The client is offline due to RuneScape update. You may see instance errors but this is due to the update and not actual instance errors. This should be resolved soon. Join our Discord for more information.

What makes RSPeer better than other botting clients?


  • Director



  • Thanks for the read, very interesting! I’ve always wondered what differs RSPeer from the other bots.


  • Director

    Nice write-up, couldn't have said it better myself.



  • Made a post earlier about this but I would like some clarifications. Obviously if it would compromise the integrity of the system there's no need to answer. My question is, what happens if the mouse/camera movements get correlated to actions that the bot performs?

    What I mean is jagex doing server-side checks for reasonability: the player always starts off at a certain camera angle facing north (please correct if I am wrong), and by examining how the player rotates their screen they could say: "wait a second, this kid somehow interacted with a tree that should be impossible to view from the current angle".

    I read in the post,

    "Eventhough RSPeer requires no mouse movement and no camera movement to perform interaction, it spoofs this data and sends it to Jagex. They receive the same information as they would from a human player using the official client."

    And then,

    "Since the mouse data and other data used by Jagex for detecting bots does not actually come from a virtual mouse or from interacting with the game in RSPeer, it can be as random and patternless as is desired without affecting the ability to interact with the game."

    If jagex implemented these server side checks, wouldn't the bot be forced to use some algorithm to determine how to rotate the camera such that the object would end up being visible in the client? Otherwise, with as "random and patternless as is desired" data, you might end up not rotating to the object, and then end up getting banned. Which means that the data can no longer be entirely random.

    Please let me know your thoughts. Thanks.



  • Forgot to mention that the same example for camera movement can be done with mouse movements. After all, jagex gets sent mouse move data and clicks. They could also run server-side checks to see if the item you interacted with can actually be clicked on with the spoofed mouse movement your client provided at the spoofed camera angle you're at.

    Clearly, it would be very computationally expensive to run these checks for everyone, but they could run them only on players that seem "suspicious", for example, those who have been playing too long. If RSPeer becomes a major goldfarming site or other nuisance to jagex, I can see them allocating some more resources to counter it.

    I'm mostly concerned with this sort of thing because I would like the client's features to be undetectable. OSbot has deterministic camera rotation (for turning towards entities) and ungodly menu/bank interaction speeds, and I'm pretty sure that's what results in most of their bans.

    I would really like to know how RSPeer handles these issues. Thanks again.


  • VIP

    This post is deleted!

  • Director

    @dogetrix So you have to understand that first of all Jagex is using a relatively old system for detecting bots. As far as we are aware the most they are able to do is setting up flags using the data available to them. Using mouse data, camera data and interaction data together to see if the interaction was legitimate requires some decently heavy calculations considering the botwatch is constantly running checking each and every player so it is unlikely they do that just for this reason.

    The second thing that you have to consider is that it is actually possible for a legitimate player to interact with things that are not on their screen. If you right click on an object and turn your camera 180 degrees, the menu is still open and you can still interact with that menu just fine. How would Jagex, even if they were able to perform those relatively heavy calculations, tell the difference between a legitimate player doing this and a bot doing this. Besides that, a lot of third party clients also allow to go past the zoom limit allowing you to click objects that weren't actually on your screen with the zoom limit, these would have to be distinguished too.



  • @yasper I was thinking that they might only run these checks on already suspicious players, like those who are running for long periods of time. That would greatly lessen the computational load.

    Regarding the second part, I agree that these are possible, but I feel like constantly interacting with traditionally out-of-sight objects could be a major flag for jagex.


  • Director

    @dogetrix said in What makes RSPeer better than other botting clients?:

    @yasper I was thinking that they might only run these checks on already suspicious players, like those who are running for long periods of time. That would greatly lessen the computational load.

    Regarding the second part, I agree that these are possible, but I feel like constantly interacting with traditionally out-of-sight objects could be a major flag for jagex.

    You're right in that they could run these checks on already suspicious players without it being too computationally expensive. RSPeer excels however at not being flagged as being suspicious in the first place. Even if they did implement something like you said I doubt it will affect the banrates as currently 'suspiciously' flagged players will likely already be manually inspected (A lot of the bans in bot watch are still performed by manually validating the systems beliefs).



  • and how about the time played mythe ? since i cant bot 24 hrs with most clients ( at once ) and still people on here get away with botting 3 to 4 days straight i know if u want accounts to survive dont bot 24/7 is it the same reason as u expained above ?


  • Director

    @unexist said in What makes RSPeer better than other botting clients?:

    and how about the time played mythe ? since i cant bot 24 hrs with most clients ( at once ) and still people on here get away with botting 3 to 4 days straight i know if u want accounts to survive dont bot 24/7 is it the same reason as u expained above ?

    Yeah, their playtime catches seem to be odd and we're not exactly what triggers it however if you bot an account for 24/7 long enough you will get banned, that is no different with RSPeer; what is different is how long you can 24/7 bot for, some people have recorded over three weeks of 24/7 botting.



  • @Yasper The description in the OP seems very similar to packet manipulation/spoofing, is that what the client is doing? If so that is extremely impressive considering Jagex use TLS and packet obfuscation.


  • Director

    @root said in What makes RSPeer better than other botting clients?:

    @Yasper The description in the OP seems very similar to packet manipulation/spoofing, is that what the client is doing? If so that is extremely impressive considering Jagex use TLS and packet obfuscation.

    It does indeed seem similar from purely describing it, I can assure you however that RSPeer does not perform packet manipulation in any way.



  • @root said in What makes RSPeer better than other botting clients?:

    @Yasper The description in the OP seems very similar to packet manipulation/spoofing, is that what the client is doing? If so that is extremely impressive considering Jagex use TLS and packet obfuscation.

    It seems like RSPeer works by emulating the intermediary layer between the mouse/keyboard input (meaning there's no need for typical event based inputs). If it was a pure network based bot there would be no need to even load the game client (like how some of the first RS bots operated).



  • @explicit True, but that does not sound as exotic as what they describe. They are probably hooking DirectX/OpenGL then using their custom input implementation. It is pretty interesting, but I am skeptical.



  • Gotto disagree with mirror mode to some level. I have logged into accs sometimes without ever botting and and been logged out and receiving message that I used 3rd program party.



  • @orlando-bloom Mirroring won't do shit, the best way to fuck with their system is to learn the heuristics they use. For example I would not be surprised if they count how many times you have spoke in-game as a weight to determining if your account should be monitored.

    time_played / conversations < SOME_NUMBER

    Plus other factors, I wouldn't say there are too many players to monitor everyone because there really isn't. People really underestimate how scaled services can become with modern cloud services, tracking the click stream of each player live would be no problem.

    That is why any of the solutions you would have seen lately in the botting area are focusing on bio metrics, which is a good area because if it is done probably it will increase the amount of entropy for each person who uses the client.

    You still have to evade heuristics. https://en.wikipedia.org/wiki/Heuristic_analysis



  • Interesting post and very nicely written. I can only say I agree 😛



  • Thank you for this post. I still have a question lying in the back of my head while I'm starting to learn how to script.

    You wrote: "Since the mouse data and other data used by Jagex for detecting bots does not actually come from a virtual mouse or from interacting with the game in RSPeer, it can be as random and patternless as is desired without affecting the ability to interact with the game. While this is not exactly how the data is spoofed, it is certainly nothing like other botting clients whom's data cannot be effectively random. This causes RSPeer to be able to send much less bot-like data to the server simply because the data does not come from the bot's interactions."

    My question then is, so could a very badly and non-random script be executed and the data sent to Jagex will automatically be made human-like in the output ??
    If I write a script that sleep always 100ms at every actions for maximum possible speed, would'nt Jagex receive that clear bot pattern?


 

48
Online

16.6k
Users

1.4k
Topics

19.2k
Posts