I’d like to start off by saying that I’ve never been a fan of using “bots” to play games for you – it defeats the purpose (to “play”) and can easily ruin online game communities (as was the case for many years in Runescape before the bot crackdown). In fact, for over 15 years I played Runescape without ever using a bot of any kind (not an auto clicker or even any keybinds). However after over 15 years of bot-free play, one day I was unceremoniously banned for botting! So there I am, out a maxed character I’ve invested a significant amount of my life to, because of something I didn’t do, when it occurred to me – as long as I’m going to be punished for it, I might as well actually bot.
Creating a bot is actually much simpler than it might seem, and a few of the modules in python (details in the instructions of Part II of this post) make it particularly easy (once you understand how they work). That said, making a GOOD, HARD TO DETECT bot takes thought. A bot should balance the desire for perfect efficiency with the need to look like a human player. Some of the methods to achieve this balance are obvious (don’t have a bot play for 40 hours straight), some require us looking deeper into human (specifically Runescape player) behavior (mouse movement patterns), and some are purely technical/based on understanding our adversary, Jagex (methods of bot detection used).
Look like a human! This section is a broader survey of potential pitfalls with bots, but is certainly not all inclusive. This is my first bot, so I’m sure I’m missing points (please comment below with any additions); and there is a broad field of work on this subject dating back to at least the 1950s. What’s more, there are a lot of companies using bot detection in a much more material way, who invest a lot of time in advancing the bot detection tools available (think Google reCAPTCHA). With that, here are a few things to pay attention to:
- Patterns/Play Style
- Clicking the same spot. This is one of the easiest behaviors to detect. A real person can’t click the exact same pixel every single time, over and over. A simple solution to this is to find an acceptable range where a click can land, and randomize where the click falls, but as we’ll see below that’s potentially not enough.
- Clicking the same pattern over and over. By design of trying to complete the same task repetitively, there is some pattern to what even human players are doing. That said, human players are messy about it, taking different “paths” to the same outcome on any given iteration.
- Clicking the same color over and over. Finding certain colored pixels is an easy and often efficient way to recognize changes in the environment (for example, seeing when an iron ore rock is ready is how, as I human, I visually identify when the rock is ready to be mined again), but it can cause unforeseen clicks (what if a player walks by that has a cosmetic with the same color in it?). Not to say this can’t be used well, but we’ll try a different detection method in this guide.
- Not interacting with other players/the environment. As a non-cheating player, one of the biggest “tells” that someone’s botting is that they won’t say anything. Yeah, sometimes people are just not paying attention to the chat, but that’s certainly not the assumption. Advanced bots can even address this by recognizing chat and replying to it, but that’s a little beyond the scope of what we’ll walk through below. A more telling failure to interact is when bots go all wonky, running around/doing stupid stuff, because something unexpected got in their way. In the iron ore mining bot below we’ll examine how such anomalous behavior can happen when a scorpion gets in the way of a movement/rock click.
- Instant mouse movement. I don’t know about you, but I can’t make my cursor teleport just by moving my mouse; however, programs can (in fact it’s often the default). First and foremost, the fix to this is to simulate the full mouse movement and not just the clicks at the destinations. That said, figuring out how the mouse should move to appear human is incredibly complex (the most complex in this list, in my opinion).
- Linear mouse movement. This is a slight improvement over cursor teleportation, but ultimately not how human beings move a mouse. Sure, it’s what we might WANT to do, but our actual mouse movement are rittled with random curves and irregular movements (also see jitter). Mimicking those types of moves can potentially be mathematically quite complex. For a good starting point in curved mouse movement, I recommend looking into “Bezier curves.”
- Constant acceleration. It’s not always easy to tell, given how fast a human moves a mouse, but we don’t move the cursor at the same speed during the entire movement. The rate will likely speed up and slow down, particularly when we first move the mouse or when we’re trying to land on a certain point on the screen.
- Jerky mouse movements.
- “Perfect” mouse movements (under/over-shoot). A human moving the cursor from point A to point B isn’t always exact. Sometimes we’ll go beyond the targeted point before moving the cursor back slightly or not move it far enough (maybe you ran out of room on your trackpad while moving the mouse).
- Jitter. Besides mouse movements not being linear or at constant speed, movements also often never follow a perfectly smooth pattern. To illustrate, try to slowly draw a straight line on a piece of paper – chances are you see little bits jutting out here/there. I recommend looking into the topic of fractalization.
- Keyboard Usage
- Simultaneous keyboard and mouse usage. Pretty hard to do…
- Certain activities commonly done by bots. It’s pretty easy to write bots for activities where you stand in one spot (high alching, fletching arrows, etc.), so those activities are common among available bots. They’re also the most commonly busted. In the writing of this article, I actually wrote a basic alching bot, which was busted very quickly. If the activity you want to automate is a common one, at least try doing it in an uncommon place (alch outside the GE, fletch by trees, mine in obscure/less efficient mines).
- Clicking within the window to bring focus to it before typing. A lot of bots will allow you to minimize your RS window while you bot, so when you want to talk to talk in game you first need to click the window to bring it back into focus – repeatedly doing this makes detection easier. Also, don’t forget not to type while your cursor is working (see Keyboard Usage above). The approach we’ll take below requires the screen to be in focus the entire time, and for the mouse to be relegated to our program entirely.
- Algorithmically easily reproducible play. Game developers are trained/practiced in writing/recognizing common algorithms, as well as with data analysis. Even “random” activity can be recognized relatively easily by “mining” the click data (though I’m not sure if Jagex does this). For example, if we have a program that clicks in a random area around a certain pixel on the screen, mining the click data could determine (after relatively little data) that the program was simply designed to click around that point.
- Identifying Information. IP addresses, computer details (screen resolution, hardware, operating system), etc. can provide bot catchers a lot of information (Google, for example, makes extensive use of network/machine information). Couple quick tips for RS: 1) don’t use an IP address that’s been caught for botting before if you can help it (VPNs are fast enough to play RS on a decent internet connection for any activity you’d want to bot) and 2) use more “common” system set-up (I’m guessing Windows 7-10, 1080 full-screen resolution, etc.), to avoid being isolated as a unique user (even if on a different account).
With all that in mind, now we can start developing a basic bot. In Part II of this guide I’ll walk through the creation of a basic iron ore mining bot for the Dwarven Mines under Faldor. You’ll notice right off the bat that this violates my point about not writing a bot for a commonly botted activity/area, but I wanted to present an example that’s both useful and where we can try and trick the system by seeming human. If you’re just in this for the code, you can skip to the end of Part II, but I’ll note that the code will be written for a specific resolution (so you will have to adjust accordingly). See you in Part II!
Excellent post. Very comprehensible and more advanced than OSRS script I’ve been able to write in Python so far.
Your Part II links throughout these posts throw 404 errors though.
Thanks for the feedback – link to part II should be fixed now.
The link still be unavailable for me :/
for those interested
great article, the bottom link is broken
where is part 2?