I think I've found out how Jagex detect bots

[Aaron C]

So basically I think I've stumbled upon how Jagex detect bots whilst I was wondering why my botting method wasn't getting me banned.

What I did was I created a very simple cannon bot using AutoHotKey, the idea behind it was if the bot only clicked randomly on the cannon and waited randomly between actions and the client was sandboxed so even if Jagex could they wouldn't be able to detect anything, and it simulated tapping on the screen so there is no mouse movement, then Jagex would be unable tell if it was a human or a robot clicking the cannon, right? No. Let me tell you why.

So as we know, a smart bot will wait a RANDOM amount of time between actions, and will click RANDOMLY in set area to avoid detection, right? Jagex knows this. So what I believe Jagex did was they asked, can you detect a random number generator? A pseudorandom number generator (PRNG) uses an algorithm which can be detected, this is because true randomness is impossible for turing machines, theoretically.

I use "Random" function in AutoHotKey to generate a random number for each mouse click (tap) coordinates and wait times, so I read the docs and found out this:

"This function uses the Mersenne Twister random number generator, MT19937, written by Takuji Nishimura and Makoto Matsumoto, Shawn Cokus, Matthe Bellew and Isaku Wada.

The Mersenne Twister is an algorithm for generating random numbers. It was designed with consideration of the flaws in various other generators. The period, 219937-1, and the order of equidistribution, 623 dimensions, are far greater. The generator is also fast; it avoids multiplication and division, and it benefits from caches and pipelines. For more information see the inventors' web page at www.math.keio.ac.jp/~matumoto/emt.html"

then a bit below that it says:

"Do NOT use for CRYPTOGRAPHY without securely hashing several returned values together, otherwise the generator state can be learned after reading 624 consecutive values."

I may be wrong, but this means that the Mersenne Twister algorithm can be detected after time, however it is apparently one of the best algorithms which is perhaps why I haven't been banned yet.

My conclusion is that either my approach of a simple tap to move mouse and randomly clicking an area, and perhaps sandboxing the game, is why I haven't been banned, OR it is because of the Mersenne Twister algorithm.

So now I wonder, what algorithm have bots (OSBot, RuneMate etc.) been using this whole time? and have they thought of this?

Thoughts?

 

[pokeno]

There's a a lot of ideas on jagex's anti-bot capabilities but honestly we will never know for sure.

Breaking an PRNG does not seem like something realistic to me as it wouldn't scale and it would be very inaccurate. (The paper you reference is theoretical. It doesn't include the entire stack of software between your mouse and Jagex' database).

Biggest reason you're not banned is because it's your own script. Large amounts of bots are banned because they behave very similarly to someone else. So mods can easily ban an entire generation of a certain type of bot. Lot's of people have been developing their own scripts for years without mouse movement and without sleep timers and they don't get banned if they keep script private.

 

Private scripts = no ban

 

You're running your own script hence no bans yet. Less script users = less patterns = less bans. Of course, given that the script is actually decent+.

As for botting clients. You've just gotta ask Arbi himself (dude's a busy fella though).

 

[Aaron C]

I don't understand though how Jagex could detect a pattern after a while, technically they shouldn't be able to since all I'm doing is clicking the cannon... You all say they detect a pattern, but how? Cmon people you're acting like they're god and that we won't ever know, that's bullshit.

The only way that they could is by detecting the random number generator, if they aren't doing that then technically my simple script will never get me banned no matter how many people use it.

 

[Aaron C]

The whole point of this thread was to point out that the only data Jagex have is the random number generator.