Echo_
2013-01-25 01:02:49
Since this directly affects the SRL community:
http://www.moparisthebest.com/smf/index.php/topic,597618.msg4207201.html
tl;dr It is possible that Jagex can detect Simba by checking if your mouse movements and clicks are actually coming from your mouse, or a mouse emulated with software.
http://www.moparisthebest.com/smf/index.php/topic,597618.msg4207201.html
So, there's a function in jaclib.dll that is named as if it is some sort of wrapper around ping. Currently it's exported as __stdcall Java_jaclib_ping_IcmpService_run.
But, it does some things that are very much not as it's named.
Firstly, it does some JNI stuff to get a handle to a function named 'notify' in the client with signature (I)V. Then it installs a message hook to all windows capturing low level mouse events and sits in a loop plucking messages:The messages go to a callback that basically just calls the notify function mentioned earlier with the only interesting parameter being a pointer into the MSLLHOOKSTRUCT Windows gives you with that message.v5 = SetWindowsHookExA(14, fn, hmod, 0);
/* some stuff /*
while ( GetMessageA(&Msg, 0, 0, 0) )
{
TranslateMessage(&Msg);
DispatchMessageA(&Msg);
}
UnhookWindowsHookEx(hhk);
I know I'm not the first to discover this (well, I found it ages ago actually, so I might have been, but I know others know about it now since if you google the method there is a pastebin result) but what I don't know is what its for.
MSLLHOOKSTRUCT contains some innocuous data like the point info, but more importantly it contains the LLMHF_INJECTED flag, which if set = this event was artificially created using SendInput or similar rather than through hardware. This makes this function a potential Simba/RiD trap, no?
If it is, though, why haven't they been using it? Does anyone with more intimate knowledge of the client know what the notify method does?
It's perhaps possible that they use this just for input on their Window I guess, but why hook all windows (they have the handle at this point) and why name it as if its something its not?
tl;dr It is possible that Jagex can detect Simba by checking if your mouse movements and clicks are actually coming from your mouse, or a mouse emulated with software.