Haha, Runescape story time. I made a sizeable sum of GP in the early RS2 days by writing a bot that automatically bought items from underpriced general stores. To find the store operator NPC, the script would move the mouse randomly over the game window and detect the yellow text in the top left. I wrote a cool function to count the number of letters in the text, as a kind of rudimentary OCR. This defeated a lot of the randomisation that Jagex applied to stop bots, since the text was always in the same place, a consistent colour, etc whereas everything else was pretty well randomised.
From there, it could "read" enough to find the right places to click to buy things. The bot basically world hopped constantly, 24 hours a day, and bought cheap items until the general store was depleted. I'd then sell them in bulk for several times more. I never got hit with random events (in-game captchas), because I never stayed logged in for more than a minute or so. I was also not hit by any of the big banning waves, since I didn't rely on reflection in Java or use any of the popular "frameworks" for macroing.
Joke's on me though, because that game consumed several years of my life and I spent a lot of money buying several years worth of "members".
Later on there was also a gambling culture of "dicing" where you'd join an IRC channel, type a command to a bot like '/roll', and get paid in-game if the 'dice roll' came out in a certain way. I took an educated guess that the channel operators were running bots with mIRC, and reverse engineered the random number generator in the mIRC client (which was fun, because it was written in C++). Turns out it was a linear congruential generator which was in principle brute forceable given a few consecutive rolls. I wrote some OpenCL code for my GPU in the very early days when "GPGPU" was a new idea, but was never able to get it fully working because mIRC used 64-bit floating point arithmetic and the least significant digits were relevant to the outcome of the RNG, and my GPU was only 32 bit.
I wrote my own auto miner for RS3 (though it would have worked for RS2 too), and it was my first foray into the OpenCV and blob detection. If a mineral was ready to be mined it would sparkle with a distinct and small white star.
I had no other inputs beyond that, and I remember that the script would work well for about an hour or two and then I'd accidentally try to attack something else that had the nerve to sparkle at me, which would send me on a wild goose chase. At one point I came back to the machine after dinner and found myself running in the wilderness.
This resulted in me having to keep an eye on it whilst it "automines", which was frustratingly boring, and probably is similar to what certain drivers feel in their autopilot cars.
The worst part is that I was in the vicinity of actual miners who were all talking to each other, and sharing stories, and I was just this dumb mute. When enemies came to grief us during mining, my character would just ignore them and keep mining. It was incredibly rude, and after a while I just stopped using the autominer since it wasn't saving me any time or effort, and was turning me into an antisocial jerk.
I got scammed once in Runescape, selling a rune shield or something and my trade partner put up the right amount of cash, but also a bunch of random items. This bunch of random items distracted me from the fact that he decreased the cash amount by a factor of 10 and I accepted the trade.
It's good to learn such life lessons in a virtual game rather than real life!
That was definitely not the only life lesson though, I also way overpaid for a halloween mask once when they were just dropping in 2002 due to the hype.
Bought a hammer for 80k because someone 5 minutes earlier had said they wanted to buy one for 100k and I thought I would make a 20k profit. Little did 14 year old me know that the buyer and seller were working together, or were the same person, and I had been tricked into buying a hammer worth 40k for 80k.
That has to be a scam as old as time. Glad I learned that lesson on runescape instead of in real life.
this is so sick. Runescape was such an amazing game. I loved how high stakes it was. If you died, you lost your shit permanently. When I was 12 my mom didn't want me to play and wouldn't allow me to use her credit card to buy a membership. I ended up mailing a ten dollar bill to Jagex HQ in the UK for two months of membership.
Love the story. My first exposure to programming was through automating RSC. All I was doing though was writing scripts for SCAR. I think maybe in… pascal?
I remember trying to learn some Java at the time, but could never make the leap between building simple CLI app’s and primitive string manipulation to integrating with the RS client and actually doing something ‘useful’. However, I was only 8, so I’ll cut myself some slack!
PSA - note the below quoted passages! If you played RuneScape between 2001 and 2012 and have any data archives or machines sitting around from that time, you might be able to help this project :)
> Contribute to the RuneScape Archive [1] with any lost RuneScape data prior to 2010 and receive any obtainable item of your choice as a thanks!
> Our goal is to recover missing versions of RuneScape from 2001 until 2012.
These versions were not saved by Jagex and are at risk of disappearing forever, with over 2/3 remaining unrecovered. If you ever played Runescape just once on a computer, the full game files were all downloaded.
I’m writing a book about RuneScape, Why We Play, and this project is the most exciting thing I’ve seen toward this end in awhile. I can’t believe I didn’t know about it!
haha I will 100% read this. I am endlessly fascinated by Runescape and the reasons it held such a grip on so many people. In my opinion, a far different appeal than a more mature game like World of Warcraft. There was something to endearing, innocent, and scary about Runescape, all at the same time.
The botting community kept meticulous archives of the client and cache during these times. I know there was very complete archives of the 2004-2011 era and I can't imagine those having disappeared completely. moparisthebest ran a script that collected it and he wasn't the only one.
Are they looking at the RuneScape Private server scene? I remember some OSRS servers that provided custom clients from those years. I don't know how accessible some of those are now, but it wouldn't surprise me if you could find those old clients that way.
There is a project by a RSPS community member to accumulate all caches (https://archive.openrs2.org/) by similarly asking people, pulling from other archives, etc. This is probably the best archive in the rsps scene / I'm sure they are aware of it, there are just caches nobody has.
> These didn't focus on keeping a historical archive of all versions of the game; only a handful of old game versions were found from these sources. Everything that was available from private servers has already been saved.
I don’t know of my parents kept my old computer in NZ. I wouldn’t be able to check till end of the year when I move back. But I may have several versions from around 2002-2005.
Seems a bit dishonest to ask people to contribute without explaining what the files are actually used for anywhere in the site, just "they could be used by Jagex". C'mon, I'm not against piracy, but I don't think it's cool trying to manipulate people like this.
I'm not sure what you're getting at here. Are you insinuating that people are being manipulated into unwittingly pirating software? The files alluded to are obfuscated Java byte code, so it's not piracy. It's useful for reverse engineering historical versions of the game for which no source or artifacts are known to exist. Perhaps you'd consider that unethical but I'd say it's ethically ambiguous at worst.
> Are you insinuating that people are being manipulated into unwittingly pirating software?
Maybe not, but it could be. They don't give any information so there's no way to know what they're doing, so you can assume good intention, or bad, or neither, whichever you prefer. To me personally it stood out how they put up a very nice landing page, with very verbose text, and never once mention any examples of what they're doing with it.
Piracy? No one wants to play random early versions of Runescape. It's purely about preservation.
An example use case here, an interactive world map with a slider that lets you see how it was updated through the years: https://mejrs.github.io/historical
I've done a quick search through that repo and its dependencies, and I see no mention of the project above. How do you that they're using the files from there?
> They contain all the various raw assets used in the game (e.g. maps, models, sounds) and the definitions of content like NPCs, Items, and scenery objects.
Not related to Open RSC, but the https://runescape.wiki/ family (linked to from the Open OSC home page) is one of my favorite MediaWiki sites of all time. Jagex helped the Weird Gloop team split them from Fandom in 2020 and they've built up one of the best-looking and -working independent MW installs.
Oh man every time I visit the runescape wiki I drool. It's just good website design. Clean, crisp, and content centric. Dark and light mode look perfect. Little delightful touches here and there that aren't over the top quirky. Proper content density. And most importantly, zero emoji litter. I'm in heaven.
Might I make a suggestion? I am completely new to Runescape (as in, this HN post is the first time I’m engaging with it), and I was hopping around your lovely wiki trying to find some kind of intro / “about the game” section with a bit of backstory.
Perhaps I missed it? (I’m on mobile)
Either way, looks like a project of love! Well done ^_^
There's [1] for an encyclopaedic overview of the game. For actual gameplay for new players, there's [2]. There's also a mobile game client if you wanted to give the game a go.
Cheating in RuneScape is what got me into programming. There was a program called SCAR (I believe) that let you write automation scripts in Pascal. That was a lot of fun.
Same here! It was also my first programming "job". I sold 4 copies of my script for 10$ each. My script would play one of the members-only minigames :D
Which minigame? I made a bot for mage training arena for all rooms, but the most interesting one was the enchanting chamber: there were dragonstones with a very high, but constant respawn rate that were highly contested. My script jumped through different servers and after finding and collecting one, it remembers the time when it spawns on that particular server. It was very satisfying to watch it run there just few seconds before they spawned, leaving other players no chance.
I've wondered as a kid how those scripts work. Do you know of a good explanation? Would they move your mouse based on the GUI, or directly send packets?
Also, while we're on hacker news, is it known how the party hat duplication bug happened? I like reading hacking white papers, but I assume nothing was published regarding that.
It wasn't a complicated bug. The trade interface accepted item quantities for stackable items: gold, bank notes, runes. A modified client allowed you to send a packet of offering into the trade a non-stackable item with zero quantity. Then at some point during the transfer, the quantity for non-stackable items gets ignored, because it should always be one, turning a zero into a one!
> Would they move your mouse based on the GUI, or directly send packets?
Depends on the client that was used. AutoRune was a popular client that sent direct packets. The game client gathered metrics on mouse movement though, so if you used direct packet injection you still had to fake the mouse movement to some extent so you could escape this rudimentary detection. Or your bot could just control the mouse in a somewhat realistic way and avoid needing to do extra work.
For reading game state, many bots in this time used color detection. So for example a flax picking bot might be coded to click on specific colors of cyan on the screen. Jagex would likewise respond with bot mitigation that was intended to fool the color detection system, for example by making flax have the same color whether it could actually be picked or not.
Later, clients would be developed that used decompilation and reflection of the Java game client to directly read game state in the form of Java objects. This would then be able to be queried and interacted with by scripts via an API that the client exposed. So for example, a script could be written that queried for all the flax (identified by their object id) around the player and instructed the client to pick it; the client would handle exactly how to move the mouse and the camera to achieve that.
An interesting bit of trivia: the first bot (that I'm aware of) to use deobfuscation of the game client was called Aryan. It was quite revolutionary for the cheating community because using the true game state worked so much better than the screen state. I don't know the specifics, but apparently the developers were threatened with legal action from Jagex. As part of their agreement with Jagex, the develoeprs released a new version of the client that sent a -1 up to the server for some field on the user that was always supposed to be positive. Jagex used this to mass-ban everyone who was using the bot.
Interesting to see this story here, I didn't know enough of that info was public to even end up here. (You have to be someone I know/know of, right?)
Basically true, though:
- Aryan wasn't the first clientmod, not even the first to deob - probably the first to go fairly 'mainstream' and end up being well known outside the circle of people using it, though (being free probably helped here)
- No legal action, tbh. Well, the same amount of legal action that all of the cheating scene got (some C&D's, domain takedown attempt type stuff at various times, but not the scary kind of legal action in the way other bots got)
- The banwave backdoor did happen, and basically as you say (iirc it was the actual UID but negative, rather than -1) but was more of a conscious decision, there wasn't an 'agreement' beforehand - it was proactively taken. Jagex were informed about it in order to detect it though, as far as I'm aware.
Doubtful. I was just a kid at the time who lurked on forums. Were you involved in the scene? If yes, do you mind if I ask what you ended up doing professionally? RS cheat developers were my role models growing up. I’ve often wondered what members of that community are up to now.
Yep, I used the nick 'Mopman' then, if you remember that name at all. Kind of appropriately for the name, I was mostly a janitor :D Admin @ Moparscape and the public Aryan channels, there's a few commits of mine in the bot but I definitely can't take credit for most of the bot itself, that was other peoples work. I did make few releases of it after the banwave incident you mention, though quickly passed that torch on (it was a lot of hassle, tbh).
Professionally nowadays I'm a pen tester/security consultant.
That's so cool. I'm star struck. I haven't thought about RuneScape in a very long time, but this thread has made me overcome with a bitter sweet sense of nostalgia. I knew so little about programming back then, so people who could manipulate this game I loved with their own code were like gods to me. The whole experience made a very strong impression on me. Thank you!
Worked on contributing a lot to that project, became my first (semi) open source contributions, and the scripts were my first forays into selling my work :)
> Also, while we're on hacker news, is it known how the party hat duplication bug happened?
I don't know for sure but I understand a lot of early bug abuse was due to a failure to perform server side validation. So hypothetically you might enter into a 2 part trade transaction flow where you offer items for trade in the 1st step and then commit that transaction in the 2nd step. Server side validation might be done in the 1st step to make sure you actually own the item you declared an intent to trade, but none is done in the 2nd step. So you could declare an intent to trade a worthless item you possess, but modify the transaction commit packet to give away an item you don't possess.
I was not part of the bug abuse community but I did find one bug in the game that involved multiple actions being done in a single server tick. As I understand it there have been a lot of bugs like this over the years. As a hypothetical example, it might be impossible to teleport while holding a certain item, but if you picked up the item on the same tick as you performed the teleport, the server might process the two actions in such a way that it allowed you to perform both.
Modern bots use reflection on the client itself, including faking the MouseEvent to the canvas/applet. Some bots use typical autohotkey style automation of just moving the mouse around and using color pickers/opencv to validate actions. Packet bots are rare but still do exist, AutoRune was one of them and it was used to duplicate items etc.
Programming scripts for SCAR in Pascal was actually the farthest I ever got in to programming - those scripts were the first things I ever wrote, and also the last. I wonder why.
Me too. I wrote one of the more popular script packs for AutoRune. Looking back AutoRune had a pretty cool event based language. I was a noobie to programming so I didn't really understand at the time.
Me too! I was active on the SRL (SCAR Resource Library) forums and got my first exposure to programming in middle school by tinkering with scripts I found there.
I wonder what this generations "gateway drug" to programming will be? Roblox?
It's impressive the amount of effort the Runescape community puts into these projects. It's amazing how many people have abandoned the game at one point in youth, yet come back and contribute as an adult. It makes me wonder what current games will still exist in 20+ years.
I've never played another game like runescape. It's pretty insane.
1. Tons of free content. I didn't get a membership for a long time. When I did it was something like 5 dollars a month, which I could scrape up as a kid.
2. Massive world. You could wander around for hours and find new stuff. Even just little things like some cool empty building, all of it was so fun to explore. Staying up late and exploring the wild with a friend was legitimately thrilling - and horrifying when you'd see a little yellow dot show up on the minimap.
3. Tons of quests and content, new content came out all the time.
Whoever pushed RS3 greatly misunderstood all of this. Graphics improvements were appreciated but not super necessary - otherwise, the game was basically ruined by having tons of random shit and an extremely cluttered UI. Really bad mobile game vibes.
I played against a year or two ago, just for a week or two, and it was still super fun. Unfortunately, it's a bit of a time sink, and I just can't spend time on it anymore. But it was a hell of a lot of fun.
RS3 is terrible, but they released "Old School RuneScape" (OSRS) which is a wonderful re-release of the old RS2 '07 version. They still update it regularly with new content!
I got back into it a year ago and it's nostalgic and fun - but yes, definitely a time-sink. I'll often have it in a spare window though doing some AFK skill such as fishing or woodcutting - helps keep me sane when I need to do some more mundane work tasks, lol.
Yeah didnt have a lot of money growing up but runescape ran fine/well IN BROWSER on our old terrible computer on rural wifi. Brother and I were also able to $5 a month together for members.
We probably would have played WoW if we could afford it and our computer could run it but for a lot of folks like us that just want realistic.
Right. We were running it on the lowest settings possible. Pretty blobby haha. But the great part about RS at the time was even at high graphic settings its wasnt that much better.
the wilderness was truly thrilling, PKing eventually became the main draw of the game to me. I will never, ever forget waking up one day to learn that Jagex had essentially removed the wilderness and PvP mechanics to combat Real World Trading. PVP was dead and I was legitimately depressed.
Honestly I come back every 2 years for about a month and then realize I'm spending hours cutting virtual trees and leave again. But for that month... man it's so much fun & nostalgic!
I always come back to runescape every couple years and the things i do in game speaks volumes to my mindset.
Back when i first started playing I never really did much of anything really... explored around, tried quests and never thought of looking up a guide, talked to alot of people standing in the bank, played alot of minigames etc. etc.
Years go by and I come back and i was hooked on efficiency. What wierd methods were there for getting insane xp per hour like sitting in lunar island, cannoning the trolls, while woodcutting the trees and high alching the logs.
skip to my early 20's when i first started programming for my day job and i would come home and write runescape bots for all sorts of stuff. One of my favorites that i wrote would have around 20 bots with gmauls sit in multi-wildy and hive mind spec poor souls who walked by.
I haven't touched RS in years, but funnily enough last weekend I found out the OS buddy and the runescape Wiki post grand exchange data. Was spending some time learning rust and decided to build a grand exchange analysis tool that looked across a number of factors (Volume, stability, beta) to determine the best items to flip.
Don't really want to post it on github cause it'd probably fuck with the economy but if anyones interested, hit me up at rhoades.lorenzo@gmail.com
You could put it as a SaaS API or behind a paywall as a web app - you genuinely could get paying users and wouldn’t have to break the economy while you do it!
I used to be really involved in RuneScape private server development in the early to mid 2010’s. It is to this day some of the most enjoyable programming I’ve done. The challenge presented by reverse engineering an obfuscated client and building a server framework off of that works almost like a puzzle game.
There were a lot of really talented developers in the space, but unfortunately the predatory donation systems and toxic culture between different servers/projects generally caused the good developers to move away from the community(or be just outright banned from community forums for no sane reason). It’s really nice to see a project in this space building a strong community with good open source culture.
I didn’t see on the website anywhere, but I’m curious if Jagex has given them any kind of permission for distributing the copyrighted assets/client? They may not care since it is focused on very old versions that Jagex themselves don’t even have or intend to profit from ever, but it would be cool to see them actually endorse a community project like this.
I've always wondered how private servers were developed. How was the netcode for private servers developed without any documentation? Were there source code leaks that helped?
My favorite RSPS was 2speced. It was probably one of the most famous 317 servers. I still remember the forum names of the developers, Tyler and Blurr. I sometimes wonder what they do now. The RSPS scene was awesome.
I grew up playing this game, which is what eventually led to me learning to program. Jagex shut the game down a while back, but a group of dedicated fans have recreated the server and kept it going.
Asheron’s call is in a similar situation. The community has implemented, from scratch, their own servers and a huge amount of the game post Throne of Destiny.
Interestingly, the game was content complete for Throne of Destiny on the server side because apparently someone found a thumb drive of the server files at a conference long ago. I’ve been secretly hoping that someone from Turbine would leak the entire game source as a final fuck you to WB backpedaling on making the servers public.
I wrote my first Java program as a means of automating in game tasks.
At the time, I didn’t know about background processes or VMs. I used the Mouse cursor api in the JCL, so my computer was preoccupied. There were 5 second intervals between actions where I can quickly change the song on YouTube.
Runescape was incredible for the time, I played even before there was a paid membership, starting around 2000. There were so many great features like cooking being useful for people heading to mine rare ores in the wilderness so you'd have cooks naturally lined up on the border trying to sell stuff.
The wilderness PvP worked with a level gap system, so when we went out as a group it was good to bring some mid-level characters to be able to suddenly attack lower-level players in the early wilderness who wouldn't expect it. That really felt like D&D - having someone prepare meals beforehand, etc.
It's a shame most games have given up on that systemic, open-world player driven style of game. Back then with Ultima VII, Baldur's Gate, Runescape, Daggerfall, Ultima Underworld, etc. it really felt like in 20 years we'd be playing games like Daggerfall persistently with thousands of players online.
And instead it's just devolved into Skinner boxes and microtransactions.
While it's not as open as Runescape, some games still have this feeling of a persistent world; a friend of mine mentioned building an automated shop in a Minecraft server to sell things to other players. Games like Rust and Valheim allows you to shape your world, although it's not "massively" unfortunately. Before Minecraft, there was a game called Wurm Online (the creator of Minecraft was involved in that) where players could band together and (tediously) shape the world around them.
The other side is modern-day MMOs; I mainly play FFXIV and have done so for a long time now, and while it doesn't have the freedoms as Runescape had, it's still a great game with a pretty good community and ad-hoc community activities.
I still have a few friends who play 2007scape and it looks like the thing to do these days is Ironman mode, which is just "no trading with other players". It's apparently fun in a North Korean self reliance kind of a way. No microtransactions at all.
I've been tempted to join them but I currently lack the time to get addicted to it again.
I honestly don't know whether I love this game or just loved being a teenager with nothing better to do but play RuneScape with my brother all weekend. Probably both. I think about my adventures in this game pretty often.
One might say that I am very into personal finance and money management. People tell me that I am good with money all the time.
I often wonder, what in my life made me even remotely care about money? I realized some time ago, that is was literally Runescape. It was my first introduction to the world of finance and economics.
Seriously, it might be one of the biggest positive impacts I can think of in my youth.
I just got a massive hit of dopamine from the nostalgia of seeing the classic homepage. So many hours of my middle school life spent playing Runescape...
FYI it’s the glory days of RuneScape (old school) private servers. The big ones have teams of developers and they’re even better than Jagex in some ways!
It's funny to read this now given I was a mod on RuneLocus during what I would consider RSPS's heyday (2006-2012ish range). It felt like the scene died off a bit especially when Jagex finally brought back OSRS in 2013.
That said it doesn't surprise me that certain servers have continued to grow and thrive over the years.
Id be very curious to see player counts from then compared to know, but at least in the quality of servers they feel comparable and even better than osrs in some aspects!
Any suggestions? I've been looking for any to play on the side while I grind the main game but all the popular ones seem sketchy in terms of monetizations and stuff.
Anything in the top of the top lists is good, ikov is probably best for pvm comparable to osrs with a little bit of uniqueness, while runewild is the best for pvp and has absolutely incredible ui/ux. Unfortunately all servers have some aspect of random boxes/currency for getting items and gambling, but the major ones make donating easily avoidable. They do all let you but the donor ranks with in game gp so donating definitely isn’t required.
I’m happy to hear that. I used to develop for a RSC server. I remember doing completely for free and one day I got paid for it and I will never ever forget it. Thanks Brwn. Long live rsckbd!
I never played the game as a kid, but thanks to the amazing content creator scene (Swampletics) and memes over at r/2007scape I gave OldSchool RuneScape a go in my 30s and went directly for an Ironman (where you cannot use the market, but have to do everything yourself).
It's such a charming game, I'm too old to spend hours playing, but I'm doing one hour here and there and I'll probably max some time in my 70s. Looking forward to doing some serious bossing when I'm retired :)
But like many people are mentioning, private servers have long been an important part of RS's legacy (and WOW's, and many other MMOs). So godspeed to these folks!
The Uranium server looks really appealing! Already 15/15/15 att/def/str in two hours killing small spiders (modified the chicken script as ALL chicken spawns are highly occupied by other bots). I wish more games/servers would allow this kind of thing :)
fwiw, this appears to be a fork of a now missing repo, and I cannot speak to the cleanliness of the files but it's a decent sized dump of old bots and sources including AutoRune.
This brings me back to the days of Moparscape and creating my own private server. I remember joining the forums and sharing my code for colour coding the menus. Great times!
From there, it could "read" enough to find the right places to click to buy things. The bot basically world hopped constantly, 24 hours a day, and bought cheap items until the general store was depleted. I'd then sell them in bulk for several times more. I never got hit with random events (in-game captchas), because I never stayed logged in for more than a minute or so. I was also not hit by any of the big banning waves, since I didn't rely on reflection in Java or use any of the popular "frameworks" for macroing.
Joke's on me though, because that game consumed several years of my life and I spent a lot of money buying several years worth of "members".
Later on there was also a gambling culture of "dicing" where you'd join an IRC channel, type a command to a bot like '/roll', and get paid in-game if the 'dice roll' came out in a certain way. I took an educated guess that the channel operators were running bots with mIRC, and reverse engineered the random number generator in the mIRC client (which was fun, because it was written in C++). Turns out it was a linear congruential generator which was in principle brute forceable given a few consecutive rolls. I wrote some OpenCL code for my GPU in the very early days when "GPGPU" was a new idea, but was never able to get it fully working because mIRC used 64-bit floating point arithmetic and the least significant digits were relevant to the outcome of the RNG, and my GPU was only 32 bit.
Link to my SE question at the time: https://crypto.stackexchange.com/questions/2086/predicting-v...