What makes RSPeer better than other botting clients?


  • Script Writer VIP Director

    So I have been getting private messages on Discord from people asking me this question and it's come up numerous times on the RSPeer discord as well so I thought I would do a write-up here to explain what exactly is different between RSPeer and other botting clients.

    What other botting clients do

    Ever since the release of RSBot there has been a 'standard' way of performing interaction in botting clients. Interactions are performed using a virtual mouse to click on things on the game canvas. Back in the day this worked decent and the ban rates for using this virtual mouse was fine. However the virtual mouse has always had its disadvantages, it is slow, unreliable and inaccurate.

    Ever since Jagex implemented their automated bot flagging system other botting clients have focused on 'antiban' and on 'human mouse movement'. These methods have a clear negative effect on the already suboptimal performance of the virtual mouse and the speed at which the scripts can perform actions. Many clients have a mouse speed limit above which script writers are not allowed to go and their 'human mouse movement' often cause inaccurate clicks with long mouse paths.

    These methods seem not to have much influence on banrates however, use a public script on OSBot or Powerbot and I'll be surprised if you last more than two days. Jagex seem to be fairly decent at detecting these botting clients even though their mouse movement is 'extremely humanlike' and their anti-ban is 'level 10 compliant'. Other clients also offer 'mirror mode' which is supposed to decrease ban rates, when all it is is just a deceiving effort at getting the user to pay more. All in all the other botting clients take a very reactive stance to Jagex's bot detection and their efforts are clearly ineffective. RSPeer is different, instead of copying the ancient RSBot model and ever so slightly changing it the developers have completely reinventend interaction.

    What RSPeer does

    RSPeer has a completely different and new way to interact with the game. It doesn't use a virtual mouse to click on objects or NPCs. The interaction in RSPeer is instantaneous, efficient and consistently reliable. The mouse doesn't need to be moved for RSPeer to interact and neither do game entities need to be visible for them to be 'clicked' on. All of this together makes RSPeer extremely fast and it makes writing scripts for RSPeer a breeze as you don't need to worry about the possibility of missclicks or having to move the camera.

    A question that is often asked after giving this explanation is: "But would this not increase ban rates?" or: "Couldn't Jagex easily see that there is no mouse movement?". The answer to this is that Jagex does not see the data you might think they do. Even though RSPeer requires no mouse movement and no camera movement to perform interaction, it spoofs this data and sends it to Jagex. They receive the same information as they would from a human player using the official client.

    Since the mouse data and other data used by Jagex for detecting bots does not actually come from a virtual mouse or from interacting with the game in RSPeer, it can be as random and patternless as is desired without affecting the ability to interact with the game. While this is not exactly how the data is spoofed, it is certainly nothing like other botting clients whom's data cannot be effectively random. This causes RSPeer to be able to send much less bot-like data to the server simply because the data does not come from the bot's interactions.

    All of this is handled under the hood, it may not be visible to the user but it is definitely present. Jagex may take extra steps to make it harder for RSPeer to operate but we have client experts who can just as well take extra steps to make sure Jagex doesn't notice a thing. This does not mean there is no chance of getting banned using RSPeer, and botting will never be risk free, but use it for a while and any sensible person will notice the difference.



  • Thanks for the read, very interesting! I’ve always wondered what differs RSPeer from the other bots.


  • Director

    Nice write-up, couldn't have said it better myself.



  • Made a post earlier about this but I would like some clarifications. Obviously if it would compromise the integrity of the system there's no need to answer. My question is, what happens if the mouse/camera movements get correlated to actions that the bot performs?

    What I mean is jagex doing server-side checks for reasonability: the player always starts off at a certain camera angle facing north (please correct if I am wrong), and by examining how the player rotates their screen they could say: "wait a second, this kid somehow interacted with a tree that should be impossible to view from the current angle".

    I read in the post,

    "Eventhough RSPeer requires no mouse movement and no camera movement to perform interaction, it spoofs this data and sends it to Jagex. They receive the same information as they would from a human player using the official client."

    And then,

    "Since the mouse data and other data used by Jagex for detecting bots does not actually come from a virtual mouse or from interacting with the game in RSPeer, it can be as random and patternless as is desired without affecting the ability to interact with the game."

    If jagex implemented these server side checks, wouldn't the bot be forced to use some algorithm to determine how to rotate the camera such that the object would end up being visible in the client? Otherwise, with as "random and patternless as is desired" data, you might end up not rotating to the object, and then end up getting banned. Which means that the data can no longer be entirely random.

    Please let me know your thoughts. Thanks.



  • Forgot to mention that the same example for camera movement can be done with mouse movements. After all, jagex gets sent mouse move data and clicks. They could also run server-side checks to see if the item you interacted with can actually be clicked on with the spoofed mouse movement your client provided at the spoofed camera angle you're at.

    Clearly, it would be very computationally expensive to run these checks for everyone, but they could run them only on players that seem "suspicious", for example, those who have been playing too long. If RSPeer becomes a major goldfarming site or other nuisance to jagex, I can see them allocating some more resources to counter it.

    I'm mostly concerned with this sort of thing because I would like the client's features to be undetectable. OSbot has deterministic camera rotation (for turning towards entities) and ungodly menu/bank interaction speeds, and I'm pretty sure that's what results in most of their bans.

    I would really like to know how RSPeer handles these issues. Thanks again.


  • VIP

    This post is deleted!

  • Script Writer VIP Director

    @dogetrix So you have to understand that first of all Jagex is using a relatively old system for detecting bots. As far as we are aware the most they are able to do is setting up flags using the data available to them. Using mouse data, camera data and interaction data together to see if the interaction was legitimate requires some decently heavy calculations considering the botwatch is constantly running checking each and every player so it is unlikely they do that just for this reason.

    The second thing that you have to consider is that it is actually possible for a legitimate player to interact with things that are not on their screen. If you right click on an object and turn your camera 180 degrees, the menu is still open and you can still interact with that menu just fine. How would Jagex, even if they were able to perform those relatively heavy calculations, tell the difference between a legitimate player doing this and a bot doing this. Besides that, a lot of third party clients also allow to go past the zoom limit allowing you to click objects that weren't actually on your screen with the zoom limit, these would have to be distinguished too.



  • @yasper I was thinking that they might only run these checks on already suspicious players, like those who are running for long periods of time. That would greatly lessen the computational load.

    Regarding the second part, I agree that these are possible, but I feel like constantly interacting with traditionally out-of-sight objects could be a major flag for jagex.


  • Script Writer VIP Director

    @dogetrix said in What makes RSPeer better than other botting clients?:

    @yasper I was thinking that they might only run these checks on already suspicious players, like those who are running for long periods of time. That would greatly lessen the computational load.

    Regarding the second part, I agree that these are possible, but I feel like constantly interacting with traditionally out-of-sight objects could be a major flag for jagex.

    You're right in that they could run these checks on already suspicious players without it being too computationally expensive. RSPeer excels however at not being flagged as being suspicious in the first place. Even if they did implement something like you said I doubt it will affect the banrates as currently 'suspiciously' flagged players will likely already be manually inspected (A lot of the bans in bot watch are still performed by manually validating the systems beliefs).



  • and how about the time played mythe ? since i cant bot 24 hrs with most clients ( at once ) and still people on here get away with botting 3 to 4 days straight i know if u want accounts to survive dont bot 24/7 is it the same reason as u expained above ?


  • Script Writer VIP Director

    @unexist said in What makes RSPeer better than other botting clients?:

    and how about the time played mythe ? since i cant bot 24 hrs with most clients ( at once ) and still people on here get away with botting 3 to 4 days straight i know if u want accounts to survive dont bot 24/7 is it the same reason as u expained above ?

    Yeah, their playtime catches seem to be odd and we're not exactly what triggers it however if you bot an account for 24/7 long enough you will get banned, that is no different with RSPeer; what is different is how long you can 24/7 bot for, some people have recorded over three weeks of 24/7 botting.



  • @Yasper The description in the OP seems very similar to packet manipulation/spoofing, is that what the client is doing? If so that is extremely impressive considering Jagex use TLS and packet obfuscation.


  • Script Writer VIP Director

    @root said in What makes RSPeer better than other botting clients?:

    @Yasper The description in the OP seems very similar to packet manipulation/spoofing, is that what the client is doing? If so that is extremely impressive considering Jagex use TLS and packet obfuscation.

    It does indeed seem similar from purely describing it, I can assure you however that RSPeer does not perform packet manipulation in any way.



  • @root said in What makes RSPeer better than other botting clients?:

    @Yasper The description in the OP seems very similar to packet manipulation/spoofing, is that what the client is doing? If so that is extremely impressive considering Jagex use TLS and packet obfuscation.

    It seems like RSPeer works by emulating the intermediary layer between the mouse/keyboard input (meaning there's no need for typical event based inputs). If it was a pure network based bot there would be no need to even load the game client (like how some of the first RS bots operated).



  • @explicit True, but that does not sound as exotic as what they describe. They are probably hooking DirectX/OpenGL then using their custom input implementation. It is pretty interesting, but I am skeptical.



  • Gotto disagree with mirror mode to some level. I have logged into accs sometimes without ever botting and and been logged out and receiving message that I used 3rd program party.



  • @orlando-bloom Mirroring won't do shit, the best way to fuck with their system is to learn the heuristics they use. For example I would not be surprised if they count how many times you have spoke in-game as a weight to determining if your account should be monitored.

    time_played / conversations < SOME_NUMBER

    Plus other factors, I wouldn't say there are too many players to monitor everyone because there really isn't. People really underestimate how scaled services can become with modern cloud services, tracking the click stream of each player live would be no problem.

    That is why any of the solutions you would have seen lately in the botting area are focusing on bio metrics, which is a good area because if it is done probably it will increase the amount of entropy for each person who uses the client.

    You still have to evade heuristics. https://en.wikipedia.org/wiki/Heuristic_analysis



  • Interesting post and very nicely written. I can only say I agree 😛


 

44
Online

3.8k
Users

493
Topics

5.6k
Posts