Hacker News Reader

Comment by akersten | Hacker News Reader

I wish the author got more into the weeds of anitcheat and how it evolved over time. Jagex was banning bots based on mouse movement heuristics in like 2005. 20 years later and there's some JS framework on the front page here heralding that same kind of analysis as some revolutionary new approach. I can only imagine what the modern anticheat engine entails, especially in the era of LLMs that can reliably emulate a human player. (Some of them can even write quite technical blog posts that almost escape detection ;)

View on HN

I farmed tens of thousands of us dollars in modern RuneScape by unhooking the mousehook. It worked for decades.

Find call to `SetWindowsHookEx` -> Find dword (`HHOOK`) it returns -> Inject module that calls `UnhookWindowsHookEx((HHOOK)(module_base + hhook_rva));` -> profit.

Jagex has done some interesting things, but without fail, there is a blunder accompanying each.

Short of hardware-enforced secure boot chain TPM anticheat there will always be a way around it. It's cat-and-mouse, not a single permanent solution.

Honestly, I dont know why "xbox mode" isn't this for PCs. Instead of anticheat, reboot into a stripped down mode just for playing the game that has a secure boot chain that the app can attest and report to the servers about and then reboot back into normal windows.

booting is so quick today that its hardly a friction point as it used to be.

It's called rebooting into rootkitted winblows

If it lets people play League on Linux thats a deal most will take. Tech people overestimate how much a normie cares about the anticheat or their data being sent to wherever.

This is where we're heading. But just like anything else, there will be an equal and oppsite reaction. Either side of the aisle making one large leap is bad. Regular users lose at every turn.

You suck for farming gold btw

Too hacker for Hacker News.

let's try the entrepreneurial defense that tends to work around here :

"oh no, it's okay -- you see I was selling the hack; I wouldn't have wasted time in that game."

On the contrary. I played the game heaps. If someone with no knowledge of a game beyond its engine and anticheat develops a bot, they become solely reliant on 3rd party developers ("scripters") to develop the content-specific automation programs for the bot. These are usually sold or rented on a form of UGC marketplace within the bot vendor's platform. This is tricky to balance and can produce situations that many teenagers/young adults who are running these platforms have not envisioned.

One such situation:

A particularly competent "scripter" writes automation programs for the most complicated content in the game. As such, they sell at a premium. It makes you and him considerable money for many months. Eventually, the community starts to develop a free version of this same automation program. You are now in a situation where you've likely built your business around the expectation of revenue from this one "scripter" and his/her products. Maybe you've even given them a more favorable revenue share model.

Another issue that can pop up from this, especially in lower pop games, is that it's very obvious from a statistics point of view. The game developer will easily take notice if the hardest content in the game is suddenly being done many times per day by players who have never showed an affinity for such content. This in turn increases ban numbers which hurts your product's reputation.

All of this is to say: Having thousands of hours in the game you are working on is a massive benefit at every turn. It is best to work on games you genuinely enjoy.

MMOs need bots farming gold, and are usually designing their economy around it

This is just blatantly false.

It is false. They don't need them by any means. In some specific cases, bots do help, but this is usually a result of poor design. An example would be any expendable resource that is required in large amounts, but is very boring and unrewarding to gather. In these instances, bots can be argued to be a positive. But for bots to exist to farm these boring resources, they must also exist to farm end-game content. If they exist at all, the negatives will always out weigh the positives. The positives exist, sure. But they're few and far between.

From a regular player's perspective, if they want to kill a boss for 3 hours, they must use X amount of Y resource. If the cost of Y resource is very high, or worse, the market has not enough supply, the game becomes less fun for them.

This is addressed by bots, but is better addressed by a design solution from the developer.

All of that being said, if bots exist, the reward for going and farming that boss is going to be far less than if bots didn't exist. So still, negative.

Modern RuneScape was a pit of whale hunting mtx pay2progress nonsense. As soon as they started to make an effort to restore integrity to the game, I stopped farming gold and selling the bot. Got a regular job. Now I enjoy the game as a fan and am very excited to see how far the new Jagex CEO can take the company and its titles.

I don't have any regret for profiting from a game being bled dry by bankers. When that stopped, so did I.

I feel that's fair.

“This is good for LLM.”

In reality since the new CEO, they have been much more strict with antibotting and they have virtually disappeared from the game. It’s been an incredible 6 months without major botfarms in the game. Botting subreddits have been on suicide watch since.

A large amount of work has been done this year alone to reduce botting to levels i didn't think was possible.

Obviously we only get the details JMods are willing to give away but some of their techniques can be seen in various reddit Smackdown posts like this one from six days ago - https://preview.redd.it/prx0s0qp2hlh1.png?width=355&format=p...

It's gotten pretty good (finally good enough that you can observe it in the game's macroeconomics), but if you're any good as a programmer then it's no work whatsoever to build something which can bypass it indefinitely.

Hi, I'm the author of the article.

Sadly, the anti-cheat is not something I'm too knowledgeable in. Half of the story is visible in the client: which data is tracked, and when (as well as some visual adjustments to defeat older colour-recognition bots such as SCAR) - as well as the data scrambling I mention in the article, though this was more likely meant to break all third-party clients and packet sniffers.

Knowing how Jagex used this data once they'd tracked it isn't something I have much of an idea about, though.

On the wink: I wrote this article by hand over a couple of weeks back in May; I used AI to provide wording review on some of the more technical sections, and to create the SVG diagrams from my specs.

The evolution for Old School RuneScape was to just make cheating a built-in feature. It only takes a couple clicks every ten minutes to "play" the game.

Only if you're talking about the Gemstone Crab.

Which was added because people were already doing that on the normal crabs, but fighting over the spots. So they made a crab that any number of people can fight at the same time (combat is ordinarily one to one), and it always lives for ten minutes no matter how many people are fighting it or how hard.

I don't think you are wrong, per se, but at the same time the skill level of late-game (or even mid-game) encounters has also been increasing. Plus, they usually aim to strike a balance between less intensive but also less efficient activities vs. the ones requiring frequent clicks and full attention but offering quicker progression.

this was the evolution of most online games, same reason why every action/shooter game that's online at the moment has a mechanic that allows players to see through walls : if players have that mechanic available to them then there is a likely scapegoat to believe killed you rather than realizing that it's a hacker with invisible textures or wall hacks; lessens the work for the developer answering hate mail from people that got killed by hackers.

It was enough to just write your own scripts instead of using freely available ones to avoid detection for an extremely long time.

No need for mouse heuristics. Sandwich Lady will wreck your shit

Reply on news.ycombinator.com