Wondering about bot detectability? Answers here

Well, I've seen a bunch of commotion on rsbot forums/sythe/subject deleted/etc/w.e. A lot of people are arguing about which bots are detected, what is safe, and how jagex can catch/ban you. I've done some researching, and with a few other people (Jacmob, illusion, and a few others), we managed to discover a few things (Mind you, this is at least 3 weeks old news, but no one here seems to know it yet). Recently, probably along with the RuneTek5 update, JaGeX released a brand new way of detecting bots. Instantly. Now, a LOT of you may be saying, "Well how come I'm not banned!?!?". A few reasons:

1) Not ALL players who use the client are botters. Some are legitimate.

2) If bots were banned INSTANTLY, bot owners would HAVE to COMPLETELY redesign their bots, making even HARDER bots for JaGeX to detect, and making them spend thousands of more dollars a year.

3) Bots can help the economy in a few ways.

Now, after that, I'll explain the detection process. JaGeX has long had a file called "jagmisc.dll". This was used to numerous useful things, such as nanosecond timers, etc. However, now they have some bot detection in it. It's not "Is the client edited" crap, or whatever ruler eric has been spreading. Jagmisc.dll gets it's owner's process. Now, how does this detect bots?

Like this.

There's two different ways to run Java files. Applets, and Applications. Applets are what's on runescape.com. They're java programs run through a web browser/web browser control/etc. These are run as "java dot ee ex ee(Sensored for some reason ???)" in the process list. However, if a java program is run as an application, it's run as "javaw.exe". Now you may see where I'm getting at. All reflection/bcel bots load the client, and hack the loader, running the client as an APPLICATION. JAVAW.EXE!! Instant detection. I've also had some people say "What about SwiftKit/etc?!?!????@@$!". Well, SwiftKit runs Runescape as an applet. It's simply a web browser control, using Internet Explorer 6, so it's perfectly legit. RiD plays through the web browser, bypassing the auto detection, and is probably one of the main reasons that you don't get banned using it.

My theory is this:
There's two ways JaGeX can flag you.
Being reported, and loading the client as an application. If you are flagged, random events are activated more often, and mouse recording probably begins. If JaGeX sees that you're using obviously a bot client, AND have botlike talking records/mouse movements/failing random events OR doing them in a botlike manner, JaGeX puts a special flag on you. This is probably when they start recording everything they can. After they've gathered enough evidence, this is when they decide to ban you. They may or may not ban you right away. They may wait on an upwards of 2 weeks to ban you.
However, Rsbots.net/rsbot/kbot are instantly detected. Good scripts will help you, possibly avoiding that "second special flag". However, be careful. JaGeX can flag anything of yours instantly if they want to (Doesn't mean they do).


Some of you may doubt me. So be it. Go do the research yourself, and go look at jagmisc.dll, there's a few other interesting things in there.
Have fun, and be safe!a

 

So what you're saying is that if on the command-line I specify
'java -cp blah com.bot.myBot'
then I won't get detected?

Also, you can't run an applet as an application unless it has a main() function (which the client does), however no bots today do run the client as an application- they run it as an applet.

 

Nope nope nope. They hack the classloader, and run it as an application. And the command line would still have javaw.exe =]

 

Uh-oh, that's not so good news for us rsbots.net users...

I just checked the process list, and yeah it runs under javaw. But one question, how can jagex tell if your connecting through an application or an applet?

 

Ummmmmmmmmmmmm............................... Its not that hard to get around... Jimmy did. >_>.

 

Hacking the client's classLoader is hardly the same as running it as an application. What they do is they load the client class, create a new instance of it, cast it as an applet, set it's stub, invoke the provideSignlink() method if they aren't using the official loader, and then call it's init() and start() methods. Now, how is this the same as running the client as an application?

And no, it would have java dot exe (for some reason it's blocked)
EDIT: SuF beat my to it >__>

 

Of course I beat you to it.... There is much better ways to detect botters than using this.... >_>.

 

Clearly.

 

I highly doubt that RSBots.net is instantly detectable. I got 99 fm on a level 3 who did nothing but fm. It failed randoms, never talked, was reported many times, and botted for long hours... And this was AFTER the update.

If they can detect it instantly then why the hell havent they banned me?

 

Confused here..

 

ToshiX thinks Jagex detects botters by using JNI to look for the javaw.exe process, which makes no sense whatsoever.

 

Wierd.... i heard rsbots.net were the best bots around :/

 

They are, I think Toshi has a good theory, but it is incorrect.

 

It's a good theory but if they could detect iBot Pro (e.g. rsbots.net) all Nexus users would be banned a few levels away from 99s to instill false hope, and Nexus seems to be coming along just fine. Plus you forgot about Scionbot back in its day, which is C#, and I believe doesn't function with a Java applet and/or in the same manner as other bots (though I might be completely wrong here).
Plus Jimmy is a champion of the internet so I believe whatever he says.

 

Ever thought he might be...WRONG?!

 

They aren't the best, but they use the client of the second-best bot around.

 

jagmisc isnt the ONLY file, dont get all excited. it even pops up if you play legit... worry about the files that pop up WHEN you bot. my way didnt get me banned yet...