57 ms·

I wish the author got more into the weeds of anitcheat and how it evolved over time. Jagex was banning bots based on mouse movement heuristics in like 2005. 20

I wish the author got more into the weeds of anitcheat and how it evolved over time. Jagex was banning bots based on mouse movement heuristics in like 2005. 20 years later and there's some JS framework on the front page here heralding that same kind of analysis as some revolutionary new approach. I can only imagine what the modern anticheat engine entails, especially in the era of LLMs that can reliably emulate a human player. (Some of them can even write quite technical blog posts that almost escape detection ;)

hansvm 16d ago
It's gotten pretty good (finally good enough that you can observe it in the game's macroeconomics), but if you're any good as a programmer then it's no work whatsoever to build something which can bypass it indefinitely.
OSaMaBiNLoGiN 16d ago
I farmed tens of thousands of us dollars in modern RuneScape by unhooking the mousehook. It worked for decades. Find call to `SetWindowsHookEx` -> Find dword (`HHOOK`) it returns -> Inject module that calls `UnhookWindowsHookEx((HHOOK)(module_base + hhook_rva));` -> profit. Jagex has done some interesting things, but without fail, there is a blunder accompanying each.
- megagpt3 16d ago
  Short of hardware-enforced secure boot chain TPM anticheat there will always be a way around it. It's cat-and-mouse, not a single permanent solution.
  - compsciphd 16d ago
    Honestly, I dont know why "xbox mode" isn't this for PCs. Instead of anticheat, reboot into a stripped down mode just for playing the game that has a secure boot chain that the app can attest and report to the servers about and then reboot back into normal windows. booting is so quick today that its hardly a friction point as it used to be.
    - yoursred 16d ago
      It's called rebooting into rootkitted winblows
      - tacomagick 14d ago
        If it lets people play League on Linux thats a deal most will take. Tech people overestimate how much a normie cares about the anticheat or their data being sent to wherever.
    - OSaMaBiNLoGiN 15d ago
      This is where we're heading. But just like anything else, there will be an equal and oppsite reaction. Either side of the aisle making one large leap is bad. Regular users lose at every turn.
- JojiDoesCode 16d ago
  You suck for farming gold btw
  - jamesnorden 16d ago
    Too hacker for Hacker News.
  - serf 16d ago
    let's try the entrepreneurial defense that tends to work around here : "oh no, it's okay -- you see I was selling the hack; I wouldn't have wasted time in that game."
    - OSaMaBiNLoGiN 15d ago
      On the contrary. I played the game heaps. If someone with no knowledge of a game beyond its engine and anticheat develops a bot, they become solely reliant on 3rd party developers ("scripters") to develop the content-specific automation programs for the bot. These are usually sold or rented on a form of UGC marketplace within the bot vendor's platform. This is tricky to balance and can produce situations that many teenagers/young adults who are running these platforms have not envisioned. One such situation: A particularly competent "scripter" writes automation programs for the most complicated content in the game. As such, they sell at a premium. It makes you and him considerable money for many months. Eventually, the community starts to develop a free version of this same automation program. You are now in a situation where you've likely built your business around the expectation of revenue from this one "scripter" and his/her products. Maybe you've even given them a more favorable revenue share model. Another issue that can pop up from this, especially in lower pop games, is that it's very obvious from a statistics point of view. The game developer will easily take notice if the hardest content in the game is suddenly being done many times per day by players who have never showed an affinity for such content. This in turn increases ban numbers which hurts your product's reputation. All of this is to say: Having thousands of hours in the game you are working on is a massive benefit at every turn. It is best to work on games you genuinely enjoy.
  - dpoloncsak 15d ago
sph 16d ago
“This is good for LLM.” In reality since the new CEO, they have been much more strict with antibotting and they have virtually disappeared from the game. It’s been an incredible 6 months without major botfarms in the game. Botting subreddits have been on suicide watch since.
swarnie 16d ago
A large amount of work has been done this year alone to reduce botting to levels i didn't think was possible. Obviously we only get the details JMods are willing to give away but some of their techniques can be seen in various reddit Smackdown posts like this one from six days ago - https://preview.redd.it/prx0s0qp2hlh1.png?width=355&format=png&auto=webp&s=8a854f49ec9d1ab5c58591e7fe8f9b4e4aa5225c https://preview.redd.it/prx0s0qp2hlh1.png?width=355&format=p...
throwaway7679 16d ago
The evolution for Old School RuneScape was to just make cheating a built-in feature. It only takes a couple clicks every ten minutes to "play" the game.
- megagpt3 16d ago
  Only if you're talking about the Gemstone Crab. Which was added because people were already doing that on the normal crabs, but fighting over the spots. So they made a crab that any number of people can fight at the same time (combat is ordinarily one to one), and it always lives for ten minutes no matter how many people are fighting it or how hard.
- Hunpeter 16d ago
  I don't think you are wrong, per se, but at the same time the skill level of late-game (or even mid-game) encounters has also been increasing. Plus, they usually aim to strike a balance between less intensive but also less efficient activities vs. the ones requiring frequent clicks and full attention but offering quicker progression.
- serf 16d ago
  this was the evolution of most online games, same reason why every action/shooter game that's online at the moment has a mechanic that allows players to see through walls : if players have that mechanic available to them then there is a likely scapegoat to believe killed you rather than realizing that it's a hacker with invisible textures or wall hacks; lessens the work for the developer answering hate mail from people that got killed by hackers.
rozenmd 16d ago
It was enough to just write your own scripts instead of using freely available ones to avoid detection for an extremely long time.
alex1138 16d ago
No need for mouse heuristics. Sandwich Lady will wreck your shit
jkm_dot_dev 16d ago
Hi, I'm the author of the article. Sadly, the anti-cheat is not something I'm too knowledgeable in. Half of the story is visible in the client: which data is tracked, and when (as well as some visual adjustments to defeat older colour-recognition bots such as SCAR) - as well as the data scrambling I mention in the article, though this was more likely meant to break all third-party clients and packet sniffers. Knowing how Jagex used this data once they'd tracked it isn't something I have much of an idea about, though. On the wink: I wrote this article by hand over a couple of weeks back in May; I used AI to provide wording review on some of the more technical sections, and to create the SVG diagrams from my specs.

hansvm 16d ago

It's gotten pretty good (finally good enough that you can observe it in the game's macroeconomics), but if you're any good as a programmer then it's no work whatsoever to build something which can bypass it indefinitely.

OSaMaBiNLoGiN 16d ago

I farmed tens of thousands of us dollars in modern RuneScape by unhooking the mousehook. It worked for decades. Find call to `SetWindowsHookEx` -> Find dword (`HHOOK`) it returns -> Inject module that calls `UnhookWindowsHookEx((HHOOK)(module_base + hhook_rva));` -> profit. Jagex has done some interesting things, but without fail, there is a blunder accompanying each.

megagpt3 16d ago
Short of hardware-enforced secure boot chain TPM anticheat there will always be a way around it. It's cat-and-mouse, not a single permanent solution.
- compsciphd 16d ago
  Honestly, I dont know why "xbox mode" isn't this for PCs. Instead of anticheat, reboot into a stripped down mode just for playing the game that has a secure boot chain that the app can attest and report to the servers about and then reboot back into normal windows. booting is so quick today that its hardly a friction point as it used to be.
  - yoursred 16d ago
    It's called rebooting into rootkitted winblows
    - tacomagick 14d ago
      If it lets people play League on Linux thats a deal most will take. Tech people overestimate how much a normie cares about the anticheat or their data being sent to wherever.
  - OSaMaBiNLoGiN 15d ago
    This is where we're heading. But just like anything else, there will be an equal and oppsite reaction. Either side of the aisle making one large leap is bad. Regular users lose at every turn.
JojiDoesCode 16d ago
You suck for farming gold btw
- jamesnorden 16d ago
  Too hacker for Hacker News.
- serf 16d ago
  let's try the entrepreneurial defense that tends to work around here : "oh no, it's okay -- you see I was selling the hack; I wouldn't have wasted time in that game."
  - OSaMaBiNLoGiN 15d ago
    On the contrary. I played the game heaps. If someone with no knowledge of a game beyond its engine and anticheat develops a bot, they become solely reliant on 3rd party developers ("scripters") to develop the content-specific automation programs for the bot. These are usually sold or rented on a form of UGC marketplace within the bot vendor's platform. This is tricky to balance and can produce situations that many teenagers/young adults who are running these platforms have not envisioned. One such situation: A particularly competent "scripter" writes automation programs for the most complicated content in the game. As such, they sell at a premium. It makes you and him considerable money for many months. Eventually, the community starts to develop a free version of this same automation program. You are now in a situation where you've likely built your business around the expectation of revenue from this one "scripter" and his/her products. Maybe you've even given them a more favorable revenue share model. Another issue that can pop up from this, especially in lower pop games, is that it's very obvious from a statistics point of view. The game developer will easily take notice if the hardest content in the game is suddenly being done many times per day by players who have never showed an affinity for such content. This in turn increases ban numbers which hurts your product's reputation. All of this is to say: Having thousands of hours in the game you are working on is a massive benefit at every turn. It is best to work on games you genuinely enjoy.
- dpoloncsak 15d ago

sph 16d ago

“This is good for LLM.” In reality since the new CEO, they have been much more strict with antibotting and they have virtually disappeared from the game. It’s been an incredible 6 months without major botfarms in the game. Botting subreddits have been on suicide watch since.

swarnie 16d ago

A large amount of work has been done this year alone to reduce botting to levels i didn't think was possible. Obviously we only get the details JMods are willing to give away but some of their techniques can be seen in various reddit Smackdown posts like this one from six days ago - https://preview.redd.it/prx0s0qp2hlh1.png?width=355&format=png&auto=webp&s=8a854f49ec9d1ab5c58591e7fe8f9b4e4aa5225c https://preview.redd.it/prx0s0qp2hlh1.png?width=355&format=p...

throwaway7679 16d ago

The evolution for Old School RuneScape was to just make cheating a built-in feature. It only takes a couple clicks every ten minutes to "play" the game.

megagpt3 16d ago
Only if you're talking about the Gemstone Crab. Which was added because people were already doing that on the normal crabs, but fighting over the spots. So they made a crab that any number of people can fight at the same time (combat is ordinarily one to one), and it always lives for ten minutes no matter how many people are fighting it or how hard.
Hunpeter 16d ago
I don't think you are wrong, per se, but at the same time the skill level of late-game (or even mid-game) encounters has also been increasing. Plus, they usually aim to strike a balance between less intensive but also less efficient activities vs. the ones requiring frequent clicks and full attention but offering quicker progression.
serf 16d ago
this was the evolution of most online games, same reason why every action/shooter game that's online at the moment has a mechanic that allows players to see through walls : if players have that mechanic available to them then there is a likely scapegoat to believe killed you rather than realizing that it's a hacker with invisible textures or wall hacks; lessens the work for the developer answering hate mail from people that got killed by hackers.

rozenmd 16d ago

It was enough to just write your own scripts instead of using freely available ones to avoid detection for an extremely long time.

alex1138 16d ago

No need for mouse heuristics. Sandwich Lady will wreck your shit

jkm_dot_dev 16d ago

Hi, I'm the author of the article. Sadly, the anti-cheat is not something I'm too knowledgeable in. Half of the story is visible in the client: which data is tracked, and when (as well as some visual adjustments to defeat older colour-recognition bots such as SCAR) - as well as the data scrambling I mention in the article, though this was more likely meant to break all third-party clients and packet sniffers. Knowing how Jagex used this data once they'd tracked it isn't something I have much of an idea about, though. On the wink: I wrote this article by hand over a couple of weeks back in May; I used AI to provide wording review on some of the more technical sections, and to create the SVG diagrams from my specs.