SRL Archive - Discussions and Debates

So I was doing my bored and decided to look at some PB scripts; to see all of the foolish people who pay for a fletching (and many other scripts) you can get for free here. I decided to look at the comments of said scripts, and I see all of these reports of people not being able to use a script more than a few hours a day (if that) without getting banned. It's so strange to me.. I can run the same type of script that is posted publicly here for days w/o breaks w/ no ban… why is that? I've heard rumors about the client being detectable; is that really the case? I really am genuinely curious as to why the bans happen for them… are the scripts just that poorly written? Is Jagex only targeting those specific scripts? What's the dealio.

ive been curious too! i have read similiar threads over at EpicBot and the devs always claim 'their client isnt detectable' or 'the scripts are of the finest quality'. its like one or the other isnt true cause people are getting banned left and right only after a few hours sooooo.. lol

how would a client be detecable?

Even if SMART is detectable we could ultimately just do browser-only if people started getting banned due to detected client?

I also find it kind of funny…maybe people just don't know we exist as much because we don't market the crap out of ourselves/false advertise?

I think it's funny how people even pay for a fletcher period… I remember when they used to be free (this ins't even that long ago) even at powerbot

From: Sk1nyNerd
how would a client be detecable?

A number of manners. One is called a 'browser-agent'. It's a small bit of information the sender includes on their outgoing requests saying who's sending it. Internet Explorer, Firefox, Opera, Chrome, and just about every browser sends their own (or simulates one of the others). Everything needs to send one of these for the called source to know how to send information back correctly, which means SMART, Powerbot, Tribot, OSBot, EpicBot, and every other bot has to send them out as well (when using a separate client, botting from the browser, this is unnecessary as the browser does it). If one of those clients sends an agent that is unique in some manner, then that would easily detectable by Jagex (last I heard, SMART actually sends an incorrect version of a Firefox agent, which means we are technically detectable - although that bug may have been fixed since I last heard).

A more common method would be to run compares between the running code and the compiled code - this could be done to detect injection clients, as they're the only ones that officially change the code. Or (if I understand correctly, @Brandon knows for sure and I may have misunderstood his description on the matter) OGL/DX interception could be detected if the Virtual Tables are left with a different read/write level than originally set, or if their address size changes.

Jagex could also write some code that checks for running assemblies on the computer and compare them with a known list of botting agents (I do not foresee this due to the large amount of Invasion of Privacy this would cause and possible legal ramifications - whether or not anyone could successfully sue Jagex and win, it would still tarnish their image pretty heavily).

And there's probably other methods of Client detection. And even then, that's all before we start discussing possibilities like what manner Botwatch may or may not truly be working with.

As for the original question to this thread, I think it's moreso because Powerbot has a larger quantity of users for Botwatch to make similar comparisons between, and they tend to be more monetarily focused, encouraging smaller quantities of areas/accounts to be watched, as opposed to any sort of experience gaining method. Then again, that could be entirely opinion based and they may just be pretty poor scripters over there with client detections or something.

From: Kevin
Or (if I understand correctly, @Brandon knows for sure and I may have misunderstood his description on the matter) OGL/DX interception could be detected if the Virtual Tables are left with a different read/write level than originally set, or if their address size changes.

That's pretty much right. Though, powerbot doesn't use VTables or anything like that. Java can't access or modify it. The JVM takes care of that. But yeah, when you modify memory, if you don't put back the same permissions, it can either cause access violations or a user can check it and ban you. But that would only apply to native code (not Java code). So in other words, it only applies to hooking/intercepting.


For Smart and all the other crap, Benland already said a couple ways of detecting Smart.. We all know why it's detectable and how to detect it.. Powerbot and the others are different though..

For the SRL botwatch competition, I came up with a couple that I was actually testing..


1. Modify Jaclib to actually use the mouse-hook that's already in it and dormant so that it actually works. Add a keyboard hook using SetWindowsHookEx..

2. Read the title of the current applet's owner/parent. (can be spoofed easily but still viable).

3. Read the class of the owner/parent. Cannot be spoofed because you cannot spoof Window classes in Java. For example, to detect Smart and powerbot, I called GetWindowClass from JNI and it printed "SunAwtFrame".. Obviously RS doesn't run in any JFrames.. Calling it on the browser gives a class of Chrome_Win_1 and SunAwtCanvas.. Which is legit.

4. Use GetPackages from the java class to get a list of all packages and check against known packages.

5. Check running processes and perform memory scans (warden and punkbuster does this and is perfectly legal if Jagex adds it to the TOS).

6. Perform runtime integrity checks such as hash checking to check if anything has been modified.

7. Check if the window is not visible and receiving commands..

8. Check the applet's components.. Powerbot likes to add listeners and menus and a whole bunch of stuff to the applet.

Everything is EASY on WINDOWS.. I don't know linux enough to say anything about that..


IMO, since most bots are ran on Windows, they should take out the windows client base first.. JacLib.dll has so much potential seeing as barely anyone knows Assembly, C or C++ well enough to remove whatever checks they can shove in there.. They already have a mouse hook in there which is apparently not in use at all or does nothing..

Jagex can stick shared memory stuff in the client and mess with smart's communication system too.. Which would include modifying colours that smart gives to Simba from the Smart.pid files, mouse coords, everything..


For powerbot, it might be harder since they don't use anything native and they can remove a lot using injection.. so I'd say integrity checks for them or Jaclib all the way.. Jagex just needs to step it up and a lot of bots can go down easily (especially on windows). Whatever Jagex is doing right now for PB, it certainly seems to be working :l


I had an example of sticking stuff in Jaclib for my SRL botwatch draft.. Some results (skydrive): http://1drv.ms/1cVr4KG

Dunno why the question marks are in the file though.. Might just be my buffer is larger than needed and it writes null chars to the file :l

Seems like they just have a larger userbase. More accounts running same script is detectible? Who knows.

I have always been a bit curious on the situation as well. I have attempted to do some research, but nobody really knows. There are many guesses, but I guess only JaGeX knows….

Ive read some of the paid scripts, they are usually pretty crappy, plus the larger user base is a huge downside as how many people a day run the same script? If everyone has similar movements in the same area and doing the same thing, then it is plausible to say they are botting.. SRL has a smaller suer base, the public code is critiqued by everyone who sees it and we hold ourselves to a higher standard than most as we script for pride and joy, not money.