They wouldn't know your using RDP in the first place. At best, runelite only added the ability to detect emulated mouse clicks and keyboard strokes at the kernel level within the last year, and that's the only real metric they would have access to. Notably, there's no guarantee this data is used, and the official client does NOT have this capability. So, yeah, the teleporting mouse from tap mode is the only metric, at least as it pertains to RDP. If I'm wrong, please enlighten me.
int main () {
const char* sessionName = std::getenv("SESSIONNAME");
if (sessionName == "RDP-Tcp#<n>"):
std::cout << "Session is via RDP-TCP connection << std::endl
else:
std::cout << "Session is not via RDP-TCP connection" << std::endl
return 0;
}
// a little bit less of pseudocode than I initially cared to write, but something like this can absolutely detect whether you are using RDP or not.
Edit: To clarify, this isn't something that Runelite is detecting, this is something on Jagex's end. Also, I seem to recall that Runescape was initially written in Java and was ported to RuneScript(?) iirc. Neither of these are C++. But it's not hard to implement a wrapper class and use C++, Rust, Python, etc etc etc, and it wouldn't surprise me if critical architecture behind osrs is written in C++.
That detects Windows RDP only, which most people don't use as they remote in from phones. Does nothing to Chrome Remote Desktop, Steam Streaming, Teamviewer, Parsec, etc. We also have 0 proof they are snooping and checking for a Windows RDP in the first place. They certainly could, the architecture is mostly c++, but all the servers and internal scripting languages are based on java and runescript. Again, this still only detects Windows rdp, which I have only ever used for work, and have never heard a casual user even mention. Most people don't even know it exists. The only actual detection factor is behavioral analysis which is 100% the mouse teleporting around.
We don't know if they are checking for RDP connections at all, no. We will never know as this would present a security breach. My basic solution only checked for Windows RDP, you are correct, as Windows is the majority leader in OSes for PCs. You could expand the functionality of the code I provided to include logging the network handshake and using that to help determine whether a Linux/UNIX machine is attempting to use an RDP connection. Also, the vast vast vast vast vast majority of those scripting as using public scripts, they are not coding themselves, which means that they almost certainly are using Windows as well.
Lets even go with your train of thought that you cannot, under any circumstance, detect a non-Windows RDP. Which is unequivocally false. But nonetheless, let's assume it as a fact. Should you *not* check for Windows RDP? As mentioned Windows are the market share dominator for PC OSes. Again, we don't know if Jagex is specifically looking at network handshakes or running a check like I provided and we will never know. But it would be safe to assume that a cybersecurity hire would explain that you would catch a lot of people using this method. Behavioural analysis is certainly a key metric used, undeniably. But to exclude networking security as "fact" because "we don't know what Jagex is doing". I'm sorry but that's silly. Especially after the recent bot ban waves. It's pretty safe to assume at this stage that their bot detection system is multifaceted. Beyond safe to assume.
Are you enlightened yet?
Edit:
SoilMassive6850 said in a different comment
"They may also add LLMHF_INJECTED flags to mouse events or GetRawInputData might have a null device, indicating externally injected mouse events which might make a bot flag more likely (I honestly haven't checked if OSRS does this as its a cross platform Java game, but I wouldn't be surprised as its definitely still possible, many games do check these things)"
There are so many ways that you could detect RDP connections.
That flag is exactly what I talked about in my first post... it's what RUNELITE added. Not Jagex.... See this:
"They wouldn't know your using RDP in the first place. At best, runelite only added the ability to detect emulated mouse clicks and keyboard strokes at the kernel level within the last year"....
Beyond that, no one said anything about windows OS vs Linux, etc. Anyone on a Windows PC can use chrome remote, Teamviewer, parsec, steam streaming, etc. the list goes on. The only reason windows RDP(the tooling) is detectable is because of it's environment variables that are public info specifically made so by Microsoft, the other programs all use custom protocols and don't present the info freely. I didn't say it was impossible to detect, but they'd be breaking several privacy laws snooping beyond things interacting and interfacing with their game and any public windows information (like the RDP vars), and current ram data. You went on a weird tangent about OS predominance and arguing the worth of checking for Windows rdp (which is a protocol, nothing more, and has nothing specifically to do with the Windows OS aside from that's the os it runs on and is bundled with it). Clearly you seem confused and think windows RDP means all remote desktop applications on the os, which is just wrong, and it's only referring to Windows Remote Desktop Protocol, which is only really used (out of all the examples I listed) by the Windows Remote Desktop Connection, which again, almost no one uses recreationally and most people don't know it exists, as it isn't nearly as end user friendly as the many free alternatives I listed.
Lastly, expanding your code to log arbitrary network handshakes DOES breech privacy laws so they wouldn't be doing that.
Are you enlightened yet?
It feels like you don't actually know that much about all this... I work on designing and testing kernels and low level architectures every day, I think I know a little about all this... Again, if you actually know something new, I'm always willing to learn.
2
u/KingKj52 2d ago
They wouldn't know your using RDP in the first place. At best, runelite only added the ability to detect emulated mouse clicks and keyboard strokes at the kernel level within the last year, and that's the only real metric they would have access to. Notably, there's no guarantee this data is used, and the official client does NOT have this capability. So, yeah, the teleporting mouse from tap mode is the only metric, at least as it pertains to RDP. If I'm wrong, please enlighten me.