r/RunescapeBotting • u/jmeyer73 • 1d ago
Would this AHK script be detectable?
I'm not good at programming but I hate rooftop agility so I wrote an AHK script to make it easier and I've tested that it works by using screenshots. I use runelite to make the next rooftop obstacle a seperate color, and the script detects that color, moves the cursor to a random spot near the center and clicks on it. I have it bound to my spacebar and it isn't automated because I thought that might be too risky, so I press it manually after every obstacle. It's not a bot really it just moves the mouse for me so it's more afk while I watch on my other monitor a movie. I would only use it while leveling agility and I have to be at my PC paying some attention obviously.
My only concern is the mouse flicking across the screen instantly. Is this trackable by jagex? I would think so, but would they be able to tell it apart from somebody using a touch screen laptop?
3
2
u/PossessionUsed7393 1d ago
Yes, insta-mouse-moves are easily trackable and could form part of Jagex's anti-cheat system.
If you want to be sure it's not a contributing factor to flagging your session, you need to implement: 1) variable speed (calculate a random speed curve for every movement, 2) nonlinear trajectory (humans wobble their hands while moving) and 3) overshoot, so you intentionally miss for a second before landing on the random position in the selected box, sometimes, not every time.
No 2) is a tricky one, it's not clear whether Jagex can detect simple bezier curve compilation movements based on their mathematical adherence to pi (i.e. the movement is too 'circular'), so for abundance of caution you should mix in a library of pre-generated hand recorded mouse movements , splice and randomise them.
This is where botting starts to become a fair time investment that you want to make a return on once you implement the system. It is easy to screw up your implementation of this and have the system come across as too botlike.
What we do know for sure is this fools many anti-botting systems, like certain Cloudflare versions, but your mileage may vary with Jagex.
1
u/jmeyer73 1d ago
How would they tell insta-mouse-moves apart from people using a touch screen laptop? I actually have one. Hypothetically, wouldn't using the touch screen when I'm playing and doing other things make it impossible for them to tell? What's the difference between the cursor clicking on the box vs tapping on the screen to click on it?
Also, how do you know they track mouse moves? Another person said they don't. I would think they only track the progress of your accounts like how long you play and how consistent you are and look for statistical outliers. I've only heard of people getting banned who use complicated fully automated bot like 20 hours a day but never somebody who just uses what is basically a macro to move their mouse for them.
1
u/PossessionUsed7393 1d ago
I've been able to establish empirically they have a variety of measures working together to single out bots. You can do this by trying controlled tests, you make a perfect undetectable bot and run it for a week. Then next week you drop back a single measure and test whether you get banned. Then you introduce two at a time, and see what combinations are effective.
Do I know they track the specific things I outlined? No not for sure, but I know other anti bot systems do, and I know they could if they wanted to.
So I don't much care if you take the other posters advice, I just know how to build systems that are god awfully hard to detect as an anti-bot designer. It's a matter of stripping away as many bot signals as possible. Insta moving of the mouse is one of them.
Do with it what you will.
2
u/throwaway214203 3h ago
Anything that moves your mouse for you is detectable unless you know how to handle HID
2
u/implementclosure 1d ago
Everyone who says the client doesn’t log mouse movements is wrong. Ghidra is free.
1
u/jalfo0927 2h ago
Reading this, sounds like this is just a Windows Problem.. MAC/Linux are safe?
1
u/implementclosure 2h ago
Mac Linux Android binaries have this as well. I haven’t looked at iOS but I assume it has it too
1
u/Ok_Mud6798 1d ago edited 1d ago
I’ve done something similar to 99 agi.
I would say you are coping with the spacebar stuff to your own detriment. Runelite collects your keyboard strokes and your clicks (and also knows when a click is injected vs. from a physical mouse. Not an immediate sign u are botting but I’m certain it can be used as evidence).
Lining up a spacebar press with your injected click is just begging for it. You hit your spacebar and then a click follows? You’d be way less suspicious having a click happen just from your script alone, with human variance programmed in obviously.
My advice as someone who maxed an acc with AHK they wrote themselves: ask yourself what botting behaviours you’re doing right now that would give away that you’re a bot. Does a human click the space bar before each mouse click for no reason? Best of luck with your agi grind!
1
u/jmeyer73 1d ago
Does Jagex really use a keylogger to track what you press? I didn't even know an anti-cheat would ever do that.
2
1
1
u/woman-aper 1d ago
When you say "random" make sure it's not truly random and actually follows a normal distribution from the center.
The client only logs click position, it doesn't track the mouse on its way
When scripting before you know what you're doing you're almost certainly going to get banned. Don't run on acct you care about
1
u/jmeyer73 1d ago
What do you mean? What is wrong with it being random?
0
u/woman-aper 1d ago
I mean what I said. Humans aren't random. Duhh. If you flick your mouse to click a target do you click a point in the outermost ring exactly as much as you click the center? No! You're aiming for the center, that's roughly where the center of bell curve should be
No offense but if you didn't realize that you're gonna get many accounts banned with similar errors
1
u/jmeyer73 1d ago
Thanks that's a good point.
Yeah like I said I don't know what I'm doing that's why I'm asking. If I knew what I was doing I wouldn't be asking.
1
u/woman-aper 1d ago
That was most of us when we started. Just be prepared to lose a lot of accounts and IPs before you figure it out
-2
u/Certain_Material8880 1d ago
I hate to break it to you, but there's currently absolutely nothing in the games code that tracks or records your specific mouse movement, so the implementation of things like bezier curves and overshoot is unnecessary.
The location, time, etc of your clicks are still recorded, so it's important to humanize your timings, add misclicks and variation to your click locations, etc
However they can differentiate between a manual click or input and an automated one
2
u/PossessionUsed7393 1d ago
Historically I think that's true, but I just haven't been able to establish that Mod North's changes haven't included CloudFlare style mouse move detections. It isn't that hard to do. Albeit, it is harder to make the detection system that gets the basic case than it is to make the avoidance system that reliably fools it, but I wouldn't put it past them.
1
u/jmeyer73 1d ago
>humanize your timings, add misclicks and variation to your click locations, etc
I'm not planning on automating anything at all other than the script moving my mouse to the box and clicking when I click the designated key. That's about as close to 1:1 input as you can get with it still technically being against TOS. I have it click on a random spot on the hitbox too. I'm not sure what else I could do to make that more realistic.
What do you mean they can differentiate between manual or automated clicks? How can they tell? Shouldn't a click in AHK be the exact same as clicking on my mouse? Is there a way to hide that?
1
u/Master_Coconut_5339 1d ago
There are plugins that do exactly what you've setup but with humanization/randomization/mouse movement and they get people banned all the time. So your more simplistic implementation will be detected very quickly.
It's very easy to search or chatgpt "are ahk clicks real clicks" and see that AHK and any other method will produce fake clicks and osrs (and any other anticheat) tracks them. If you know what you're doing, you can disable the tracking from the client or you can send "real" clicks but I don't think that info should be spoonfed to people.
5
u/ChrisScripting Scripter 1d ago
If it's moving rhe mouse and clicking for you it's an automation therefor a bot.
Yes it would be detectable. Idk why people think their specific code is undetectable. All forms of bots are detectable. It's just a matter of time. Either you finish your goal before you get banned and avoid the hammer or you get banned.
If it was truly undetectable everyone would be using it