Maper

You're wrong on one front and correct on another. An external hack is not undetectable by any means. But as for detecting clicks per second - sure, they could do something in the client which detects the number of clicks per second. They currently don't, but it's possible. What's more important to consider (and is probably what you meant anyway) is how many actions per second you make, as each action needs to be communicated back to the server. In this way, the server can judge your APM (Actions Per Minute). Let's say an average player clicks between 1-3 times per second, which I think is pretty reasonable as an average. That means their APM will vary between 60-180, on average. Now a bot comes along that clicks 10 times per second. There are two problems with this - one is that the bot's APM will be 600, which suffice to say will stick out like a sore thumb on the server. On top of that, the bot's APM will consistently be 600 with little to no variance. That is highly unlikely of a human player.

In terms of getting detected, it's pretty obvious that the rate of instance recreation, the speed and consistency of input, and the amount of time played are all taken into account. I know for certain that there is nothing client-side going on, so these are the kinds of heuristics the server could use to detect a bot. If you want to be safe, your bot should behave like a person. Slow reaction times, inconsistent input (not X inputs every second), and regular changing of zones or characters as well as logging off for periods of time. It may make your farming less efficient, but it is easier to prevent detection that way.

That also makes sense now that I think of it.

Oh, dang, now that you mention that it makes perfect sense haha. Thanks for clearing that up! I thought it was like a security thing, like people thought it would be less detectable or something like that. I dunno.

I'm not sure that I understand the whole VM thing in the first place. What's the point of botting in a VM?

I guess that's a reasonable point. My thoughts were that it was a heavily farmed are by normal players, too, so that might make it less conspicuous. But I guess it could go either way, really.

I'm a fan of docks.

"Undetectable." Anyway, I may be able to hook you up, I'll let you know in a day or two.

I've lurked around some of the other websites with Path of Exile hacks, and I have seen the name of this bot tossed around, so hello. Looks like some cool work is being done here. I'm happy to contribute however I can, whether it be code or theory or moral support.

That is not a sufficient humanization algorithm. The variances in network latency alone could be expected to be +/- 50ms, so it is still completely likely that the server could measure that 95-100% of your actions are taken at approximately the same interval, whereas if you were a real player this would be statistically improbable.

It is possible that the bot-checking mechanics only apply to new accounts. Perhaps once an account is considered human for a certain period of time (say x number of levels, or play time) the server no longer checks that account. That wouldn't be an unreasonable assumption, and would explain your anomaly. I also feel it's pretty unlikely that they check interaction with other players. Many people play this game completely as a single player experience, so that wouldn't exactly be a fair criteria for detecting a bot (though maybe it would help strengthen an indication when paired with other criteria.)