Combat Bots - Flaw in mouse movement. Bot may easily be detected

[chartpk 1]

Hello,

 

I have been trying out a couple of free combat bot scripts. These include DynaFighter AIO, KingFighter, and MrCombat. I have noticed a pattern in all of these which is very bot-like.

 

Whenever the bot attacks a monster, it hovers mouse over NPC, attacks, and keeps the mouse in the same location until NPC is killed - most of the time.

This typically differs from normal human behaviour. A human player would normally hover mouse over npc, click attack, and then move the mouse elsewhere.

Such as moving the mouse slightly to the left/right, or out of the screen. Even already right clicking the next NPC to prepare to attack it.

 

I think this is a huge flaw, and a huge giveaway. As known, RS client collects mouse data. Therefore I think it is important to make this change. Now, I am not entirely familiar with Dreambot and how its scripts work. Would a change in a script make the difference I am pointing out here, or is it dreambot client itself that is responsible for moving mouse away after attacking NPC?

 

Thank you.

[Hashtag 8688]

It's the script's responsibility to move the mouse.

[Theorems 23]

This approach of not moving the mouse is taken by a lot of combat bots because it is often best to interact as little as possible with the client.

 

In theory, it would make the script look more human-like to have the movements you described. In reality, that often just gets you banned faster because you would be using random number generation which may appear humanlike to you watching the bot, but does not appear as human movements to Jagex's automated detection system because it would, of course, be able to detect patterns (or lack thereof) from the random numbers which aren't present when a human is playing.

 

That being said,  from comparing ban-rates of scripts it seems that certain movements when done correctly does make the bot harder to detect, but I have only really seen a few scripts where they have been implemented in an effective way.

[dQw4w9WgXcQ 184]

you can bot for weeks 12-24h/day using default mouse or even mouse hop.  Also, when i started randomly moving the mouse a fuck ton i didn't see any decrease in bans, though i never fully implemented my own mouse alg.  As you said, dreambot's mouse alg is so obvious that they would easily detect it if they had any form of mouse path analysis, but apparently they don't.  Mouse click position? idk, i've seen evidence that it does matter, but you can be successful without accounting for it.  

 

Mouse path isn't their primary method of catching bots, its probably only looked at manually to verify bans and to catch ahk abusers.  

[kingsolo 15]

In my script the mouse has the chance to randomly move, mostly though we will move the mouse out of the RS client whilst waiting for the NPC to die which is what I would do if I was playing legit and doing something else. 

 

I'm not entirely sure how much data Jagex collect about the position of your mouse on the screen but I believe it's more likely they are detecting repeated clicks on the same area following a specific timing pattern rather than your mouse path.

 

Who knows though!

[Articron 738]

In my script the mouse has the chance to randomly move, mostly though we will move the mouse out of the RS client whilst waiting for the NPC to die which is what I would do if I was playing legit and doing something else. 

 

I'm not entirely sure how much data Jagex collect about the position of your mouse on the screen but I believe it's more likely they are detecting repeated clicks on the same area following a specific timing pattern rather than your mouse path.

 

Who knows though!

 

Mouse position is sent every 50ms

 

Clicks are always sent to Jagex because the server needs to validate & process your click

[kingsolo 15]

Mouse position is sent every 50ms

 

Clicks are always sent to Jagex because the server needs to validate & process your click

Ah interesting, presumably this is only whilst inside the game client. Sounds like the safest thing to do is move the mouse outside the client when possible then.

[dQw4w9WgXcQ 184]

Mouse position is sent every 50ms

 

Clicks are always sent to Jagex because the server needs to validate & process your click

 

stored every 50ms*

 

sent when u click or after a fixed period in a separate packet

[chartpk 1]

Interesting to read all your inputs.
I think there are a couple of things to take into consideration.
Let's imagine a scenario for example where you let a combat bot train for you, but you manually monitor it at all times, in case there's any players next to your player that you have to chat/reply to, or a random which you should solve, or any other small interaction which requires human involvement - you pause the bot and you manually take over for a minute, then let your bot proceed.

If you take a very simplistic scenario where your only interaction with the game is fighting NPC's. You do this from your home residential IP, and you pause the bot and tak over for a minute if there's anything wrong, random, or chat needed to reply to:

Then the only ways to detect whether you are botting would be by looking at your interaction with the game. Your only interaction is by:

1) Mouse patterns
2) Camera Movements

3) Client detected as botclient

Let's disregard 3) as we assume the botclient is not detected. The only two remaining patterns to detect if you are botting are the direct interactions with the game, such as mouse patterns and camera movements.
Now, in response to @@Theorems input that using slightly randomized, or gaussian distributed mouse movements the way I explained in this thread, would be more detectable by the anti-bot systems because it picks up on randomized data.
I would disagree, because if you instead look at a bot which always/most of the time does nothing with the mouse after attacking an NPC - until the NPC is dead, that is much easier to detect from a technical standpoint.
While with randomized mouse movements right after attacking an NPC (which is what most humans do anyways - they move their mouse slightly away after clicking attack NPC, or even hover their mouse on to the next NPC getting ready to attack it, sometimes right clicking next npc, hovering mouse over attack option and waiting for current NPC to die before immediately selecting option attack), then logically that would be harder to detect as opposed to the first option - because now you're mixing patterns, behaving more like a human, doing random things.
Of course it is also important to vary mouse speed, mouse acceleration, shakyness, and distance on most moves, and varying movements in mouse per millisecond. These variables could vary according to data such as if the bot has been fighting for 40 minutes without break, and it is planned to break in 5 minutes, then increase mouse speed and accelration to demonstrate restlesness. A human playing for 40 minutes without break clicking npc's would be eager to take a pause, and click desperately for the last couple of minutes in order to kill as many NPC's. This would for example be randomized as well to not happen every time. This is one example out of many to implement a more human behaviour. In terms of resources - sure, it could be more power consuming than a bot which only interacts very little, but it will be very much more human-like and therefore less likely to get banned. Such a bot would be suitable to use on your main account with 1 bot running on the machine.

 

PS: I've looked into the API documentation, and tested out a little. The getMouse().move() method moves the cursor slightly to a random position on screen somewhere, but it I don't think it is good enough, it needs to vary more in relation to other parameters and variables.

Is it possible for the developers to create more API options for using mouse, or would this have to be created manually by the scripter?

 

On another similar note, the getMouse().moveMouseOutsideScreen() which randomly moves the mouse outside of the screen is not entirely optimized or good either. I think it should also have a method where it takes in parameters of direction you want the mouse to exit screen (top,right,bottom,left) and the percentage chance of the mouse exiting that side of the screen. moveMouseOutsideScreen() currently randomly moves your mouse outside screen on any direction, either top,left,right,bottom, and the worst thing about this, the mouse re-enters canvas again from an ENTIRELY different location. For example, mouse exits screen from the bottom right corner, and then one second after, mouse suddenly re-enters screen from the TOP area. If anything, this is the randomized mouse movements which @@Theorems mentioned which are actually BAD. Because, a human would never be able to move mouse below canvas screen, and suddenly have it appear on the top again in only a few milliseconds, even not likely after a couple seconds.

Instead, the way it should work is that it should have a specific area on screen where mouse exits and re-enters. Most people have two monitors, so a very likely scenario would be that the mouse exits screen somewhere on the right side of the canvas, and it re-enters again on the right side of the canvas (As if you have your RS client on your left monitor, and some other chrome tabs or video open on your right monitor which you're always switching to after attacking an NPC). This could be going on for a session of 30 minutes while fighting a monster, and occasionally have once or twice where the mouse exits on the top of the canvas screen, and re-enters on the right. But never exit from left side of the screen and suddenly "teleport" by re-entering on the right side of the screen. I think the API for this should definitely be updated so that it will be more adjustable.
Perhaps the option for now is to make a custom moveMouseutOfScreen(int direction, int percentage)
//With direction being 0=top,1=right,2=bottom,3=left and percent of likelihood that mouse will exit on that side of the screen, where value 100 means it will always exit somewhere on that side of the screen.

(Edit: Actually percentage isn't neccessary as it can be calculated with another method. So only int direction)

Is there any way to move cursor out of screen and re-enter from a specific location?
Maybe using getMouse().move(randomXvalue,-200) to move the cursor out of the screen on the top area (-200 y direction)?
Would the mouse re-enter automatically from that direction again for its next interaction?

[dQw4w9WgXcQ 184]

...

The only ways to detect whether you are botting in this case would then be:

1) Client is detected as Botclient

2) Mouse patterns

3) Camera Movements

...

 

not how they detect bots