The Jagex Client Ban WON'T WORK... Yet

[@LaVieBAOIM]

Hate to be that guy, but with the backend, they actually do have a great system in place to detect cheaters. When creating a fork, runelite automatically has a hash index that shows when and where the fork began, kinda like a blockchain branch. That branch then shows up as an additional line of code that jagex can very easily look into and see that it's purpose doesn't exist on a normal install of RL. The real thing you need to be thinking about here is how I actually have no clue what I'm talking about and I'm just making shit up to waste your time. Okay bye.

[@VeryImportantYT]

Incredible comment

[@thewillofd5446]

😆 . Now get back to mole

[@nomad3245]

you had me

[@mmww_]

Lmfao

[@ZorteOSRS]

God damnit you got me

[@platnuim544]

Since the backend of runelite isn't public anymore, I think they'd be able to change something about it secretly so anyone using an old runelite clone would stand out

[@Yltimate_]

"Thurgo looking Linux nerds" well that's going on the Twitter bio

[@tormstorm]

ThurgoLinux when? 😂

[@MacGuffin1234]

Huge gz on the promotion!

[@ZorteOSRS]

Thanks Henry :)

[@3dp_edc]

i mean i dont have a modified version of runelite, and can still use banned plugins through launchers. which inject straight into the client.

[@piprod01]

Runelite has a much more stripped down API than other cheat clients, you can definitely sideloaded some OP plugins into runelite but I a lot of them are just not going to work because they rely on hooks that just aren't present in the runelite client. I wonder if they can detect cheat clients using reflection and this might be able to give them a fingerprint of the API functions the client has and detect some of those cheat clients that way. This would still not catch clients running in mirror mode which is what a lot of botting clients use. Although I imagine forcing the client to be launched though the launcher gives them more insight into the daughter process and that there is not any mirrored client also running. Definitely no expert or even novice here, but I suspect they could be pretty confident who is using [cheat client name expunged]. They'll not immediately permaban, and will probably just mass temp ban them for a couple days or even just warn them when the policy comes into effect like they do with RWT.

[@ZorteOSRS]

Great questions! Best suited for a bot developer to answer, but yeah I think the takeaway is that this is always going to be a cat and mouse game. Reflection, screen scraping, and other methodologies will probably all be leaned on in different circumstances to try to bypass detection. Also hoping that the launcher will have some sneaky additional checks in there (I suspect that it will)

[@josephsouthern4643]

Where's no bag UIM gone? 😭💔

[@ZorteOSRS]

Ha, you're actually only the 2nd person to ask about that series since I discontinued it. I have 3 more episodes recorded, but interest in the series was declining. I think that even though it was significantly more difficult than playing traditional UIM, it didn't come across as clearly as something like "Morytania locked." The other side was that I found that playing it felt a lot like just re-playing my main UIM grinds, except at a quarter of the speed, which was sometimes less than fun and made for slow progress. Not necessarily ruling out a return in the future though!

[@josephsouthern4643]

@@ZorteOSRS that's fair if it wasn't doing as well as you'd like man but I can't lie I was enjoying it! Hope to see it back some day 😁

[@brandonmcgillis]

Even though Runelite is the best way to play this game currently it was always funnest as a browser game

[@ksfjcu]

Hey dude, love your RS content, but theres some things you got wrong here. 1. Application signing code should NOT be private; it is the private key that identifies a RuneLite build as legit, not the code used to sign it (OpenSSL, for example, is all in the clear in much of the world's secure infrastructure is built on top of it). The details of the implementation, especially when using secure crypto libraries that are widely used and vetted, do not change the security of the signed binaries. 2. While it is true that RuneLite network code was public for years, it would not be very difficult for RuneLite and Jagex to coordinate a signed handshake that periodically identifies a client as properly being RuneLite. Again, as long as the keys used to manage these things are secure, there is no way to spoof it.

[@ZorteOSRS]

Thanks for your comment! To your first point, I suppose my wording was poor in the video. The point I was attempting to make is that the malicious users need to be unable to generate their own key that could be used to disguise an illegal client as the latest official RuneLite release. As you pointed out, I'm sure Jagex is using a well-vetted library to accomplish this rather than trying to implement it themselves (I hope lol). Hopefully that better conveys what I was attempting to get at. To point 2: I agree with you, under the assumption that this is something that Jagex has done. Whether or not that's the case, I have less confidence-- but you're correct in that it would definitely be easy to add. I appreciate the conversation, always happy to nerd out with fellow RS code nerds 🤓

[@Desperado070]

OSBuddy is PoweredBot, always been, always wil be.

[@EnderCrypt]

application signing? uhh.. i dont really know how it works but.. cant the application just send in a fake signature to the server?

[@troytrick3325]

What i want to know is why has jagex not been mass banning revs bots that insta telly or log anytime someone in their attackable range gets close enough to teleblock them???? Its sad and ruining revs

[@VeryImportantYT]

I can verify. I am runelite and work for Jagex and married to mod ash and own the internet.

[@CODCritic101]

they need anti cheat before u log in and u be good like csgo and valorant fortnite

[@RW720p]

Scan both client and withdraw unauthorized modified code. Runelite is c++?

[@Pppp-yf4lj]

Quite tricky and a headache. How would they differentiate someone developing a legitimate plugin compared to e.g. cheat plugin that's been ported to fit RuneLite API. Without intrusion you simply can't. Unless you give kernel access there's no knowing what X plugin is doing compared to Z plugin. So Jagex is none the wiser to them all they'll see is "RuneLite" so it's greenlit. This doesn't only apply to RuneLite but beyond their C++/vanilla client also every game. It's in part why VAC is meme-d as being useless; it's no privilege, you can just unhook everything when they scan for cheats and rehook right after, or supply false reading directly. But then again, is having what essentially is a rootkit on your system a fair price to pay just to play RuneScape? LOL hell no not for me. I wouldn't trust any company let alone Jagex with their track record, the risks associated is not worth it. If they decide to go the same route as Vanguard you can bet your bottom dollar its going to attract people to try hack Jagex which'd be C2 for an entire botnet all laid out ready to be exploited. I'm just happy to not be the one tasked with fixing this LOL what a drag

[@JunkieOSRS]

jagex and runelite shook hands and did that together btw i miss oprs so much so so so much i love open dev tbh

[@KenGaming3000]

I commented on your vid. Just use sb bro or h***a tech

[@bettertelevision968]

they killed playerbase again

[@Shadows_of_the_Past_Official]

Does anyone know how to get unethicalite 🤣

[@zoox101]

First?!

[@sail7689]

Who cares lol.

[@zoox101]

@@sail7689 likely the content creator would get joy out of seeing people excited to get to a video early and the comment itself driving engagement, helping it get into the algorithm! Have a nice day sir

[@ZorteOSRS]

You are #1! Thanks for being a bell-notifier :) (I absolutely do appreciate the comment for the algorithm btw)