I've done a bit of thinking about this in the last six months... here's my rough treatise on the subject of game automation in AHK. I very openly invite anyone with additional or conflicting information to post your thoughts.
NOT GETTING BANNED
The first assumption that must be made is that the game that you are playing cannot detect the fact that you are using Send or ControlSend. You should first google the game that you are automating and see if others have been banned.
In all cases if possible you should use a 'trial' account for this. You must also be aware that many companies will investigate or even automatically ban other accounts by IP address - use an anonymous proxy for all of your testing.
Going further down this road (and you MUST go all the way down this road if you want to be safe about it) with that is that you should actually use a clean game install folder - preferably to a different drive letter entirely, than the one you normally use for playing the game. The reason for this is that, as I have 'friend' confirmation on it, is that at least two popular games will store client/account logon data locally and check for this as well.
A breakdown of true security for your main account: You should use a different machine under a different login name through an anonymous proxy to access the game for any automation testing before putting your beloved purples at risk.
NOT GETTING DETECTED
From my experience the most frequently used method for detection, especially by the web-based MMO's, is repetition. If you continually click in the same location repeatedly after taking an action in the game, i.e. you are (as above) selling objects from a place in your bag, clicking in the same bag location (same pixel location on that bag item) over and over to move it into the sell field or select it is going to be detected. The same goes for internal (game side) macro commands that are spammed into the console much faster than you could ordinarily do so. (runequest, I think)
You also don't want to hit the button EVERY SINGLE TIME on the first click. This is another method these games use to detect input.
Really what you are doing here is emulating human behavior in a way that a machine is UNLIKELY to detect. To that effect I recommend the following method for clicking buttons or controls: (untested)
Code:
ClickButtonRandom(TopLeftX, TopLeftY, BottomRightX, BottomRightY)
{
Random, ExtraClicks, 0, 1
Random, Sleep, 500, 1000
Random, X, %TopLeftX%, %BottomRightX%
Random, Y, %TopLeftY%, %BottomRightY%
Random, DC, 0, 1
Sleep, %sleep%
Click, %X%, %Y%
If DC ;randomly double click
{
Click, %X%, %Y%
}
If ExtraClicks ;half the time throw another click in there
{
Sleep, 100 ;
While ExtraClicks
Random, XSeed, 1, 8
Random, YSeed, 1, 8
X := X+Seed
Y := Y+Seed
Click, %X%, %Y%
}
Return
}
Some of the random people behaviors you may want to think about emulating in your script:
-User accidentally clicks outside the box
-(in closed environments) user accidentally clicks the wrong button on occasion, and then cancels that window and goes back to what they were doing
-User occasionally opens their friends list for a random period of time, maybe clicking on a name
-User occasionally takes a break of 3-4 minutes
-User responds to tells (difficult to emulate I know)
-(in the bags case) user occasionally closes the bag window on accident and then randomly presses 'b' OR clicks on the bag button to open it back up
While scripts can be quite close-ended, when you know that all you have to emulate to get past the detectors is enough random human stupidity then it's not so impossible to sneak past the jailer.