SRL Archive - S.M.A.R.T.

At least in the way it grabs the client to load it. First, it directly reads the page the client is on without sending a referrer, which any real browser would do. It also doesn't send a user-agent, which any real browser would do. (I'd suggest a Firefox user-agent, a list of which can be found here), try to keep at least the OS and the CPU architecture (i386, i586, x86_64 etc etc) correct as they can detect that from java and compare. And lastly, make sure you use a different connection and a different user-agent to download the actual jar, as per my thread here:
https://www.moparisthebest.com/smf/index.php/topic,431592.0.html

I haven't looked much into the way it sends events and such, but it can certainly be made more flexible allowing more than one algorithm and the like, much like how I programmed Cherokee. When I get time I'll probably go ahead and do that.

So, who wants to fix it and contribute the changes? If benland doesn't want to incorporate them, perhaps Wizzup? can host the fork at https://git.villavu.com/ ? If you are wondering, this won't change the way it is used at all from SCAR or Simba, the change will be transparent to the users.

Wow, nice find! I don't know whether or not to be happy, lol. :)

E: Until the update comes (if it does) I guess I'll take precautions with my main and just bot directly to the browser.

I do doubt very much that jagex would have system(s) in place that checked how every player actually reads reads the client, and i doubt that it is against the rules to directly read the client.

I doubt it's that detectable, or that Jagex would use that to detect SMART. I actually use an addon for Mozilla that blocks my page referrer, so a browser won't necessarily send a referrer.

Ben has said before that SMART is easily detectable, but that jagex doesn't bother to check for it.

But the point is, they might one day, so maybe we'd like to have go at these changes, since mopar even went through to point them out? :)

~RM

From: NiCbaZ
I do doubt very much that jagex would have system(s) in place that checked how every player actually reads reads the client, and i doubt that it is against the rules to directly read the client.

We aren't talking about complicated 'systems':

[PHP]
if(empty($_SERVER['HTTP_USER_AGENT'])
flag_user();
[/PHP]

It is against the rules to play the game outside of a browser isn't it? The only way it would load it without a user-agent would be if someone wasn't using a browser. Plenty of proof to ban someone, or at least flag them.

I'm not going to debate with you over whether or not they detect this or not, without inside sources at Jagex we will never know for sure. What we DO know for sure is that it is easily detectable, and all cheats should be written in a way so that they operate exactly as a person playing the game in a browser would, so that they CAN'T be detected.

From: r!ch!e
I doubt it's that detectable, or that Jagex would use that to detect SMART. I actually use an addon for Mozilla that blocks my page referrer, so a browser won't necessarily send a referrer.

How do you know they don't detect SMART? ;) It still sends a user-agent, and the Java plugin sends a different one no matter what kind of extensions you have installed or what browser you are using, so it's easy to see you aren't loading it right with a simple grep of the HTTP server logs.

From: Sir R. Magician
Ben has said before that SMART is easily detectable, but that jagex doesn't bother to check for it.

But the point is, they might one day, so maybe we'd like to have go at these changes, since mopar even went through to point them out? :)

~RM

Benland nor anyone else without direct access to Jagex can't know if they detect SMART or not. But they can, that should be enough to fix it. (it's not exactly a hard fix either)

"Windows Client

* Launch RuneScape directly from your desktop, without all that browser clutter;
* Doesn't need Java installed - try this if you can't install Java or are having Java problems;
* Doesn't require administrator privileges for your PC;
* The application is open source. For a copy of the source, click here.

Click Here to download. If you are having problems then look at our troubleshooting guide."

Does the standalone Jagex client also do this?

SMART by passes the adds, so it is against the rules.

Somebody posted a youtube link last week-ish about a Q&A session with jagex, and they mentioned a mass ban coming. Assuming that's true, that means they have been saving up bans from various detection methods. If this is one of those methods, then there should be a >100 fold increase in bans of SRL users when that mass ban comes. If that doesn't happen, then we can assume that they don't bother with it at the moment. But either way, somebody should take a crack at fixing it, for the same reason we have consts like BLACK_OUTLINE. Great find mopar.

Funny, I made a post about this 2 years ago about HTTPHeaders, and got flamed for "not knowing what I was talking about.", "Jagex can't check that." Meh…

I remade a similar thread a few months back, and got no feedback at all, now suddenly its a good idea >.>

Guess I should have had Mopar post it …

From: Jethr0x
Funny, I made a post about this 2 years ago about HTTPHeaders, and got flamed for "not knowing what I was talking about.", "Jagex can't check that." Meh…

I remade a similar thread a few months back, and got no feedback at all, now suddenly its a good idea >.>

Guess I should have had Mopar post it …

Link to threads?

1st one deleted (since I can't find it),

2nd one= click my name, click viewposts, its like 10 down.

titled: HTTP Headers

From: tarajunky
"Windows Client

* Launch RuneScape directly from your desktop, without all that browser clutter;
* Doesn't need Java installed - try this if you can't install Java or are having Java problems;
* Doesn't require administrator privileges for your PC;
* The application is open source. For a copy of the source, click here.

Click Here to download. If you are having problems then look at our troubleshooting guide."

Does the standalone Jagex client also do this?

I haven't looked at the source code for this yet, though I know they use the openjdk (which is why they had to release the source).

They probably send their own user-agent, which would be allowed. Not sending one at would definitely raise flags though.

From: Jethr0x
Funny, I made a post about this 2 years ago about HTTPHeaders, and got flamed for "not knowing what I was talking about.", "Jagex can't check that." Meh…

I remade a similar thread a few months back, and got no feedback at all, now suddenly its a good idea >.>

Guess I should have had Mopar post it …

I did see your thread before I posted this, but you only mentioned the referrer, which is a small part of the problem (there ARE legit reasons they wouldn't get a referrer, there AREN'T any they wouldn't get a user-agent)

You also just asked the question, instead of saying 'this is the problem', but either way, good thinking and keep it up! :)

This is a relatively simple fix, so we should add it and Ben can patch the SMART svn, following this we can simply update the libsmart.(so|dll).

From: moparisthebest
… I did see your thread before I posted this, but you only mentioned the referrer, which is a small part of the problem (there ARE legit reasons they wouldn't get a referrer, there AREN'T any they wouldn't get a user-agent)

You also just asked the question, instead of saying 'this is the problem', but either way, good thinking and keep it up! :)

Thanks, however, even spoofing things such as user-agent can cause other problems, as your browser holds cached data from things from previous days, or even weeks that are readable, I think that's what the big "youtube comment scare" was about…

However, if we were to spoof it with SwiftKit's headers, it would look more legit, don't you think?

SwiftKit = Open's SwiftKit's Homepage, Navigates to RuneScape.com, and loads a random world via the "Click Here to Play" on their page…

If I recall, kBot did something very similar to this, (the whole navigating through the site)

http://gh0stowns.net/PHPTools/Test.php <– Interesting :o

Browsers don't always cache data, and they never cache the client, so we don't have to worry about that. The client loading code in my bot framework, cherokee, navigates the website as well, but doesn't as of yet send a different user-agent for the jar, as I haven't updated it since I discovered that.

From: moparisthebest
Browsers don't always cache data, and they never cache the client, so we don't have to worry about that. The client loading code in my bot framework, cherokee, navigates the website as well, but doesn't as of yet send a different user-agent for the jar, as I haven't updated it since I discovered that.

I believe I 1st thought of it when I saw a post saying don't go from www.rsbots.net -> www.runescape.com because they will see you are from there…

so I played around with php methods and saw alot of other things they can read, and i passed it onto Kosaki who said he would see what he can do… which I guess he made the bot navigate the page.

One thing is, in Java, its easy to check for running processes =/ … not sure if its illegal, but something like:

Process p = Runtime.getRuntime().exec(new String[]{"cmd", "/c", "tasklist /svc"});
    	BufferedReader stdInput = new BufferedReader(new InputStreamReader(p.getInputStream()));
    	BufferedReader stdError = new BufferedReader(new InputStreamReader(p.getErrorStream()));

Then read the incoming data, and output it as a array…

if (strOutput.length() < 1) {
    	} else {
    		String processName[] = Misc.splitArgs(strOutput);
    		process = new StringBuffer(process).append(" "+processName[0]).toString();
    	}
    	strOutput = stdInput.readLine();
    	}

:S

then check for it with something like.

if process.contains("scar.exe") { Flag.User(); } 

or

if process.removeAllBut("java.exe").Length() > 10) { Flag.User(); }

^ Checks form ore than one java.exe process… (botting while on another acc, etc)

As I said, these can be illegal, but how would we know if they are doing it? I dont think u can VMWare Java Incoming commands :o

then from that they can grab specific information about a process… and since you clicked yes on the signature, they can do w\e they want to your computer…

Like there are SO MANY THINGS jagex can use to check for bots… *undetectability* is so much more than just humanlike movements, reflection, and loading the client the right way.

From: moparisthebest
Browsers don't always cache data, and they never cache the client, so we don't have to worry about that. The client loading code in my bot framework, cherokee, navigates the website as well, but doesn't as of yet send a different user-agent for the jar, as I haven't updated it since I discovered that.

Would there be a way to fudge the refferer?

The referrer is provided by the client and can easily be manipulated.

But as mopar said, the HTTP_REFERER isn't the problem, its the HTTP_USER_AGENT Anyways: Spoofing a HTTP_USER_AGENT legitly can be done by:

  var
     agent : string;

procedure SetAgent;
begin
  agent := GetPage('www.whatever.com/useragent.php');
  agent := Between('<agent>', '</agent>', agent);
end;

^ just wrote in scar cause it was easier and more colorful

then have the .php be something like:

<html>
<head>
<title>blah</title>
</head>

<body>
<?php
     echo "<agent>" . $_SERVER['HTTP_USER_AGENT'] . "</agent>";
?>
</body>
</html>

right?

To make sure the agent it spoofs will match the same as if the user logged in normally. (if they do checks like that by IP)

Also, does PHP and Java return the same things? I'm sure they would…
(im sure theres a better way)

From: Nava2
Would there be a way to fudge the refferer?

It's easy to set both the referrer and the user-agent from Java, they are just headers.

@jagex checking running processes
Currently they don't do that, we can check the code every update to make sure. But more to the point, if we run the client unsigned then they can't do anything like that at all, I've written a SecurityManager for MoparScape that is under the GNU/GPL that we can incorporate into SMART to make sure the client runs as unsigned, when I get time I'll probably just re-write the whole thing (or at least the java part)

You want to reserve the users option to use signed. Though I agree, something should be done to make SMART less detectable.

From: IceFire908
You want to reserve the users option to use signed. Though I agree, something should be done to make SMART less detectable.

Yea, I'm all for users choices. :)

Unsigned was abandoned by SRL many months ago.

Unsigned has slightly different placement of some login screen items, no "lobby" screen, and slightly different logout functionality. Anytime the signed client login screen would update, the SRL login code would be "fixed", thereby breaking the still working unsigned login.

Set a simple boolean for signed\unsigned,

according to what you said, the unsigned client doesnt change much, so it won't be much more to "fix" when there is an update…

then have the signed\unsigned procedures in the same method, just switched by the defined boolean… right?

From: tarajunky
Unsigned was abandoned by SRL many months ago.

Unsigned has slightly different placement of some login screen items, no "lobby" screen, and slightly different logout functionality. Anytime the signed client login screen would update, the SRL login code would be "fixed", thereby breaking the still working unsigned login.

I've explained to Fakawi on moparisthebest.com why autoing with the signed client is a HORRIBLE idea. Maybe I'll have to make a thread here about it…

From: tarajunky
Unsigned was abandoned by SRL many months ago.

Unsigned has slightly different placement of some login screen items, no "lobby" screen, and slightly different logout functionality. Anytime the signed client login screen would update, the SRL login code would be "fixed", thereby breaking the still working unsigned login.

It wasn't abandoned, just that my my old computer ( that just died via blue screen lol ) couldn't run unsigned and no one else offered to port the new login system to work with unsigned. Perhaps this will change soon, if I don't than some one else.

I like signed because I've never been banned before using it, and it runs a lot smoother for me. All in all, it's been worth the risk.. so far.

Signed does give A LOT more access to your computer than you realize =/

Easily a shell can be made to view all files. >.>

From: moparisthebest
I've explained to Fakawi on moparisthebest.com why autoing with the signed client is a HORRIBLE idea. Maybe I'll have to make a thread here about it…

please do! :)

Totally different thought, but what about this?

if(this.getClass().getClassLoader() != Object.class.getClassLoader())
  System.out.println("HAMMERTIME");

From: Tniffoc
Totally different thought, but what about this?

if(this.getClass().getClassLoader() != Object.class.getClassLoader())
  System.out.println("HAMMERTIME");

Jagex themselves use a classloader, so that would print 'HAMMERTIME' every time. :)

And, yet again, the unsigned applet couldn't even run that code. :sasmokin:

From: moparisthebest
I've explained to Fakawi on moparisthebest.com why autoing with the signed client is a HORRIBLE idea. Maybe I'll have to make a thread here about it…

Please do.

This is the same old thing I've heard a million times. Its a non-issue, but if you all are dead set on continuing to bring it up, someone make a patch, send it to me, and i'll commit it. There are a plethora of other (better and more accurate) ways to detect if SMART is being used or not. To be perfectly honest, Jagex just doesn't seem to care. I highly doubt they would use anything outside of the Java client to nail people for autoing. After all, is it against Jagex's rules to use a non-standard browser? True, the ad blocking is an issue that does go against their TOS, but do you all REALLY want to add the Ads to SMART? Anyway, yea. This is an old and non-issue.

Edit: For an example of a much easier and more accurate method of checking for SMART. Simply put:
try {
Class.forName("smart.Client")
banUser();
} catch (Exception e) {
}
somewhere in the runescape client. Instant ban. This is just an example of how people react to limited knowledge. The browser-emulation issue is completely irrelevant.

I don't know if it helps, but in FireFox I use a greasemonkey script to remove the ads on the F2P worlds - it displays them for a second, but then they are hidden. Maybe some kind of implementation like this? I'm not that versed in java, so I'm not sure how you would do this.

From: BenLand100
This is the same old thing I've heard a million times. Its a non-issue, but if you all are dead set on continuing to bring it up, someone make a patch, send it to me, and i'll commit it. There are a plethora of other (better and more accurate) ways to detect if SMART is being used or not. To be perfectly honest, Jagex just doesn't seem to care. I highly doubt they would use anything outside of the Java client to nail people for autoing. After all, is it against Jagex's rules to use a non-standard browser? True, the ad blocking is an issue that does go against their TOS, but do you all REALLY want to add the Ads to SMART? Anyway, yea. This is an old and non-issue.

Edit: For an example of a much easier and more accurate method of checking for SMART. Simply put:
try {
Class.forName("smart.Client")
banUser();
} catch (Exception e) {
}
somewhere in the runescape client. Instant ban. This is just an example of how people react to limited knowledge. The browser-emulation issue is completely irrelevant.

Even if a non-standard browser didn't send a user-agent for the page, the java plugin would send one for the jar file no matter what. And a simple grep of the logs is all they need to discover this, it's something we could never know whether they do it or not. If they put that code in the client, we would find it (not to mention we need to run the client with a proper securitymanager and that type of thing couldn't be done anyway).

I'll probably end up writing a patch to send you in a few weeks though.

edit:

From: noidea
Please do.

What information can Jagex Track? (always use unsigned client)

Good job. I have always been scared of using smart on my main so I have only botted using a browser =)

I think a minimizable browser that supports java would be great for autoing. (One that has fake mouse and color finding just like smart). And it should send all the same things to jagex than like firefox does =)

From: moparisthebest
Even if a non-standard browser didn't send a user-agent for the page, the java plugin would send one for the jar file no matter what. And a simple grep of the logs is all they need to discover this, it's something we could never know whether they do it or not. If they put that code in the client, we would find it (not to mention we need to run the client with a proper securitymanager and that type of thing couldn't be done anyway).

Do they require you to use sun's java plugin? I mean, you can use a simple proof by contradiction to solve this problem.
1) Suppose Jagex detects SMART being used
2) Jagex would ban accounts using SMART (if for no other reason than blocking adds)
3) Any account using SMART would be banned
Since AFAIK accounts are not banned for using SMART, they must not detect SMART being used.

From: BenLand100
Do they require you to use sun's java plugin? I mean, you can use a simple proof by contradiction to solve this problem.
1) Suppose Jagex detects SMART being used
2) Jagex would ban accounts using SMART (if for no other reason than blocking adds)
3) Any account using SMART would be banned
Since AFAIK accounts are not banned for using SMART, they must not detect SMART being used.

Jagex has never banned accounts immediately on detection, and perhaps they just flag all the SMART users and watch for something else, or save them up for those mass-bans they like to do.

The bottom line is regardless of whether they actively detect it now or not, it is still easily detectable and can be fixed rather easily, so it should be.

From: Boreas
Somebody posted a youtube link last week-ish about a Q&A session with jagex, and they mentioned a mass ban coming. Assuming that's true, that means they have been saving up bans from various detection methods.

I'd like a link to that.

Seems to me that – whenever they talk nebulously about banning bots – they'd be mostly targeting the Java bots out there, especially the ones with hundreds of times as many accounts as us.

Or they're BSing.

But seriously, there are more Java based chinchompa bots, more dragon bots, more avian bots, by far than there are SCAR and Simba bots. Because they mass market for real world profit. We don't.

Anyway, there are definitely Firefox plugins that mess with the user agent, and definitely people out there who use them, so they should get at least some amount of false positives.

From: ForgotMyName

Seems to me that – whenever they talk nebulously about banning bots – they'd be mostly targeting the Java bots out there, especially the ones with hundreds of times as many accounts as us.

Or they're BSing.

But seriously, there are more Java based chinchompa bots, more dragon bots, more avian bots, by far than there are SCAR and Simba bots. Because they mass market for real world profit. We don't.

Anyway, there are definitely Firefox plugins that mess with the user agent, and definitely people out there who use them, so they should get at least some amount of false positives.

How does that make you feel any better? SMART is a Java bot.

And as I said above, firefox extensions can mess with your BROWSER user-agent, but the sun java plugin ALWAYS sends a user-agent when requesting the jar file, regardless of browser or extensions.

I could write something up for SMART that sets the JAR request properties, but what should be put for the referrer property?

I have accounts that have been using smart since the release.. two have maxed lvls thanks to Harry's Cave fighter, I feel jagex looks for more then the client. It would be great if it was updated to get the worry off our backs.. even if some users dont think its relevant. I'm not very educated in the whole java field but i've been around here a while and safty is what srl offers. A safer, reliable bot.

Sorry for spelling and/or grammar.
:santa:Becks

From: TRiLeZ
I could write something up for SMART that sets the JAR request properties, but what should be put for the referrer property?

There is no referrer for the jar request.

So, would I set the request property to "-"

clientConnection.addRequestProperty("Referrer", "-");

or would I not even add the referrer request property?

From: moparisthebest
How does that make you feel any better? SMART is a Java bot.

And as I said above, firefox extensions can mess with your BROWSER user-agent, but the sun java plugin ALWAYS sends a user-agent when requesting the jar file, regardless of browser or extensions.

Economies of scale.

Because they can get maybe 100 people targeting SMART this way.

Or they could spend a day monitoring (insert common spot for RSBot/KBot/whatever) and 1000s. For example, that one room of chaos tunnels green dragons usually has about 10-20 bots in it per world. 80ish members worlds. And don't even get me started on soul wars or red chinchompas.

There are plenty of big Java bot sites advertising their asses off to make money off of their users. I'm not saying we're invincible, but because the SRL community does not have nor seek such large numbers, we're not likely to be the target of scrutiny. If they want their big mass ban, they have easier ways of getting the names than us.

EDIT:

One of my legit RS friends developed this trick a while back. Not sure if it still works. Go into that chaos tunnel green dragon room and drop a single nature rune and a single water rune off in the corner. Nearly every bot will run after it as soon as it appears, then get stuck trying to find their way back.

Or, go drop a piece of essence in the Varrock anvil room and then close the door a bit after. (Why are ess mining bots picking up dropped items anyway?)

Plenty of the most popular bots (I'm talking their scripts have more users than all of active SRL users combined, no offense) have these sorts of huge flaws. Making up a big ban list from any specific source is easier than going after us. We only get caught as part of the generic dragnets or abuse reports.

If Jagex isn't going to the effort to target those big sources – and I mean just you try to play legit soul wars or hunt chinchompas – then I feel confident they won't target SRL specifically.

From: TRiLeZ
So, would I set the request property to "-"

clientConnection.addRequestProperty("Referrer", "-");

or would I not even add the referrer request property?

You don't add the property at all. But for future reference, you spelled the property wrong anyway, it is 'Referer' when it comes to HTTP (yes, it is spelled wrong in the RFC)

@ForgotMyName, you don't seem to understand what I'm getting at. They don't have to 'spend time monitoring' for people that use SMART, a simple grep of the web server logs will tell them EVERYONE who uses SMART and any other Java bot (almost everyone I've seen the source code for), they can do with that information whatever they want, be it flag the person or simply ban them.

In this mass ban that is supposedly coming, I wouldn't be surprised if they finally take down my main, though he has survived every mass ban so far. I've been autoing with him on SMART for a long time and been caught in stupid randoms. I sometimes do wonder if they go after the big ones.



Though if mopar is right, it would be beneficial to prevent jagex from using one simple line of code to determine who is using SMART.

From: moparisthebest
You don't add the property at all. But for future reference, you spelled the property wrong anyway, it is 'Referer' when it comes to HTTP (yes, it is spelled wrong in the RFC)

I apologize if this was mentioned earlier, but would the fix be a simple blank argument like "" to make it less easier to detect after 'referer'? Or is there much more involved?

how do you know there is to be a mass ban?

From: BlueWorld
how do you know there is to be a mass ban?

At RuneFest, the mods said they're preparing to dish one out [ASSUMING they aren't lying to please the legits ;)]

From: cstrike

I apologize if this was mentioned earlier, but would the fix be a simple blank argument like "" to make it less easier to detect after 'referer'? Or is there much more involved?

There isn't much to the fix, I mention how to do it in the thread on moparisthebest.com linked to in the first post.