SRL Archive - Discussions & Debates

Hello all, I've seen a few posts which have been saying that Jagex tracks mouse movements/clicks.

Firstly, assuming that Jagex wants to save alot of hard drive space, I put the clicks in this format:

X,Y Type (1 = left, 2 = right, 3 = scroll)

This took approximately 9 bytes to store:

511,202 1

Keep in mind that this is ONE click. An average player clicks almost 14000+ times in a single hour of gameplay, and if you think i'm pulling numbers out of my ass i'm not. I downloaded a program called WhatPulse and timed myself for one hour 4 times, here were the results:

Hour 1: Dungeoneering ~21000 clicks
Hour 2: Kalphite King ~19000 clicks
Hour 3: Kalphite King ~12000 clicks (Swapped from Tank to DPS)
Hour 4: Slayer        ~13000 clicks

Here's the bytes per hour for each activity:

21000 * 9 = 189000 / 1024 = 184.5 KB
19000 * 9 = 171000 / 1024 = 166.9 KB
12000 * 9 = 108000 / 1024 = 105.5 KB
13000 * 9 = 114000 / 1024 = 114.3 KB

Keep in mind that this is med to high click activity, and most bots cant do this sort of thing. Lets assume that bots click about 5000 times an hour, regardless of activity. Even still, the amount of KB it takes to record all this is infestismal, and a 1TB hard drive could very well cover all of this for a week.

At all times there're about 80 000 players online, and assuming that 9000 clicks an hour for the entirety of the RS Community, it takes about

9000 * 9 / 1024 * 80000 = 6328125KB / 1024 = 6179MB = 6.1GB/Hour 

Since recording/logging clicks takes about 6.1GB of hard drive space an hour, it takes Jagex approximately 146.4GB of hard drive space everyday to record all of this. However, eventually they'll have to delete/rewrite over everything that happened earlier on because they'll run out of space on the disk (or on Cloud hosting) and will have to buy another one. From a company's point of view it isn't very smart to rebuy rather than reuse.

But the bigger problem is for Jagex to actually go through all that data, so my assumption is that the only time Jagex even records your clicks is if you click in the same area (1-3 px difference) multiple times at which point they start logging your clicks and investigate (or let the computer do it tbh) once it exceeds a count.

Your opinions?

I'd like @Flight's opinion on this :p

I'd imagine they filter through a pattern, every check interval, looking for stuff like:
- click same coordinate excessively
- excessive mouse jumps (non mouse keys)

both generalized points, so definitely allow for speculation as to precise intervals/coordinates/jumps/patterns

-Lj

They probably do track mouse movements, but probably aren't as strict as we think. Have they been tracking for a while or just recently?

The client does track and send both mouse movements and clicks. The data for a mouse movement takes between 2-6 bytes to represent (depending on the changes in time and position from the previous movement), and mouse clicks can be represented in 6 bytes. It's sent this information off to the servers for years.

Regardless of the size of the data, there's not really a need to keep it around for a long time. I'd imagine that it's regularly discarded unless the system flags it as interesting, after which it's actually useful to look at the data more closely.

From: Method
The client does track and send both mouse movements and clicks. The data for a mouse movement takes between 2-6 bytes to represent (depending on the changes in time and position from the previous movement), and mouse clicks can be represented in 6 bytes. It's sent this information off to the servers for years.

Regardless of the size of the data, there's not really a need to keep it around for a long time. I'd imagine that it's regularly discarded unless the system flags it as interesting, after which it's actually useful to look at the data more closely.

Yep yep, I've seen this as far back as the 300 client series; there are indeed packets that record mouse movements & clicks.

I also agree with this data not being stored for too long, if at all. Now this is pure speculation so bear with me. If it were me I would only record near-perfect line mouse movement, and only record 2+ mouse clicks that clicked (or right/middle clicked) at the exact same coordinate twice (or more) in a row, or perhaps not the exact same coordinates but very close in range (< 5 pixels?). To me that's the logical way to go rather than storing every movement & every click of every player; just record the suspicious ones, no?

14000 clicks an hour?? That's 4 clicks per second constantly. You would basically have to be spam clicking that entire time :blink:

From: Austin
14000 clicks an hour?? That's 4 clicks per second constantly. You would basically have to be spam clicking that entire time :blink:

Time yourself, if you spam click like me than it's real possible.

Lets all set up 100 accounts moving out mouse across the screen and clicking, waste that jagex hard-drive space! haha :p

From: Ollybest
Lets all set up 100 accounts moving out mouse across the screen and clicking, waste that jagex hard-drive space! haha :p

AHAHHAHA Omg Olly you made me laugh and choke on my drink.

Wow sin nice work in figuring that out.

So realistically they would just look for repetitive patterns.

I think that's interesting that they would get so much data out of it per day.

What about all those people that high-alch and/or sell things to the general store (massive bulk)? They click on the same pixel for ages. I would say that Jagex looks more into near perfect mouse movements like @Flight said; or even, no mouse movement at all (if you're really that silly).

They'd probably look for timing in between clicks too, I'd assume. Well, their computer would look for it…

I doubt they save any mouse data on their hard drives. They could just store some recent mouse activity in their RAM and use that data to identify bots? Actually I think they have that type of tracking system only enabled on a small amount of players(reported players?) at a time to save resources.

From: guthixboss1
AHAHHAHA Omg Olly you made me laugh and choke on my drink.

That's a bit over the top..

From: xtrapsp
That's a bit over the top..

Nuuuu its the way he said it. :P

id think the only time they would look at it is if you were reported other than that i assume they would just trash the info.

I recall a jagex mod post regarding the QBD, saying that it wasn't just a boss anymore but that mouse movements and all were recorded. Therefore, the logical conclusion that I have to draw is that this system only operates in limited areas.

Also, botwatch definitely isn't all that powerful. For all the scripts that led to bans, it is fairly clear that there was some human intervention by jagex. In most cases, the script was just leaked.

As for the actual time the data is stored, I find it important to point out that bans are extremely easy to pinpoint in time. All bans start the same day and usually happen quite fast. There is no going back 30 days in the past to find out who was using the script.

Finally, areas that are said to be heavily botwatched also have scripts that have recovered from the watch, namely dungeoneering and LRC. Therefore, it is fairly clear to me that the system isn't fully automatic.

From: Wardancer
I recall a jagex mod post regarding the QBD, saying that it wasn't just a boss anymore but that mouse movements and all were recorded. Therefore, the logical conclusion that I have to draw is that this system only operates in limited areas.

Also, botwatch definitely isn't all that powerful. For all the scripts that led to bans, it is fairly clear that there was some human intervention by jagex. In most cases, the script was just leaked.

As for the actual time the data is stored, I find it important to point out that bans are extremely easy to pinpoint in time. All bans start the same day and usually happen quite fast. There is no going back 30 days in the past to find out who was using the script.

Finally, areas that are said to be heavily botwatched also have scripts that have recovered from the watch, namely dungeoneering and LRC. Therefore, it is fairly clear to me that the system isn't fully automatic.

This, their detection system is outdated like.. 6-7 years

It probably is automated and just need review from a mod. It just flags accounts and records and then someone has to review it.

From: Wardancer
I recall a jagex mod post regarding the QBD, saying that it wasn't just a boss anymore but that mouse movements and all were recorded. Therefore, the logical conclusion that I have to draw is that this system only operates in limited areas.

Also, botwatch definitely isn't all that powerful. For all the scripts that led to bans, it is fairly clear that there was some human intervention by jagex. In most cases, the script was just leaked.

As for the actual time the data is stored, I find it important to point out that bans are extremely easy to pinpoint in time. All bans start the same day and usually happen quite fast. There is no going back 30 days in the past to find out who was using the script.

Finally, areas that are said to be heavily botwatched also have scripts that have recovered from the watch, namely dungeoneering and LRC. Therefore, it is fairly clear to me that the system isn't fully automatic.

From: klae17
It probably is automated and just need review from a mod. It just flags accounts and records and then someone has to review it.

Improbable. If that was the case, why would there only have been one wave of bans for dungeoneering or LRC? I believe the work that has to be done by a jagex worker is more extensive than rubber stamping.

Botwatch operates in specifically designated regions. Once a player is identified as a bot (whether that be manual or automatic), the system can analyze that player's actions and automatically ban others that may be using the same script (behaving similarly). I'm certain that mouse biometrics plays a role as well. To the extent of my knowledge, these bans are automatic.
As for dungeoneering and LRC, it's probably because Botwatch isn't set to it at the moment. If you based the lack of bans for dungeoneering off PowerBot's scripts, then it's because Botwatch isn't set to it.
Regarding mouse biometrics, it's actually not a very CPU intensive process. As Method stated earlier, the cost for transmitting the mouse clicks is minimal, they could actually add angular based biometrics to it. The cost of that would be ~12 bytes total (an increase in 6 bytes). There was a paper published on the topic that used a Pentium 4 Xeon 3.0Ghz processor. They used angular based biometrics and were able to build profiles for 1000 users that inputted ~5000 clicks in 20 seconds. Once that profile was built, they claimed to be able to verify 5800 clicks in 230ms. Even if this is was exaggeration on the part of the researchers, the cost to verify a profile is still quite low.
Given the size of Jagex's servers and the skills of their employees, I wouldn't doubt their ability to build a profile for a bot (like powerbot) and use that profile to find users of the bot (which would only involve verification, thus not consume nearly as many resources). A few of the Fellows from powerbot apparently proved the concept and hence, forced the changes in powerbot's mouse. Obviously Jagex can't build a profile for all of it's users given the size of the game, but they can certainly target bots with a mouse implementation that very rarely resembles human behavior.

From: pyroryan
Botwatch operates in specifically designated regions. Once a player is identified as a bot (whether that be manual or automatic), the system can analyze that player's actions and automatically ban others that may be using the same script (behaving similarly). I'm certain that mouse biometrics plays a role as well. To the extent of my knowledge, these bans are automatic.
As for dungeoneering and LRC, it's probably because Botwatch isn't set to it at the moment. If you based the lack of bans for dungeoneering off PowerBot's scripts, then it's because Botwatch isn't set to it.
Regarding mouse biometrics, it's actually not a very CPU intensive process. As Method stated earlier, the cost for transmitting the mouse clicks is minimal, they could actually add angular based biometrics to it. The cost of that would be ~12 bytes total (an increase in 6 bytes). There was a paper published on the topic that used a Pentium 4 Xeon 3.0Ghz processor. They used angular based biometrics and were able to build profiles for 1000 users that inputted ~5000 clicks in 20 seconds. Once that profile was built, they claimed to be able to verify 5800 clicks in 230ms. Even if this is was exaggeration on the part of the researchers, the cost to verify a profile is still quite low.
Given the size of Jagex's servers and the skills of their employees, I wouldn't doubt their ability to build a profile for a bot (like powerbot) and use that profile to find users of the bot (which would only involve verification, thus not consume nearly as many resources). A few of the Fellows from powerbot apparently proved the concept and hence, forced the changes in powerbot's mouse. Obviously Jagex can't build a profile for all of it's users given the size of the game, but they can certainly target bots with a mouse implementation that very rarely resembles human behavior.

That is interesting. Do you think it would be impossible to build a 'profile' of a well scripted Simba bot? Simba bases a lot of its mouse movements on colour and hence is more random/human like?

From: The Mayor
That is interesting. Do you think it would be impossible to build a 'profile' of a well scripted Simba bot? Simba bases a lot of its mouse movements on colour and hence is more random/human like?

Color has nothing to do with mouse movements. Both bots will generate a destination point to move to (and/or click). How the bot moves the mouse to that destination can be exploited by mouse biometrics. I can't exactly remember how Simba's mouse works so I can't comment on the specific case, but looking at the percent bans should give you a general idea for whether something is being detected or not.
In the end, a human is fairly random whereas a bot will follow a general trend. A well scripted bot will look like a human in areas such as banking (so don't deposit an item only to withdraw more of it for example). Matt/gh0st used some of Jacmob's old code from the RSBuddy times to analyze the scripts on powerbot (when they banked, items withdrawn, where they walked, etc.) and was able to determine the areas where the scripts were repetitive enough to be analyzed. Supposedly that is very similar to Botwatch.
In short, a well designed script and bot isn't going to be detectable. Whether it uses color or injection (or any other techniques) is irrelevant in this case.

Very interesting read, thanks sin, method, flight and pyroryan.
It seems to me like jagex could be banning quite a bit more with the sheer volume of data they can collect…almost odd that their bot detection is so bad. (Another way to say it, how we are able to consistently evade them…maybe it says something about their company)

I'm surprised there aren't more ban waves. Considering it took them 6 hours to break down the second QBD powerbot botting attempt, I'd expect jagex workers to be able to cycle through different bots, find a flaw and massively ban. I wonder what can explain this. I'd be very surprised if something massive was coming as botwatch was defined as a work in progress system that would slowly get rid of bots.

Any hypothesis?

From: Wardancer
I'm surprised there aren't more ban waves. Considering it took them 6 hours to break down the second QBD powerbot botting attempt, I'd expect jagex workers to be able to cycle through different bots, find a flaw and massively ban. I wonder what can explain this. I'd be very surprised if something massive was coming as botwatch was defined as a work in progress system that would slowly get rid of bots.

Any hypothesis?

The only thing I can think of is that maybe the combination of the QBD bot having an obvious flaw and also having many users was what made it so detectable. Consider this: The way below average Simba script has multiple flaws that should alarm Jagex, however because it likely has very few users it is difficult for a discernible pattern to emerge. Or an above average Simba or PowerBot script, there would be enough users to generate a discernible pattern, but there are no big flaws to raise red flags. Does that make sense or not?

From: BMWxi
The only thing I can think of is that maybe the combination of the QBD bot having an obvious flaw and also having many users was what made it so detectable. Consider this: The way below average Simba script has multiple flaws that should alarm Jagex, however because it likely has very few users it is difficult for a discernible pattern to emerge. Or an above average Simba or PowerBot script, there would be enough users to generate a discernible pattern, but there are no big flaws to raise red flags. Does that make sense or not?

I believe that's one plausible hypothesis. Another one is that jagex really isn't making that much of an effort.

I found out not too long ago (yesterday I believe) that the idungeon bot on powerbot wasn't even updated since it received a ban wave yet many people are still using it without getting banned while during the ban wave, people were getting banned after 15 minutes of use. Maybe the powerbot's includes were updated though, I wouldn't know.

That being said, I'd be quite happy if your theory ended up being the correct one and that their system would be that bad.

From: BMWxi
The only thing I can think of is that maybe the combination of the QBD bot having an obvious flaw and also having many users was what made it so detectable. Consider this: The way below average Simba script has multiple flaws that should alarm Jagex, however because it likely has very few users it is difficult for a discernible pattern to emerge. Or an above average Simba or PowerBot script, there would be enough users to generate a discernible pattern, but there are no big flaws to raise red flags. Does that make sense or not?

Makes perfect sense to me. A script with a large enough user base with flaws will lead to bans. I guess an example of this would be iDungeon.

^Sorry just saw your above post

I dont think that mouse click data can really help Jagex that much tbh.

From: Method
The client does track and send both mouse movements and clicks. The data for a mouse movement takes between 2-6 bytes to represent (depending on the changes in time and position from the previous movement), and mouse clicks can be represented in 6 bytes. It's sent this information off to the servers for years.

Regardless of the size of the data, there's not really a need to keep it around for a long time. I'd imagine that it's regularly discarded unless the system flags it as interesting, after which it's actually useful to look at the data more closely.

Do you have any clue as to how they log the data?
I am wanting to log data from scripts I run and would like to use a logging method as similarly as neatly as possible.

From: pija
Do you have any clue as to how they log the data?
I am wanting to log data from scripts I run and would like to use a logging method as similarly as neatly as possible.

I'm not sure what you mean. Any code that deals with the mouse data is on the server, which is inaccessible to us.

From: Method
I'm not sure what you mean. Any code that deals with the mouse data is on the server, which is inaccessible to us.

How do they format and log mouse activity?
You said something about taking 6 bytes to store mouse clicks, and 2-6 to store mouse movement, even if it is a speculation, I want to make an approximation of the information the client sends, this way I can analyze the data.

From: pija
How do they format and log mouse activity?
You said something about taking 6 bytes to store mouse clicks, and 2-6 to store mouse movement, even if it is a speculation, I want to make an approximation of the information the client sends, this way I can analyze the data.

The client packs up the position (or change in position), a timestamp, and any extra relevant data and sends it off to the server. The protocol changes every client version, and packet opcodes are encrypted, so trying to intercept and decode these packets as they travel over the wire probably won't work very well.

If you just want to see how your script is moving and clicking the mouse, why not edit the SRL mouse routines to log the relevant data?

How would they log mouse movement? do they log every pixel the mouse hovers on and timestamp it? If it only records on a given interval then they aren't recording mouse movement( which they are lol).
How do you think they save mouse movement?

From: pija
How would they log mouse movement? do they log every pixel the mouse hovers on and timestamp it? If it only records on a given interval then they aren't recording mouse movement( which they are lol).
How do you think they save mouse movement?

The client has a class that implements MouseListener and MouseMotionListener which subscribes to mouse events that take place over the game window. Events are fired automatically by Java when the mouse is moved over or clicked on components (like the game screen, for example), so the client just takes the information it receives from there, packages it up, and sends it off to the server.

I remember hearing that Java notifies event listeners about mouse motion events roughly every 20ms or so, but the frequency at which Java learns about events probably depends on your OS and its configuration.

From: Method
The client has a class that implements MouseListener and MouseMotionListener which subscribes to mouse events that take place over the game window. Events are fired automatically by Java when the mouse is moved over or clicked on components (like the game screen, for example), so the client just takes the information it receives from there, packages it up, and sends it off to the server.

I remember hearing that Java notifies event listeners about mouse motion events roughly every 20ms or so, but the frequency at which Java learns about events probably depends on your OS and its configuration.

So theoretically it's possible to block/stop the MouseListener from sending info to the server?

From: Sin
So theoretically it's possible to block/stop the MouseListener from sending info to the server?

Sure, you could modify the client so it doesn't send that information. However, I'd imagine that not sending any data is more suspicious than sending data that may be considered bot-like after analysis.

Yup that's what I was thinking too :/

From: Sin
Time yourself, if you spam click like me than it's real possible.

Yepp haha, I am like you, always spam clicking, especially if my character doesn't start doing what i want right away :p

Also, very informative. Im sure they do record mouse clicks and such, but throw away the information unless it is flagged as bot like.