How do you detect a cheater?

Pimpin new players? Started a new clan? Do you dislike a player or a clan? Post it all here.

Moderator: Moderators

Post Reply
Monk
plummets to its death
Posts: 61
Joined: Tue Dec 19, 2006 6:33 pm
Location: us

How do you detect a cheater?

Post by Monk »

It's been ages since I've had to deal with reviewing demos to look for cheaters when clans accuse each other in league matches (or wars as some call 'em).

So I was kind of wondering what y'all do now to make judgement calls for this kind of stuff.

I used to review demos with a wallhack on so that I could see if the player was targeting someone through walls when he could not have heard him, or if someone was just moving in general in response to people he could not have seen, that kind of stuff. That helped look for possible wallhacking and spiked models (but who the hell ever used THOSE anyway besides crazy Q2CTF players).

For autoaim bots, the demos were mostly easy to detect. People tended to use SSG and the bot would "pop" from the current crosshair to shoot at someone and then "pop" back. Hard to tell in-game but much easier to see in a demo. Most human twitch snipers don't magically return to their EXACT STARTING POSITION after the twitch time and time again, so that was pretty much a no-brainer.

Most AQ2 servers could detect M4 scripts, I think even Q2Admin added support for that. So that became a non-issue relatively early on. There might still be one or two that use some cl_angle crap instead of cl_pitchspeed, but I think that's kind of minor to worry about.

Requiring random screenshots took care of most glowskins. Or non-approved skins, at least. That also addressed, to a degree, gl_modulate and intensity settings.

Banned players used to be able to be found out by their MAC settings if they ran a Windows machine. Something like nbtstat -A [ip address] could resolve the hostname and MAC address, if you had an existing one to compare that to and you knew it belonged to a banned player.

You'd need access to server logs to check IP addresses, of course. And access to server logs could help detect edited demos. That was used to ban a clan from a league for editing/modifying their demos. They wanted to "force" a substitute player into the match so they told someone to disconnect their network cable so they would lag out and give them an excuse to sub a player. They edited that text out of the demo but it existed in the server logs. Busted!

I never really checked for sound/footstep cheating, I suppose that would be found out from the wallhack testing, but possibly not.

Ok, so that's:

aimbot
wallhack/spiked models/sound cheating(maybe)
M4 script (non-issue)
glowskins/non-legal skins
banned players circumventing the ban
modifying demos/evidence in disputes

What else is there?

And how do YOU blokes detect this stuff? What do you look for? Do you examine demos or is this all just in-game realtime guesswork that gets people banned or labeled as cheaters?

I am curious.
LaggizZ
melted
Posts: 151
Joined: Mon Feb 02, 2004 1:27 pm
Location: se

Post by LaggizZ »

You know if someone knows to much when you play versus them..

Then you just ask for demo, and they turn it off maybe.
hmm..
Clown
unpossible??!?!!
Posts: 1750
Joined: Sun Jul 27, 2003 7:38 am
Location: en

Post by Clown »

We have a comittee, who seem somewhat useless.
And we have this forum, who are far too quick and judgmental.

I didn't bother reading your post, so I hope this helped.
I don't give a shit.
sanity
was in the wrong place
Posts: 267
Joined: Sun Aug 29, 2004 1:15 pm
Location: se
Contact:

Post by sanity »

seriously guys....
who cares about cheaters?
if you think someone is cheating, just leave the game, who the fuck cares if that (possible)cheating-clan writes on their website: Clan XXX W.O they left.
do you really care? some idiot might write: OMGOMG U LOST VS XXX LOL NOOBS

do you care? it's a fucking game, for fucks sake, show everybody you don't live by your computer, fuck this gets me mad

if you think someone is cheating, just leave the fucking game and feel good about yourself for not cheating like those sons of bitches are, damn. it's not harder then that...

do you feel better knowing another cheater is caught? not really i suppose...
Image
Image
Clement
Master of the Universe
Posts: 743
Joined: Fri Jul 25, 2003 10:27 pm
Location: dk
Contact:

Post by Clement »

Some years ago - spose it's 4 or 5 years ago now - a few of us (MysteryMan, Frede, Santa and I) who were adminning the very popular Boomtown servers decided that we wanted to make a common basis for rules and banlists for the Northern Europe servers, so we started "The AQ2Admins" project :)

Our website can be found at http://mysteryman.z0r.nl/aq2/index.php (at least when Myst has his computer turned on, which doesn't seem to be the case atm). At first we were just the boomtown servers but during the years a lot of other servers have joined up. Myst made an IRC bot which logs IP adresses of every player on all our servers and the admins can then search on either IP adress or nickname in the IP database. In our private admin channel we can also request 'status' from every server if we want to see who's faking and so on - it actually works as a remote rcon, so we can do all kinds of funny stuff like changing gravity, which is always a bomb :). The bot is also able to ban an IP on all servers at once, which is what we use when we detect a cheater.

The detection of cheaters mainly stem from viewing demos. At one point, when frkq2 was the main form of cheat used, we used to stuff some commands via rcon (I believe it was "!q2ip"), which would then output 'localhost' if a guy was using frkq2.

Nowadays, the main cheat used is wallhack, simply because botting is way too easy to spot. More often than not, the demos we view comes from this forum. When I want to check whether a guy uses wallhack or not, I play the demo without wallhack first, just to get a general idea of how the guy plays, and then I watch it with wallhack enabled to see if there's an immense amount of aiming through walls and so on.

I don't think we've ever had a cup/league where you weren't allowed to use your subs as you saw fit, so we've never had the need for server demos.

At least this is how it worked a few months back when I was a bit active.. :)
Monk
plummets to its death
Posts: 61
Joined: Tue Dec 19, 2006 6:33 pm
Location: us

Post by Monk »

Cool beans.

Yeah, for the subs thing, it was something like only 2 switches per map or something like that. The intent was to not distract people by switching all the time every round. Because in some cases the match would stop while people switched, too, which broke the rhythm of the match.

As for the "just leave the server if you don't like cheaters" mentality, what happens when every pub out there has a least one cheater? And why should *I* have to inconvenience myself because someone is too retarded to play the game as intended?

You might feel like it's your 'right' to play how you want, but by playing how you want it stomps all over MY 'right' to play how I want as in to play the game as intended--and if my opponents are using wallhacks and aimbots, well, that's not playing the game as intended.

I don't see what gives YOU the right to dictate how *I* should play or enjoy playing a game. Perhaps you feel the same way. However, I must point out that of the cheater and the non-cheater, it's the cheater who is going out of his way to ruin the gameplay experiences of other players.

Maybe it's that additional feeling of power that's the lure?
Clement
Master of the Universe
Posts: 743
Joined: Fri Jul 25, 2003 10:27 pm
Location: dk
Contact:

Post by Clement »

Great video btw! I wanted to vote "At least he's not ragging on the Finns", but it just wasn't possible in a thread in the cheaters section :o)

Oh and just for the record, snt ain't a cheater.. he just don't give a fuck..
minchiano
bleeds to death
Posts: 451
Joined: Mon May 17, 2004 5:44 pm
Location: se
Contact:

Post by minchiano »

When we had the [balle] server (well guid0[balle] ran it) I honestly don't know what anticheat we ran but most in the clan had rcon of some sort and actively used it against clear cheats, lameplaying fake/no-nickers etc. Being no. 1 on the statswhore site TheCLQ said a lot about the servers popularity.

And regarding sanity:

I don't care either if some bloke, an entire clan or the whole world cheats in World of Warcraft. I don't play it so why the fuck should I? Stop posting here.
Image
Clown
unpossible??!?!!
Posts: 1750
Joined: Sun Jul 27, 2003 7:38 am
Location: en

Post by Clown »

When I had RCON to Jolt, I basically kicked everyone I didn't liked or who was annoying everyone.
I don't give a shit.
BeAViS
ittssaaa marrrioooo!
Posts: 1390
Joined: Wed Apr 06, 2005 5:15 am
Location: it
Contact:

Post by BeAViS »

Clown wrote:When I had RCON to Jolt, I basically kicked everyone I didn't liked or who was annoying everyone.
thats the one.

another way is to write "OMGOMGOMG CHEATER U SUXXOR!!!!!!! IM GOING TO TELL ADMINS YOUR IP!!!!!!!!!".
those who disconnect are cheaters.
- Killing today in old fashioned way -
- Beware of Beavers -
- :mario: -
minchiano
bleeds to death
Posts: 451
Joined: Mon May 17, 2004 5:44 pm
Location: se
Contact:

Post by minchiano »

Clown wrote:When I had RCON to Jolt, I basically kicked everyone I didn't liked
That's so you clown :sleep:
Image
Caracol
was picked off
Posts: 1152
Joined: Wed Sep 01, 2004 8:11 am
Location: cl
Contact:

Post by Caracol »

Back in the days we threw them with the hands tied into water. You could spot them right away, since cheaters are made out of wood.
Ne quid nimis.
dudemcpek
had its throat slit
Posts: 1422
Joined: Fri Jul 25, 2003 6:16 pm
Location: si

Post by dudemcpek »

And weigh as much as a duck? :)
Post Reply