free Runescape Private Server - How does it work?

I've seen a lot of Runescape private servers lately. How do they work? Most of them are based on the old Runescape, but a few look exactly like the real Runescape. How do they make the servers? Has the source code of the game been leaked on several occasions, and is that used to make Runescape servers? Or have some people just replicated Runescape, and tried to make the same game themselves (and "stolen" the 3D objects and texture from Jagex to make it look the same, and written the code to be able to replicate most functions of Runescape)?

3 Answers

Most Runescape Private Servers are coded in the Java language. For the most part, it's been a community effort. From the early days of Free Runescape Bots classic, there was some leaked source, and from there it's been mostly the community reverse engineering updates as they come. Textures and images are found through URL-Manipulation, and some source code can be found to this day through such methods. Until late, a lot of the game could be analyzed through making a client, and then reading what gets sent to the client by the real Runescape server. Nowadays, you can get a lot of good source code for making your own, from large Runescape Private Server communities. You can get source ranging from a fully developed engine, all the way down to just a simple construct that needs to be fully scripted.

What most people are saying here is entirely incorrect.
The process of developing a RuneScape private server is a bit complex.
Over the years, more and more RuneScape client revisions have been released. I believe the current revision is 724.
The RuneScape private server revision that you most commonly see is the 317 revision, possibly because the most work has been done on this revision. The RuneScape clients are obfuscated before they are released (ZKM obfuscator), but over the years several capable individuals from the RuneScape hacking scene have been able to "deobfuscate" these clients, in a sense. Once deobfuscated, the clients can be studied to understand how the game protocol works.

Let's take the 317 protocol for example. (Before you begin writing a private server/emulator, you need networking knowledge)
Firstly, you create the server. The server binds to port 43594 (the default).
After this, you'd need to set up a system to decode the incoming data being received from the client. The first part of data that is received from the client is the login protocol, which logs the user into the game (not going to describe how this works in detail). Basically, during this procedure, different data are exchanged between the client and the server, including the player's credentials.
Once the login procedure has been decoded, the server would perform player updating (in reality, the client updates the player, but the server would send packets to the client to tell it to begin the player updating procedure). The player updating procedure, well, updates the player (appearance, movement, etc.).
After these two have been completed, the player will be logged in game. Once logged in, the client and server send each other several different packets. These packets include sending interfaces and widgets, loading map regions, spawning items, and the like.
The opcode of a game packet is basically an identifier for the type of game action that the packet represents. The size of the packet is the Free Runescape amount of bytes that the payload of the packet carries, and the payload is an array of bytes that holds the actual data (information) of the packet (which is encrypted using the ISAAC cipher to prevent 3rd-party programs from tampering with the stream). A fixed-size packet is a packet whose payload size does never change, and the size for the specified opcode is already known between both client and server. A variable-sized packet is a packet whose payload size changes according to the situation of the game session.
Along with the standard data bytes that you can think of being sent to the client/server ([un]signed bytes, shorts, longs, the like), there are also special RuneScape data types. These have been named by the RuneScape hacking community but aren't JaGeX's official names for them. Here are a few:

• JString - A C-Style string. The bytes of the string are written, followed by a terminating byte of 10.
• "Special" bytes and shorts - Each special byte or short has a different read/write transformation. These are commonly known as special a, c, and s or add, invert, and subtract, respectively.
• More come along in the later protocols...