for months. Also Jagex has experimented implementing other languages into there game-engine such as open-gl and directx for rending graphics and for years now they have experimented with porting to game consoles (which are not typically very friendly with Java).
Applet to Application?
The disadvantages to this are very high...For one java is very browser friendly. There are not really very many languages that could be implemented the way java is in the browser..."Jagex I swear to God if you use flash I will come down to Cambridge and kick you all straight in the balls." Is it possible that Runescape may move away from its browser based client and switch to an installable binary? I hope not. They could of course accomplish the same while keeping it browser based by implementing ActiveX. However the problem with that would be compatibility since not all operating systems are capable of running the ActiveX plugin.
Other possibilities...
If all else fails Jagex may seek to write a proprietary plugin to run from browsers. The plugin would require players to download to play and would then load up the client. It's not completely unheard of after all Jagex has already written it's own server-side scripting language...(you may have noticed the .ws extension almost all of their pages)
*EDIT*
I thought I might add Wolfdog's idea up here as well because it is very insightful. Jagex code named the project: Cluster-Flutter. Wolfdog's interpretation of this is that Cluster stands for the vast database of items/objects (IDs) and Flutter stands for the randomization of these values. As each item has an object/item in the game has an object ID, and scripts call these objects, randomizing them could have a huge effect on botting clients. For example a flax picking script will click on any object with that shares the same integer value as flax. If Jagex was able to randomize these item IDs a scripts would begin to behave randomly and while one second they would be clicking on flax the next they would be attempting to "pick sheep."
So in case any of you were wondering which method Jagex used it was "mix up the IDs." Actually if the information provided was correct "mixing up the item IDs" is the least of of our worries. Since now every item instance is an object in a giant array(list). Thank you Trent for providing the link to this leak.
So Jagex has made another idle threat...or is it idle? We currently know very little about how Jagex will do it but we do know that it is aimed at:
1. Reflection (Nexus client aka. rsbots.net):
http://services.runescape.com/m=news/c=S73Xvn335ro/bot-busting-and-bonuses-for-all
2. BCEL, or byte code injection: (RSbuddy and powerbot):
(http://services.runescape.com/m=forum/c=sX-40WHN8D0/forums.ws?15,16,791,63289799,goto,4
The problem with the threat that Jagex has made is that often in the past they have not been able to follow through. Also both reflection and bcel are native to the Java language meaning that as long as Jagex uses java their client can be exploited.
How Jagex has tried to prevent botting in the past:
In the past Jagex has tried to prevent bots from working by obfuscating the clients code after every update. Everytime the client was obfuscated the "hooks" used to get variable input changes. By the way this is one of the reasons you have to wait for bot developers to get their clients back online. Many bot developers have sped up this process by writing scripts to accomplish this for them.
Why is Java Different:
However, unlike most languages Java is interpreted before it is compiled meaning that a Java program can "read its own code" before it is compiled into byte code and then read by the JVM (Java Virtual Machine) and then by the physical CPU. This is how most clients exploit the Runescape client and this method is commonly known as reflection and is undetectable by Jagex. Byte Code Injection is slightly different in the way it works but accomplishes roughly the same thing. It not as subtle and in theory detectable (although Jagex does not detect it) but is much faster than reflection.
So how will they stop it?
This is the question that bot developers have been asking themselves for the past day. Currently there is no way to prevent a java programs variables from being read during run-time simply because of the way it is interpreted/compiled. However we should not assume that Jagex has not found a way to prevent it. In the past they have been on the vanguard of pushing the Java language to doing incredible things...just look at the graphics running in a browser...holy shit! ....... Still, I have my doubts.
Rewrite the client?
There is also the possibility that they change the language in which the client is written....I know, I know. How could they possibly change the code of an entire game like RS. They wouldn't the client is only responsible for sending user input and interpreting information sent from the server. In theory writing an entirely new client from scratch would be a monumental task, but mods did say the project was being worked on for months. Also Jagex has experimented implementing other languages into there game-engine such as open-gl and directx for rending graphics and for years now they have experimented with porting to game consoles (which are not typically very friendly with Java).
Applet to Application?
The disadvantages to this are very high...For one java is very browser friendly. There are not really very many languages that could be implemented the way java is in the browser..."Jagex I swear to God if you use flash I will come down to Cambridge and kick you all straight in the balls." Is it possible that Runescape may move away from its browser based client and switch to an installable binary? I hope not. They could of course accomplish the same while keeping it browser based by implementing ActiveX. However the problem with that would be compatibility since not all operating systems are capable of running the ActiveX plugin.
Other possibilities...
If all else fails Jagex may seek to write a proprietary plugin to run from browsers. The plugin would require players to download to play and would then load up the client. It's not completely unheard of after all Jagex has already written it's own server-side scripting language...(you may have noticed the .ws extension almost all of their pages)
*EDIT*
I thought I might add Wolfdog's idea up here as well because it is very insightful. Jagex code named the project: Cluster-Flutter. Wolfdog's interpretation of this is that Cluster stands for the vast database of items/objects (IDs) and Flutter stands for the randomization of these values. As each item has an object/item in the game has an object ID, and scripts call these objects, randomizing them could have a huge effect on botting clients. For example a flax picking script will click on any object with that shares the same integer value as flax. If Jagex was able to randomize these item IDs a scripts would begin to behave randomly and while one second they would be clicking on flax the next they would be attempting to "pick sheep."
-fingers crossed-
