SRL Archive - S.M.A.R.T. Questions and Answers.

Whether the community likes it or not - Smart, or any other client (Powerbot, tribot, WHATEVER) is detectable through JacLib.DLL which can check if a mouse is emulated or hardwired.

If I'm wrong let me know why, but I am 95% certain about this.

source to jaclib.dll?

int __stdcall Java_jaclib_ping_IcmpService_run(int a1, int a2)
{
int v2; // edi@1
int v3; // eax@1
int (__stdcall *v4)(_DWORD, _DWORD, _DWORD, _DWORD); // edx@1
HHOOK v5; // eax@1
int (__stdcall *v6)(_DWORD, _DWORD, _DWORD, _DWORD); // edx@1
int v7; // eax@1
int result; // eax@3
struct tagMSG Msg; // [sp+30h] [bp-1Ch]@1

v2 = (*(int (__stdcall **)(int, int))(*(_DWORD *)a1 + 124))(a1, a2);
v3 = (*(int (__stdcall **)(int, int))(*(_DWORD *)a1 + 84))(a1, a2);
v4 = *(int (__stdcall **)(_DWORD, _DWORD, _DWORD, _DWORD))(*(_DWORD *)a1 + 132);
dword_100241B4 = v3;
dword_10024170 = v4(a1, v2, "notify", "(III)V");
idThread = GetCurrentThreadId();
v5 = SetWindowsHookExA(14, (HOOKPROC)fn, hmod, 0);
v6 = *(int (__stdcall **)(_DWORD, _DWORD, _DWORD, _DWORD))(*(_DWORD *)a1 + 132);
hhk = v5;
v7 = v6(a1, v2, "notify", "(I)V");
sub_10005DA0(a1, dword_100241B4, v7, 0);
while ( GetMessageA(&Msg, 0, 0, 0) )
{
TranslateMessage(&Msg);
DispatchMessageA(&Msg);
}
UnhookWindowsHookEx(hhk);
(*(void (__stdcall **)(int, int))(*(_DWORD *)a1 + 88))(a1, dword_100241B4);
result = 0;
dword_10024170 = 0;
hhk = 0;
return

@Aph0tix;
full source please?

Did you take this from my powerbot post when I was fighting with Sanders and Ampersand?

From: Brandon
Did you take this from my powerbot post when I was fighting with Sanders and Ampersand?

lol'd

From: Brandon
Did you take this from my powerbot post when I was fighting with Sanders and Ampersand?

Link to post? ;)

From: Brandon
Did you take this from my powerbot post when I was fighting with Sanders and Ampersand?

Nope, me and a friend inspected the source code earlier but since you seem to know about the issue - what is your opinion on it?

http://s23.postimg.org/thx6ldgsp/image.png
http://s12.postimg.org/6lwks91i3/image.png

From: Sjoe
Link to post? ;)

It was like 2 weeks ago or something. I have a shitty name on there and I don't want anyone to know or bother me or find me ;) so I'll just say it here:

http://www.youtube.com/watch?v=3y7vRDmq4i8&feature=player_embedded

RSRogie during the ban wave quoted me at 4:37.. I screen-shotted all the decompiles and stuff. And another post called "IsDebuggerPresent" where I posted the jaclib using GetWindowHandle from the Win32-API via JNI.. Had a whole bunch of crap but no.. Admins removed it lol. Iunno what the rest was but I was pretty mad because every time I posted those noobs got mad and delete what I said. So much so that Paris decided that he was going to add OpenGL mode to RSBot and some sorta hetero mouse? I can't remember lol. After I posted that stuff like a shitstorm of posts came up about detection and new mouse movements and what not. Even their gravedigs. Some other guys were saying I was correct but just late.

It was a fight so yeah.. @OP it's obv that all clients = detectable atm but I don't think jagex is even bothering or checking stuff they should be checking. No one has a clue what that mouse thing does and as for the other stuff, just ignore it for now if you saw it. Keep going though. You're on the right track.

From: Brandon
It was like 2 weeks ago or something. I have a shitty name on there and I don't want anyone to know ;) so I'll just say it here:

http://www.youtube.com/watch?v=3y7vRDmq4i8&feature=player_embedded

RSRogie during the ban wave quoted me at 4:37.. I screen-shotted all the decompiles and stuff. And another post called "IsDebuggerPresent" where I posted the jaclib using GetWindowHandle from the Win32-API via JNI.. Had a whole bunch of crap but no.. Admins removed it lol. Iunno what the rest was but I was pretty mad because every time I posted those noobs got mad and delete what I said. So much so that Paris decided that he was going to add OpenGL mode to RSBot and some sorta hetero mouse? I can't remember lol. After I posted that stuff like a shitstorm of posts came up about detection and new mouse movements and what not. Even their gravedigs.

rofl yeh, pbot does everything to avoid an outbreak.

(is your nickname Strange Clouds? :p)

From: Brandon
It was like 2 weeks ago or something. I have a shitty name on there and I don't want anyone to know or bother me or find me ;) so I'll just say it here:

http://www.youtube.com/watch?v=3y7vRDmq4i8&feature=player_embedded

RSRogie during the ban wave quoted me at 4:37.. I screen-shotted all the decompiles and stuff. And another post called "IsDebuggerPresent" where I posted the jaclib using GetWindowHandle from the Win32-API via JNI.. Had a whole bunch of crap but no.. Admins removed it lol. Iunno what the rest was but I was pretty mad because every time I posted those noobs got mad and delete what I said. So much so that Paris decided that he was going to add OpenGL mode to RSBot and some sorta hetero mouse? I can't remember lol. After I posted that stuff like a shitstorm of posts came up about detection and new mouse movements and what not. Even their gravedigs. Some other guys were saying I was correct but just late.

It was a fight so yeah.. @OP it's obv that all clients = detectable atm but I don't think jagex is even bothering or checking stuff they should be checking. No one has a clue what that mouse thing does and as for the other stuff, just ignore it for now if you saw it. Keep going though. You're on the right track.

Meh, this does make me reconsidering using Smart - i'm pretty paranoid! Enough to stop using Powerbot completely (ew).

Is there a guide on how to use a script without Smart? :)

From: Aph0tix
Meh, this does make me reconsidering using Smart - i'm pretty paranoid! Enough to stop using Powerbot completely (ew).

Is there a guide on how to use a script without Smart? :)

No point being paranoid. I was just teaching them something and stirring up a storm. There's nothing wrong. Consider this:

a. If smart and pb are detectable (we obviously know this). Then what's the big deal if that detection isn't used? Yeah reversing it sorta does scare me too but I mean, how can the code be there but no bans are being laid out? I mean, they could really do damage with it but nothing happening? Apparently, someone replied to me saying the code has been there forever. Perhaps they can't use it. Maybe a privacy law? Iunno. Either way, doesn't scare me. Scares PB. They got hit hard during that ban wave. I don't think Smart got hit. Only the users here that were using their client got hit.
b. The only way to know what jagex does is to watch them do it. If and when it happens, then we'll know for sure what they do with that code of theirs.
c. If and when this happens, you can simply patch it too. Cat and mouse. Tbh, it just makes things more interesting.
d. I use smart without hesitation even after I posted all that. Doesn't bother me. I use it on my maxed account as well (trying to get completionist cape while coding other stuff). Obviously I wouldn't risk it if I knew for sure a ban was going to slap me. I risk it because I'm lazy and I know that a ban can hit me any time if I'm "caught" botting.

From: Brandon
No point being paranoid. I was just teaching them something and stirring up a storm. There's nothing wrong. Consider this:

a. If smart and pb are detectable. Then what's the big deal if that detection isn't used?
b. The only way to know what jagex does is to watch them do it. If and when it happens, then we'll know for sure what they do with that code of theirs.
c. If and when this happens, you can simply patch it too. Cat and mouse. Tbh, it just makes things more interesting.
d. I use smart without hesitation even after I posted all that. Doesn't bother me. I use it on my maxed account as well (trying to get completionist cape while coding other stuff).

So you believe that right now they aren't using this to detect us but they could do in the future?

From: Aph0tix
So you believe that right now they aren't using this to detect us but they could do in the future?

Well I see no reason why they can't use it. That code has been there quite some time. I was just first to point it out publicly like that. I also believe Moparisthebest or someone on that site posted a mousehook as well. Perhaps the same thing you found up there. And that was probably over a year or two ago. Re-read my edited post above. I wouldn't risk my account. No worries. I don't think anyone on srl is stupid enough to bot knowing that the client is detected. I think all bot sites know their bots are detectable but isn't detected.

From: Brandon
Well I see no reason why they can't use it. That code has been there quite some time. I was just first to point it out publicly like that. I also believe Moparisthebest or someone on that site posted a mousehook as well. Perhaps the same thing you found up there. And that was probably over a year or two ago. Re-read my edited post above. I wouldn't risk my account. No worries. I don't think anyone on srl is stupid enough to bot knowing that the client is detected. I think all bot sites know their bots are detectable but isn't detected.

I read over it and it makes sense - to be frank I'm far too busy to waste over 5000 hours on a game, hence why I bot - so I guess I'll have to stick to botting and hope for the best!

It could be a privacy law, from what you've told me I feel more comfterable using Smart anyway so thank you.

As for OpenGL, could you tell me a little about that? I've read what I could find on wikipedia etc but I'm interested to know how its going to be applied on Villavu, detectabillity, uses and the like?

From: Aph0tix
I read over it and it makes sense - to be frank I'm far too busy to waste over 5000 hours on a game, hence why I bot - so I guess I'll have to stick to botting and hope for the best!

It could be a privacy law, from what you've told me I feel more comfterable using Smart anyway so thank you.

As for OpenGL, could you tell me a little about that? I've read what I could find on wikipedia etc but I'm interested to know how its going to be applied on Villavu, detectabillity, uses and the like?

Yeah OpenGL is different from Inject/Reflection in that it's complete interception. It cannot modify the client but it can modify what's sent to your gfx. I haven't done that. Only reading what is already there. Sorta like how reflection just reads but instead, it intercepts.

Anyway, it works like this. It stays in your Simba folder so you don't need injection. Smart loads it and since only one process can load 1 dll, RS cannot load it so it instead uses the one Smart loaded :D
It's a wrapper dll that contains all the functions of the original opengl32.dll and nothing more. Then what it does is it intercepts all information to the graphics card and monitors all calls to the opengl function. Using patterns and recognition, it can detect when certain things are place in a buffer, on screen or off screen, etc.

View here for a detailed breakdown of how most of the things work: http://villavu.com/forum/showthread.php?t=89645 The api changed a bit but the basics really still apply no matter how much you try to escape it.

Old news indeed. Your post you took (shame on you) from the SCAR forums, here:
http://forums.scar-divi.com/rs2-discussion/1583-urgent-new-banning-system-rs

The topic being discussed in Mopar's community:
http://www.moparisthebest.com/smf/index.php/topic,597618.0.html

…And finally the Villavu discussion for this, including Benland's statement on the matter:
http://villavu.com/forum/showthread.php?t=85688

No need for a scare, if they detected our botting, regardless of client, we would all be banned. But we're not.

From: Ashaman88
No need for a scare, if they detected our botting, regardless of client, we would all be banned. But we're not.

So either:
1. They can detect, but chooses not to ban
2. They can detect, and chooses to ban all
3. They can detect, and chooses to ban some

Personally I believe they're going for #3 because of the amount of botters is so high, banning them would mean they lose a lot of money.

From: Zyt3x
So either:
1. They can detect, but chooses not to ban
2. They can detect, and chooses to ban all
3. They can detect, and chooses to ban some

Personally I believe they're going for #3 because of the amount of botters is so high, banning them would mean they lose a lot of money.

i think their trying to please legits and botting

Worse case scenario we just switch back to VM's and use Simba without SMART

E: Weird. I just loaded up OldSchool on a fresh VM, no sign of jaclib.dll… Seems like it's only for EoC and not OSRS which makes me think BenLand is correct and it's about the fullscreen mode ect

From: Zyt3x
So either:
1. They can detect, but chooses not to ban
2. They can detect, and chooses to ban all
3. They can detect, and chooses to ban some

Personally I believe they're going for #3 because of the amount of botters is so high, banning them would mean they lose a lot of money.

I agree with that.

From: Justin
Worse case scenario we just switch back to VM's and use Simba without SMART

E: Weird. I just loaded up OldSchool on a fresh VM, no sign of jaclib.dll… Seems like it's only for EoC and not OSRS which makes me think BenLand is correct and it's about the fullscreen mode ect

I'd rather spend time getting to know Appa better. Good observation about jaclib only being created for EoC; as you said this supports Ben's statement.

From: Flight
I agree with that.



I'd rather spend time getting to know Appa better. Good observation about jaclib only being created for EoC; as you said this supports Ben's statement.

From memory, Appa cannot communicate with Java Applications?

From: nielsie95
Hey,
A few features:

• Browse the web
• Simulate mouse and keyboard events
• Get page source
• Adjust page source
• Get screen contents when minimized
• Block input (kind of useless, but fun :p)
• Get/Set target in page (useful for flash applets)
• Submit forms
• Cookie support
• Proxy support
• Frame support

NOTE: the mouse and keyboard simulations do not work for JAVA applets.

Well dont use SMART, use the regular browser or client. You can bot with it but the only cons is that you wont be able to use mouse while botting. But this will be virtually undectectable.

From: Justin
From memory, Appa cannot communicate with Java Applications?

Yeah we'd have to keep bugging Nielsie until it's possible. :D

From: Justin
Worse case scenario we just switch back to VM's and use Simba without SMART

E: Weird. I just loaded up OldSchool on a fresh VM, no sign of jaclib.dll… Seems like it's only for EoC and not OSRS which makes me think BenLand is correct and it's about the fullscreen mode ect

And what makes you guys think fullscreen requires a MouseHook? The only thing you need for fullscreen is a new viewport and to call the function ChangeDisplaySettings(Ex): http://msdn.microsoft.com/en-us/library/windows/desktop/dd183411%28v=vs.85%29.aspx and set the applet's preferred dimensions and SetWindowLong to remove the titlebars and remove taskbar.

It is only for EOC because the OldRS doesn't even have the "bot watch" and flutterer thing like EOC does. They said they'd implement the security soon. Aka some cluster flutterer or w/e it's called for Old-School. If and when it's implemented, if jaclib is downloaded and you see another mouse hook then you know for sure it isn't for fullscreen. Speculation right now is not worth it.

P.S. full screen used to be there long before jaclib (which came in 2012) and it handled the mouse just fine. Food for thought. I'm with Zytex on #3 .

Just don't bot if you're not willing to risk a ban.

The client is only as good as the amount of work put into it. IF you're extremely worried about a certain aspect, feel free to change some code around and post snippets or suggestions! Thats the great thing about totally open-source community.

Honestly though, we have bigger things to worry about the SMART atm, rs3 coming. GOtta worry about that

Jagex seems to be getting more pro-active in banning bots, i guess when it's such a large phenomenon they have to try to slowly try to get users to stay away from botting, by increasingly banning more and more, and especially banning high level players to create more publicity, and hurt those who have supposedly botted the most.