From what I observed/read and shit, theres multiple things they may have done.
First off, the port they use is something like 51418 or something....
The token changes
The opcodes might be changed
token changes every so on (5 minutes or something)
Annoying anti-botting threads closing everything that was ever posted here.
They way their client side antibot works is that it acts like a virus scanner... looks for partial code and similarity's, you simply have to recompile a program/rename and it usually works. I've posted ways to open walker while the client was running and stuff... the original ways were originally thought of by this thread starter.