Comment by tmp_anon_22

> Botting in general was the wild west in this game from about 2008 - ~2014.

There’s a weird, secret history around Runescape botting that I really hope gets told in full one day.

Essentially, the biggest and best botting client from the 2008-2011 era was Powerbot, later rebranded RSBot. It was written and managed mostly by some CS student from the UK, who went by the handle Jacmob, and used some bytecode editing + reflection to bind game objects directly, meaning that it allowed full interactivity with the underlying game, rather than just a simple image recognition and mouse control framework.

During this era, Jagex (makers of Runescape) made some big efforts to combat the botting. They started using obfuscators to make reverse engineering the bytecode harder, and reworked the handling of all String objects internally to mask them. There were more efforts, of varying success, but without fail, this one guy would have the botting client (and by extension, the whole botting ecosystem) back online in a week or so.

Flash forward to 2011, and Jacmob starts teasing something big for his RSBot 4.0 release: a “web-walking” API that would allow script writers to input any two positions on the world map, and have the botting client find them a path there, navigating through buildings, portals, teleports along the way. This was going to be an absolute game changer - script writing required insane attention to detail, trial and error, and tedium to navigate the world map in a slightly-randomized/hard-to-detect way. And yet a week or so before the big release… boom, another big effort comes from Jagex to stop the injection clients: the Great Bot Nuke of 2011.

This was different from the prior attempts by Jagex. Radio silence from Jacmob and the RSBot team, which was weird given the pending release. As the dust settled over the following weeks, it comes out that Jacmob, King of the botting community, has become Mod Jacmob, employee of Jagex, with very little fanfare both then and ever since. RSBot 4.0 was not to be.

Jacmob left the company several years later, but led their efforts through 2014 to combat botting, with great success. There’s very little information publicly available, but I strongly suspect he was using the obvious strategies of looking at probability distributions for click positioning on game objects and delays between certain behaviors to spot automation.

Jagex’s operations have grown much sloppier after his departure, but the scene has never returned to its former glory pre-2011. One nerdy, talented, quiet figure was responsible for so much of the Runescape community’s development - and yet you’d never know it without having been there yourself. Quite a world we live in.

(@Jacmob, if happen to read this - can I interview you pls <3?)

Edit: this is all from memory, I’m probably bungling the details in quite a few places.

>Absolutely. I learned devops managing really inefficient gold farms that got free servers from the Azure promotions when Microsoft cloud launched.

I mined cpuminer cryptocoins on azure free servers about this time. I got banned fast but still made a few 100s of dollars (which is basically a million to a 16 or 17 year old like me).

Delightful, I very nearly stopped my stream of consciousness to check the numbers, I wondered if anyone else would. It seems many of us share nostalgia around RS.

Macros are what got me into programming. I wanna write a blog on it if no one else has done it yet but you had different tiers of it in between 2005-2007:

AutoRune: top-tier -- This was the absolute best RuneScape classic bot but you had to pay $15 a month for an auth code to use it, which is extremely expensive for a school-aged kid. One of its killer features was that you could run the game in headless mode with no graphics so your PC would not be overloaded due to running too many expensive Java applet graphics processes.

If I recall correctly it had its own intuitive scripting language. Some of these scripts were extremely coordinated: you could have several accounts mine ore, another account transfer it, and another account to manage smithing it in an orchestrated fashion.

If you were into player-versus-player, RS Classic had this unintended concept of "having catch" on someone based on your player ID on the server. Essentially if your player ID on the server was lower than your opponent's, then in a fight it would be significantly easier to chase them until they were dead. Catching a player took some well timed clicks and coordination. AutoRune (and the other bots I'll talk about) exposed this player ID to you so you could log out and in until you received a player ID that was sufficiently advantageous enough for you.

Even more scary was that it had an autocatcher that made it effectively impossible for another player to escape you in PVP so that you didn't need to learn the proper catching technique.

There were also free to use but less powerful bots like IT-bot (scriptable with Java) and Runebot (IIRC only allowed you to autotrain).

Fatigue and CAPTCHAs defeated by crowd sourcing with Sleepwalker -- To deter bots, RuneScape implemented a concept called "fatigue" where your character would supposedly get tired after harvesting items or gaining a certain number of experience points and you would be forced to use your sleeping bag to rest. When you rested, you would have to solve a CAPTCHA to wake up. I am still amazed with the level of coordination that happened here: someone built a tool called SleepWalker where you would write CAPTCHAs for other people and gain points. Each point you wrote for someone else became a word that you were allowed to have someone complete a CAPTCHA for you. You were also able to pay money to avoid writing CAPTCHAs yourself, and Sleepwalker was smart enough to integrate with whatever bot you were using. Eventually the more sophisticated bots like AutoRune and IT-bot implemented their own OCR so SleepWalker became something only used by people who couldn't afford OCR, but I'm still amazed by the community coordination here.

Now, these bots interacted with the RuneScape world by sending server side commands so you would never need to actually click on anything in the world to watch your character do things. The problem here is that these methods were comparatively easy to detect so Jagex would periodically ban players caught cheating. This is where SCAR comes in.

SCAR = Shit Compared to AutoRune -- SCAR was a less sophisticated but extremely effective botting tool that relied only on clicking colors. You wrote scripts in Pascal (of all things!) to do the tasks you wanted like mine ore or kill chickens and it did this by clicking predefined pixel colors with the timings you specified. To do it properly, it calibrated your in-game compass to align properly so the pixel clicking would work. It also implemented its own timing and color jitter so that the simulated clicks would appear to be from a human and not a bot. There were also scripts that would handle cases where a mod would message you and ask if you were a bot and it would respond with 'noope im not a bot, gtg bye!'.

All the characters I automated with the API-based bots ended up banned, but I'm pretty sure the one that I used SCAR on never got banned. The clicking approach became extensible when RS Classic became RS2, and I'm sure AutoRune continued into the future too but this is where I became too busy with school to keep up with all this.

Anyway, RuneScape automation is near and dear to my heart and got me started in CS so I love talking about this haha.