The flaw you mentioned is the very thing I referring to. The team I worked on had a member that was hired before me⌠Who used to be an ex-botter, who âHexedâ (modified) the client, and was offered a job due to his skills. We werenât the first to come up with hiring an offender to get rid of them. Jagex, and Runescape actually did this a long time ago, hiring and paying the guy who had made a botting/RMT website to help the team get rid of bots. I had suggested using Captcha for our server, because another game (rather, a private server of Aura Kingdom) had used that function, and it worked wonders on bots⌠For a while. It was an image, containing a 6 digit number, that would teleport people back to town if they failed 3 times, giving them 60 seconds to complete it. If they failed, they would receive a debuff that basically disabled skill use, if I remember correctly. If they passed, they got a small 10% EXP boost for a short period of time (10-30 minutes, canât remember the exact number), and would have a longer delay between the next Captcha (which appeared during any item use, skill use, or item gathering).
He basically told me that modifying the client was all it would take to bypass it, just like with most other things. You know, the only thing we came up with (we never got to implement it, because it was out of our scope due to our team size and time constraints) that we thought might actually have a chance of working was the idea of designing our own HackShield-like software⌠Designed to meet our own needs, to cater specifically to our game. That way, we wouldnât have to worry about some team of botters countering any fix or modification we made to the software, because we could instantly counter it if they countered, unlike with the actual HackShield (and similar programs) in which you would have to wait for the team to make a fix. Even then⌠With everything he had said was possible just by modifying the client⌠It made me doubt the possibility of ever having a bot-free game without somehow finding a way to completely remove any reason botters would have for botting.
Other than that, as far as Captchas go, outside of that experience⌠Iâve been told that in any instance where the code is provided as an image, and it requires you to type the answer, that answer is stored somewhere within the client the moment it is sent to the client to test the user, which picks a random one, usually within a limited number (not truly random since it is a specific number, usually 1000 or 10,000 sets of number combos) of random number sets of 6 digit/letter combinations, but theyâre supposedly present client-side whenever itâs on your screen⌠Which means they can be deciphered by Captcha Breaker, and similar programs. Same goes for image-based ones, since there are image recognition programs out there that can be modified to do the same thing.
Iâve been racking my brain on how to actually solve the TOS bot problem, but what I keep coming up with are countermeasures to the solutions Iâve come up with⌠Captcha was the first one I actually came up with before realizing it just wonât work with how advanced technology is, and how easy it can be for these guys to solve them. It doesnât help that Iâm used to working with a population of 10,000 or less, and I know that this server is potentially going to have far more than that upon the F2P release⌠Which means far more bots. If theyâre willing to pay for entry now, then who knows how many will come once entry is free?