Nullable

As some may or may not know, in the background of everything else going on, I've been rewriting Tribot from scratch. I know, I know, a lot of you have heard that one before. "Good one, Nullable, now fix script download issues". I get it. I even still use the project codename created in 2017 for the first of many supposed "rewrites". But this is real and the best part is that I am still prioritizing development for what you use right now. So at the very least, no harm done. That being said, I am making a lot of progress and I figured some would like to get some details. Injection? Reflection? What are these things? The current version of Tribot is a Reflection bot, for reference. What is Reflection in terms of botting? Reflection refers to the programming mechanism of the same name. It's where, during runtime of the program, code can examine the contents of itself. Since the game runs in the same process, we can use this mechanism to "examine" the game memory and read data. This is allows us to know where the objects and npcs are and stuff like that. The upside of this is that it doesn't modify game bytecode. The downside is that it can be slow. Tribot uses a lot of intelligent caching, though, making it one of the most efficient reflection bots created for the game. Nowadays, we're one of the only reflection bots out there. And Injection? "Injection" refers to the technique of modifying the game bytecode as it loads it. It "injects" friendly names and interfaces into the game's classes so that it can simply call them directly and receive game data. The upside is that it's fast and direct. The downside is that it modifies bytecode. The problem with modifying bytecode is that it's legally dubious and has the potential to be reflected itself. While there is no indication of any sort of reflection-based anti-bot, and patching it would be possible for injection clients, it's always a possibility. So what is Tribot X? Tribot X won't be using either. It will use Compile-Time Wrappers. Not a very catchy name, admittedly. While developing the basis of the new bot, I realized we could have the best of both worlds for how we interact with the game. This technique is actually really simple. The game is just a jar like any other, and can be programmed against. So we do that! public int getSomeValue() { return client.obfuscated_name * multiplier; } And now when we compile and run this, we get the value. Of course, this has lots of problems. I would need a ton of these to get all the data and I would need to change them every time the game updates. Also, there are various other roadblocks that I won't go into for getting this to actually run. We solve the main problem by generating code and compiling it against new game updates. These generated classes act as wrappers and give us the same functionality as injection without needing to inject anything. As such, they are just as fast and require no game modification. We've already written a complete generator for doing this automatically. More details! Since this is my first post on Tribot X, I'll give some one-liners over some of the other random technical details I may not write full posts about. Tribot X has a lot more flexibility in terms of spoofing, and includes the spoofing of runtime information that could be used in the future for bot detection (even though it isn't currently). Tribot's mouse has been completely swapped out and is astronomically more efficient and less prone to error. The current tribot uses an event queue mechanism while the new one uses a single thread with locking to enforce thread safety. By doing so, we reduce the number of threads and overhead. Every method for manipulating the canvas has been optimized. Faster code, less CPU, less RAM. It supports tabs! But really properly this time with perfect isolation and spoofing. The GUI of Tribot X uses Jetpack Compose. The entire bot is written in Kotlin. For really CPU intensive tasks or to share code with our launcher, we have a way to interop Kotlin and Rust code in the client. The architecture of the bot has been entirely changed. Plugins separate from scripts are now a possibility.

Check out the beta for the launcher here:

Script queues will eventually be entirely replaced by a full script automation system.

Hello everyone, I've been talking about this project a lot in the past few months and I'm happy to announce we can start distributing it as a working beta. This new launcher is a big upgrade to our current one. We're still missing a couple features for full parity (sorry, no bulk launcher just yet...), but we have the core features ready to try out. Note: You can have this installed alongside the current launcher. We will keep it functioning for the foreseeable future. Download Windows: Tribot Installer ZIP Open the .zip and run the included exe installer. It will walk you through the installation. You may need to click "More Info" and "Run Anyway" if given the prompt. If windows defender gives you trouble, you can whitelist the installer and then whitelist C:/users/[yourusername]/appdata/Local/Tribot as well. MacOS: Tribot Installer DEB Running the installer will be blocked by newer versions of MacOS. Follow this guide to run: https://www.wikihow.com/Install-Software-from-Unsigned-Developers-on-a-Mac It will be a one-time thing. Linux: Tribot Install AppImage chmod +x the file and then execute it. This app uses AppImage - it will often work first try but if not, the command line will tell you what you need to do to get it working, such as installing a dependency. Features New Account Manager This launcher has it's own account manager that you can add multiple jagex accounts to and run them without needing to login each time. When running clients with this launcher, the client will inherit the launcher's account manager instead of using the old one. There is currently no way to import/export. The new account manager will also keep track of data such as combat level, stats, items, quests, and more to make it easier for you to keep track of which account is which. This will also serve as a basis for bot farm automation features in the future. New Proxy Manager Similar to the old proxy manager, but a little more user friendly. Allows you to associate proxies with Jagex Accounts so that when you launch one, it automatically applies the proxy. Client Management This launcher keeps track of all running clients and can give you details about them. The only functionality it offers right now is the ability to minimize and maximize clients and display what script/account they're running. A lot more to come! Always-Running When you close the window, Tribot stays running in the background (like Discord or Steam). It's highly optimized in this state and uses very little CPU and RAM. By doing this, we'll be able to add features such as bot farm management and better CLI features. Tribot Login Management The launcher keeps track of your Tribot auth, meaning you'll never be logged out unless you do it explicitly. Only clients launched via the new launcher inherit its auth, though. Better Auto Updating and Observability By utilizing standard installation mechanisms, this app auto-updates itself with a lot more stability than the previous launcher. While not quite as smooth as something like discord or chrome, it will no longer leave some users in invalid states and gives us a lot more flexibility on what kinds of updates we can push. We also improved the status of launching clients. You'll be able to see errors instead of the app just crashing. And you'll be able to see download progress. More To Come Bulk Launching Account import/export Proxy import/export Ability to set a proxy when initially logging into a jagex account New CLI Home screen with quick actions, announcements, blog links, newly released scripts, and more Advanced settings Built-in Instance Manager with meaningful names and data

I'm guessing this is just a troll post. I'll allow it for now. If anyone is seriously wondering, the first image is from the runescape website and highlights rating data from PEGI (Pan-European Game Information) for rating video games. It refers to Runescape's use of microtransactions. All video games with any form of in game purchases include these as it's required by law. The second image is from Runelite's landing page on their website, highlighting that they integrate with Discord's status, which you can disable in discord itself if you want. It also has nothing to do with bot tracking as it literally just sends your discord app two strings of data that doesn't even get persisted in Discord, let alone sent to Jagex. Tribot doesn't run through runelite so their discord integration doesn't affect you anyway. Neither of these images are related to bots in any way.

Good to hear. I'm making it so that the launcher will also keep track of character stats, quest completion, bank contents, location, etc so that organization is a lot easier. This will also eventually lead into advanced automation features.

In addition to the roadmap and official announcements, I thought I'd add another blog category for talking about incremental progress that isn't as visible. For those who saw the 2024 update in the announcements, those items listed are exactly what I'm working on. Stability is at the forefront of efforts currently and much of that is going to be enabled by the new launcher that I'm sure you've heard me talk about before. Stability means different things for different people. For some people, the most important stability issue is mouse movement inconsistencies. For others, it's script instancing. For others, downloads. And for others, it's jagex account support. For some it's even that the current launcher downloads don't behave properly with their machine/ISP. Our current efforts are on fixing all of these holistically. We're always looking quick wins but we also need to pay off years of technical debt. New Tribot Launcher I've talked about this a lot in the past. I'm proud to say we're currently allowing some MacOS users the ability to beta test a very light version of it to tackle the jagex account issues. But also, I'm working on a solution that can benefit everyone. The overall idea is to start moving features from the client itself into a constantly running launcher. By having the account manager here, it will make it much easier to... well... manage accounts. This is especially important for Jagex Accounts. The idea behind this is to make the account manager easy to use whether you have 1 account or 5000 accounts. What's done so far: Vastly improved persistent (local) storage for jagex accounts, regular accounts, characters, proxies, and client settings Bidirectional communication between the new launcher and Tribot clients Launcher that gets minimized to the taskbar properly on all systems, and only takes <10mb of RAM while running in the background. Jagex account login support with the ability to store the session such that re-login is not required. What's left: Bulk launch support Data import Auto-updates Polishing Once those items are done, we can have a full 1.0 release to replace old launcher. From there, we can expand into real bot farm management and automation features. About script downloading issues Over the past couple months, a lot of users have had intermittent issues with downloading scripts and client updates. It seems like lately there's been a lot of service degradation with our CDN hosting, which is unfortunate. I plan on creating a custom download server that handle caching and secure downloads better. I also plan on hosting launcher dependencies locally or through github as the regular servers for those also don't always perform adequately. A new tribot client? I actually made a ton of progress on a new client a couple months ago. Full hook support, a fast and stable mouse, keyboard input, much lower resource usage, etc. I'm putting this work on the backburner to focus on the launcher, but am hoping to pick it up in the next couple months. It's an enormous amount of work to make a new client that supports so many scripts that use APIs made over a decade ago, but we're finally at a point where the path forward is clear enough to realistically achieve it. We have no shortage of ideas on how to make the best OSRS bot possible. But technical debt makes it difficult to make these ideas come to life. We brought forward a ton of new features last year by paying off our server side tech debt, and we plan on doing that this year with the client. Once the new launcher is further along, I'll be writing a dev blog with all the technical details.

@Dentist

https://tribot.org/download Download the client and log in. Your script is added to your account.

@Jarty We updated our rules: You are allowed to post your discord link assuming your thread complies with the rules.

@Oogle We updated our rules: You can add your discord link back assuming it complies. Make sure to include your Discord ID here.

@HelloThere It's fixed now (except on MacOS) You can find the button here:

@Karmas Here @cuzzy Jagex account support has been moved to the Tribot Launcher. Look for the button there and try it.

Update: Jagex has now started enforcing more security on their login flow. I'll be working on a fix but there is no ETA.

Hello, you might have been experiencing bugs due to the recent game update. We've made fixes to the client. Can you try again?

Congrats on the release! Glad to see some modern versions of AIOs coming out.

Most normal players don't use a VPN. Well over 99% of all users for any web service do not use VPNs. VPNs are all universally "detected", meaning that when you connect to a website/game/etc the server can look up your IP and immediately know its a VPN/Proxy. This is considered a reg flag a lot of the time. You'll see more captchas when web browsing, you might get payments declined, etc. Your "trust factor" with everything immediately goes down. This is the same for most proxies in general, to be honest. I've used a lot of anti-fraud technology and they all factor in proxy IP. This alone makes it more likely to be banned for botting. But also, botters have exhausted VPN IPs for every shady thing you can imagine. If you're using a VPN, you're on an IP address that has probably had dozens of RS account bans, WoW bans, shoe buying bans, credit card fraud bots, nigerian scammers, forum bot activity, youtube viewbot activity, and much more. When you access anything with a VPN, it's assumed that there is a very high chance you're not legit because your IP probably already has a bad history with that service.

@Jarty No discord links allowed on the forums

Not perfectly. Their data isn't good enough to fully determine anything like that. Their "3rd party client" detection is a lot less reliable than people think. Tribot automatically ensures your account has a particular random.dat UUID for each account. To Jagex it will basically be like you're using a different machine when you bot, which makes any differences in client parameters seem reasonable. Of course, client detection is not Jagex's primary factor for detection. They mostly use player behavior. I highly recommend reading the post about what we know about bans in the Premium section of this forum to learn more. As an absolute rule, botting always carries some risk.

Hello, that message appears the first time you load the game and there is nothing sent to jagex regarding that message or what you click there. Looking Glass was broken by the very recent jagex account update. There is no ETA when it will be available again. It is generally not considered any safer nowadays, so it's not a huge priority. If you would like a refund on any recent purchases, you can create a support ticket in the support tickets section.

While a refreshing login is the most common, I've seen authentication logs for a few systems, including Tribot. There are always people with many logins with all sorts of explanations. Jagex can certainly see the patterns on their end if they wanted to, but it's highly unlikely they'll use it as botting evidence because that's a stretch and would likely cause more problems than anything. Also, their authentication logs are a whole separate system. It may not even be apparent in the cases they manually investigate an account anyway and it's unlikely they have any automation in this regard. All that being said, I do plan on adding refreshing logins at some point. It was actually my original plan but we had to rush things a bit.

Nope. Our solution does not require the Jagex Launcher at all and works on Linux.

TL;DR - Tribot now supports Jagex Accounts What is a Jagex Account? Over the past several months, Jagex has been rolling out their new account system for logging into the game. Previously, every OSRS character had a separate login you entered after loading the game. Now with Jagex Accounts, you can have one account with multiple characters that you log into before launching the game. When you launch the game, the previous "login" process is now just a button that enters the game world. This new system forces two factor authentication. This feature is now required on all new OSRS characters. As it stands on January 2024, regular runescape accounts made before this change can still be logged in the previous way. This new account system conforms to most modern standards compared to regular runescape accounts and is now very similar to login systems you use in other games and websites. In fact, it's similar to how you login to Tribot as we use similar modern standards. How does this affect Tribot? As of today, Tribot supports Jagex Account login while still preserving support for regular runescape accounts. Since regular accounts can still use the old tools and there are probably tons of those stockpiled, we will not be modifying the account manager or removing the option to start a client without a jagex account. Instead, we added the feature separately. You can launch a client with a Jagex Account here: This supports both email and authenticator two-factor-authentication. What about the Account Manager? The Account Manager is largely coded around the ability to log in while in-game. Since Jagex accounts can't do that, we are going to leave it completely unmodified. Meaning, you will not be using it at all for Jagex Accounts and will only want to use it if you still have regular Runescape accounts. For now, you can use the Bulk Launcher feature of our tribot launcher which can manage and launch Jagex account clients fully automatically. This is especially good for larger farms. Do we have to login manually every time? No, we have two solutions for that. The tribot command line arguments: --jagex-email --jagex-password --jagex-totp --jagex-display-name And the Bulk Launcher, which supports these fields so that you can manage and launch jagex account farms automatically with a GUI. Jagex email and password are self-explanatory, but the totp argument is for 2fa. The value of this argument should be the authenticator secret that can be accessed when setting up 2fa on the account. It will ask you to scan a QR code. Under that there will be a way to reveal the plain secret. Do that, save the secret, and then scan the QR code or do what you need to generate a code to complete the process. It should go without saying that this data is extremely sensitive. If someone gets these 3 values, they will own your jagex account. Please keep them very secure. Our implementation does not store this information nor does it send any of it to our servers.

A Recap of 2023 The past year has been an interesting one, both for Tribot and botting in general. For Tribot, we kicked off the year with me becoming sole owner. By Spring, we completed our full web overhaul with an entirely new backend, new website, new store, and even new forum implementation. From there, we stabilized a lot of older client features, better secured our ability to update with the game, and refactored a lot of old code. In fact, much of the work in the middle of the year to the end was not nearly as visible as what we did with the web overhaul. I know that can feel frustrating as a customer, so without going into our future plans just yet, please know that this won't be the case for long. We finally expanded our development team a few months ago. While we are not at the capacity we were a few years ago, our efforts are a lot more focused and streamlined. Botting in general has been great. We saw a massive rise in high level PvM botting and account training for that purpose. While we don't have complete stats for the year, I can say for certain that in the past 6 months, you all have botted well over 50 million hours on Tribot. Users of the platform have collectively made trillions of gold this past year alone. Despite the large focus on bossing scripts, they aren't the only players in town. While our revenant, vorkath, zulrah, and phosani nightmare scripts are all near the top of the charts, we also see plenty of success in scripts like nMercher, nGreenDragons, nMagic, ArkSlayer Pro, Elon Lava Dragons, and more. Private scripts also show up in the middle of charts, demonstrating some large farms for the few private requests that scripters accept. While I obviously can't go into much detail on these, we can see that private scripts are still relevant for large farmers. Overall, Tribot is alive and thriving. We have every reason to continue developing and improving things and fully intend on doing so. Thank you all for your participation, support, and interest in what we do and thank you for this great year. Our business is not possible without you. Our Vision for 2024 We want this year to be more flashy than the previous year. A new backend, serious cost savings, and web reliability were all fantastic efforts we completed last year, but they were boring to customers. And while tasks like that will always be around, we hope that our previous work in reducing overhead can help us focus on more products, more features, and performance improvements that every one of you can tangibly benefit from. I'll break this down in to a few high level categories. Scripter Excellence One of Tribot's current strengths is the scripting team. All of the scripters we have are amazing at what they do and are a large part of where we are today. We have always had relatively strict standards when it comes to who we approve, but that can only carry us so far to achieving high quality. This year I want to get more involved in helping the scripting team improve as well as holding everyone accountable. I've started that process by finally posting an official path to scripter. Hopefully this helps up and coming scripters get involved in our process. Our regular scripters have had very little changes and oversight in the past few years. This year I'll be doing a regular scripter audit. This means I'll be evaluating all of our normal scripters again similarly to their first application. I'll look at what community scripts they have published, their condition, their activity, etc. Scripters will need to pass this audit or complete follow ups on their assessment in order to remain scripters. Premium scripters will undergo something similar. Instead of an audit, I will be documenting common issues customers have with scripts, refund requests, and other data I can use to identify premium scripts that may not be up to our standards (don't worry, I'm not blind and know of a couple already). Scripts of this nature will be audited and possibly placed under a quarantine status, where they will remain available for purchase with a large, visible warning and more generous refund policy. They may also possibly be removed from the store if they do not pass the audit and do not have many sales. Outside of scripter processes, I want to hopefully introduce community script bounties, where scripters can get paid to write community scripts or potentially even premium scripts to help fill in some of the gaps we have. I am not fully certain on this idea yet, though. More details will come. If you are a regular user who can write scripts and are interested in writing small-ish community scripts for tribot store credit, please let me know. From the client side, I hope to dedicate time to really solving some of the roadblocks scripters have to ensuring quality. After all, a script is only as good as the client powering it. I'll talk more about that in a separate category. I want to achieve enough quality for you to be as fearless as possible in your purchasing decisions at Tribot, or at the very least well informed. A New Launcher, Jagex Account Support, and (Potentially) New Client You may have heard me talk about it on Discord, maybe some rumours, or maybe you've been around so long that you're deaf to this kind of thing at this point (remember TRibot X?). Well, last year I came up with a plan and design to create a new Tribot client incrementally. This starts with the launcher. The current launcher and all previous versions have all been meant to, well, launch clients. While that makes sense, it could be so much more. Our vision is a centralized process on your machine that acts as the shared brain among all clients running on your system. We all know how frustrating it is that every individual client process has its own tribot login, its own settings, its own account manager. Our plan is to move everything to a central UI so that you can manage everything centrally. What this means is: We no longer have to code fragile distributed process synchronization, which means fewer bugs for you. You no longer have to walk on eggshells when modifying anything while having multiple clients open. You no longer have to load a game client to change settings. We have a foundation for new features like bot managers, a better CLI, more stable tribot account credentials, and more. And most importantly.... Jagex Account Support With a centralized launcher, we can manage Jagex Account Credentials. Similar to the official game launcher, we can keep a persistent logged in state for (multiple) Jagex Accounts and run clients with them. All you need to do is log in manually one time (similar to the Jagex Launcher), and our launcher will automatically log you in thereafter. The main difference will be that our launcher can manage multiple accounts simultaneously so that you can choose when launching a client. What about the new client? This design is a bridge. It will support the current client and a new client as we develop it. While I cannot promise a new client will exist any time in the foreseeable future, a lot of work has already been put into it. A few months ago I dove deep into the Tribot X code that was developed several years ago and can proudly say we have feasible way forward to create a brand new client with heavily reduced resource usage, significant automation capabilities, and support for all current scripts with a way for it to integrate seamlessly into this new launcher. Keep an eye on out in our blogs section for development posts I'll likely make on it in the future. Attention to Longstanding Issues I understand that a lot of users can point out at least one issue Tribot has had for a long time that annoys them. For example, bossing scripts and wilderness scripts in particular that require fast, precise actions have really encountered pain with some of our old mouse code that was written to be humanlike. We already have an ongoing effort for experimenting swapping out the mouse code entirely and intend to progress on it this year to the point where can definitively release it or push it to the new client effort. More immediately, I have already uncovered several performance improvements, particularly with memory usage. Within the next couple months you can expect to see some upgrades to our runtime. While I'm sure many of you think this will be fixed by a new client, I want to be clear in saying that we are working on these independently of a new client. Pushing everything to a giant, longterm project that may or may not be ever completed is not the right thing to do if we can come up with an alternative. These bug fixes are on our radar for the short and medium term. Additionally, I'll be personally going through all of our public and private bug reports to acknowledge them, prioritize them, investigate them, and hopefully solve them or at the very least move them forward. This is not the year bug reports will simply take up space to be dealt with "later". And fitting my vision of flashy changes, I will be focusing my attention on the ones that will most notably impact day-to-day usage of the client. Wrapping Up I hope this post provides some transparency into our plans and passion for Tribot. Our work is never done. Keep in mind this is far from the only thing we are working on this year and that this is not a roadmap, but rather a vision to what we want to focus on. As many know, little things are always coming up that need taken care of and sometimes our priorities are swayed by our availability and capacity to handle them. I will be writing more blog posts in the coming weeks with a more detailed roadmap and potentially preview of the new launcher/client. If not, at least a development blog showing some progress.

What are Tribot Scripters? Tribot scripters are members of the community who have demonstrated proficiency in writing scripts from all areas. They know the API, know how to create GUIs, know how to handle script arguments, and have the ability to create overall quality scripts and content. Regular scripters are still just community members that have provided at least one script for the community to use freely and have passed the application to become one. Premium Scripters are scripters who have successfully passed the application to get a script approved for sale. These members are official Tribot staff and contractors who have demonstrated not only technical capability, but also the ability to talk with customers, be friendly, and be helpful. They are capable of handling the responsibility of an official staff position and contract with our company. Benefits of becoming a Scripter Regular scripter rank provides free Tribot Premium Membership benefits (unlimited bots, use of community scripts, etc). They have access to upload scripts to our repository for community or even private usage. They also get access to a scripter+ only discord channel and forum where we collaborate on tribot as a whole and make decisions. Some regular scripters also get access to make some open source tribot contributions/fixes for their scripts to benefit from. Premium scripter rank provides all of that and the ability to sell their scripts on Tribot's marketplace and earn profits from them. Additionally, premium scripters get a larger say in how we operate and conduct business. They get access to all semi-open-source tribot code and can apply directly to be a Tribot client/web developer. How to become a Scripter In order to become a scripter, you must write at least one script that you plan on releasing publicly to the community script repository on Tribot. For writing scripts, you can find tutorials in this section. At least one of these scripts must contain the following: A GUI (Swing, JavaFX, or Jetpack Compose) Script arg handling Complex enough to be somewhat configurable (a simple one-location iron miner is not enough, but an AIO miner that supports 10 locations could be) From there, you can apply by creating a support ticket in this section with the following: An upload of your script source code (github link, zip file, etc) Why you want to become a scripter Any additional content you've created for Tribot (guides, open source scripts, helpful advice you've given) We will take into consideration your script, code, and general community conduct. Scripter applications may get delayed based on availability and/or the need for more scripters. For premium scripter, you can contact me directly after you have become a scripter and we can discuss what you can do to become premium. This is usually just writing a premium script, but the content matters depending on our need and the market. It also depends on your eligibility to be a contractor.