How do you detect a cheater?
Moderator: Moderators
How do you detect a cheater?
It's been ages since I've had to deal with reviewing demos to look for cheaters when clans accuse each other in league matches (or wars as some call 'em).
So I was kind of wondering what y'all do now to make judgement calls for this kind of stuff.
I used to review demos with a wallhack on so that I could see if the player was targeting someone through walls when he could not have heard him, or if someone was just moving in general in response to people he could not have seen, that kind of stuff. That helped look for possible wallhacking and spiked models (but who the hell ever used THOSE anyway besides crazy Q2CTF players).
For autoaim bots, the demos were mostly easy to detect. People tended to use SSG and the bot would "pop" from the current crosshair to shoot at someone and then "pop" back. Hard to tell in-game but much easier to see in a demo. Most human twitch snipers don't magically return to their EXACT STARTING POSITION after the twitch time and time again, so that was pretty much a no-brainer.
Most AQ2 servers could detect M4 scripts, I think even Q2Admin added support for that. So that became a non-issue relatively early on. There might still be one or two that use some cl_angle crap instead of cl_pitchspeed, but I think that's kind of minor to worry about.
Requiring random screenshots took care of most glowskins. Or non-approved skins, at least. That also addressed, to a degree, gl_modulate and intensity settings.
Banned players used to be able to be found out by their MAC settings if they ran a Windows machine. Something like nbtstat -A [ip address] could resolve the hostname and MAC address, if you had an existing one to compare that to and you knew it belonged to a banned player.
You'd need access to server logs to check IP addresses, of course. And access to server logs could help detect edited demos. That was used to ban a clan from a league for editing/modifying their demos. They wanted to "force" a substitute player into the match so they told someone to disconnect their network cable so they would lag out and give them an excuse to sub a player. They edited that text out of the demo but it existed in the server logs. Busted!
I never really checked for sound/footstep cheating, I suppose that would be found out from the wallhack testing, but possibly not.
Ok, so that's:
aimbot
wallhack/spiked models/sound cheating(maybe)
M4 script (non-issue)
glowskins/non-legal skins
banned players circumventing the ban
modifying demos/evidence in disputes
What else is there?
And how do YOU blokes detect this stuff? What do you look for? Do you examine demos or is this all just in-game realtime guesswork that gets people banned or labeled as cheaters?
I am curious.
So I was kind of wondering what y'all do now to make judgement calls for this kind of stuff.
I used to review demos with a wallhack on so that I could see if the player was targeting someone through walls when he could not have heard him, or if someone was just moving in general in response to people he could not have seen, that kind of stuff. That helped look for possible wallhacking and spiked models (but who the hell ever used THOSE anyway besides crazy Q2CTF players).
For autoaim bots, the demos were mostly easy to detect. People tended to use SSG and the bot would "pop" from the current crosshair to shoot at someone and then "pop" back. Hard to tell in-game but much easier to see in a demo. Most human twitch snipers don't magically return to their EXACT STARTING POSITION after the twitch time and time again, so that was pretty much a no-brainer.
Most AQ2 servers could detect M4 scripts, I think even Q2Admin added support for that. So that became a non-issue relatively early on. There might still be one or two that use some cl_angle crap instead of cl_pitchspeed, but I think that's kind of minor to worry about.
Requiring random screenshots took care of most glowskins. Or non-approved skins, at least. That also addressed, to a degree, gl_modulate and intensity settings.
Banned players used to be able to be found out by their MAC settings if they ran a Windows machine. Something like nbtstat -A [ip address] could resolve the hostname and MAC address, if you had an existing one to compare that to and you knew it belonged to a banned player.
You'd need access to server logs to check IP addresses, of course. And access to server logs could help detect edited demos. That was used to ban a clan from a league for editing/modifying their demos. They wanted to "force" a substitute player into the match so they told someone to disconnect their network cable so they would lag out and give them an excuse to sub a player. They edited that text out of the demo but it existed in the server logs. Busted!
I never really checked for sound/footstep cheating, I suppose that would be found out from the wallhack testing, but possibly not.
Ok, so that's:
aimbot
wallhack/spiked models/sound cheating(maybe)
M4 script (non-issue)
glowskins/non-legal skins
banned players circumventing the ban
modifying demos/evidence in disputes
What else is there?
And how do YOU blokes detect this stuff? What do you look for? Do you examine demos or is this all just in-game realtime guesswork that gets people banned or labeled as cheaters?
I am curious.
seriously guys....
who cares about cheaters?
if you think someone is cheating, just leave the game, who the fuck cares if that (possible)cheating-clan writes on their website: Clan XXX W.O they left.
do you really care? some idiot might write: OMGOMG U LOST VS XXX LOL NOOBS
do you care? it's a fucking game, for fucks sake, show everybody you don't live by your computer, fuck this gets me mad
if you think someone is cheating, just leave the fucking game and feel good about yourself for not cheating like those sons of bitches are, damn. it's not harder then that...
do you feel better knowing another cheater is caught? not really i suppose...
who cares about cheaters?
if you think someone is cheating, just leave the game, who the fuck cares if that (possible)cheating-clan writes on their website: Clan XXX W.O they left.
do you really care? some idiot might write: OMGOMG U LOST VS XXX LOL NOOBS
do you care? it's a fucking game, for fucks sake, show everybody you don't live by your computer, fuck this gets me mad
if you think someone is cheating, just leave the fucking game and feel good about yourself for not cheating like those sons of bitches are, damn. it's not harder then that...
do you feel better knowing another cheater is caught? not really i suppose...
Some years ago - spose it's 4 or 5 years ago now - a few of us (MysteryMan, Frede, Santa and I) who were adminning the very popular Boomtown servers decided that we wanted to make a common basis for rules and banlists for the Northern Europe servers, so we started "The AQ2Admins" project
Our website can be found at http://mysteryman.z0r.nl/aq2/index.php (at least when Myst has his computer turned on, which doesn't seem to be the case atm). At first we were just the boomtown servers but during the years a lot of other servers have joined up. Myst made an IRC bot which logs IP adresses of every player on all our servers and the admins can then search on either IP adress or nickname in the IP database. In our private admin channel we can also request 'status' from every server if we want to see who's faking and so on - it actually works as a remote rcon, so we can do all kinds of funny stuff like changing gravity, which is always a bomb . The bot is also able to ban an IP on all servers at once, which is what we use when we detect a cheater.
The detection of cheaters mainly stem from viewing demos. At one point, when frkq2 was the main form of cheat used, we used to stuff some commands via rcon (I believe it was "!q2ip"), which would then output 'localhost' if a guy was using frkq2.
Nowadays, the main cheat used is wallhack, simply because botting is way too easy to spot. More often than not, the demos we view comes from this forum. When I want to check whether a guy uses wallhack or not, I play the demo without wallhack first, just to get a general idea of how the guy plays, and then I watch it with wallhack enabled to see if there's an immense amount of aiming through walls and so on.
I don't think we've ever had a cup/league where you weren't allowed to use your subs as you saw fit, so we've never had the need for server demos.
At least this is how it worked a few months back when I was a bit active..
Our website can be found at http://mysteryman.z0r.nl/aq2/index.php (at least when Myst has his computer turned on, which doesn't seem to be the case atm). At first we were just the boomtown servers but during the years a lot of other servers have joined up. Myst made an IRC bot which logs IP adresses of every player on all our servers and the admins can then search on either IP adress or nickname in the IP database. In our private admin channel we can also request 'status' from every server if we want to see who's faking and so on - it actually works as a remote rcon, so we can do all kinds of funny stuff like changing gravity, which is always a bomb . The bot is also able to ban an IP on all servers at once, which is what we use when we detect a cheater.
The detection of cheaters mainly stem from viewing demos. At one point, when frkq2 was the main form of cheat used, we used to stuff some commands via rcon (I believe it was "!q2ip"), which would then output 'localhost' if a guy was using frkq2.
Nowadays, the main cheat used is wallhack, simply because botting is way too easy to spot. More often than not, the demos we view comes from this forum. When I want to check whether a guy uses wallhack or not, I play the demo without wallhack first, just to get a general idea of how the guy plays, and then I watch it with wallhack enabled to see if there's an immense amount of aiming through walls and so on.
I don't think we've ever had a cup/league where you weren't allowed to use your subs as you saw fit, so we've never had the need for server demos.
At least this is how it worked a few months back when I was a bit active..
Cool beans.
Yeah, for the subs thing, it was something like only 2 switches per map or something like that. The intent was to not distract people by switching all the time every round. Because in some cases the match would stop while people switched, too, which broke the rhythm of the match.
As for the "just leave the server if you don't like cheaters" mentality, what happens when every pub out there has a least one cheater? And why should *I* have to inconvenience myself because someone is too retarded to play the game as intended?
You might feel like it's your 'right' to play how you want, but by playing how you want it stomps all over MY 'right' to play how I want as in to play the game as intended--and if my opponents are using wallhacks and aimbots, well, that's not playing the game as intended.
I don't see what gives YOU the right to dictate how *I* should play or enjoy playing a game. Perhaps you feel the same way. However, I must point out that of the cheater and the non-cheater, it's the cheater who is going out of his way to ruin the gameplay experiences of other players.
Maybe it's that additional feeling of power that's the lure?
Yeah, for the subs thing, it was something like only 2 switches per map or something like that. The intent was to not distract people by switching all the time every round. Because in some cases the match would stop while people switched, too, which broke the rhythm of the match.
As for the "just leave the server if you don't like cheaters" mentality, what happens when every pub out there has a least one cheater? And why should *I* have to inconvenience myself because someone is too retarded to play the game as intended?
You might feel like it's your 'right' to play how you want, but by playing how you want it stomps all over MY 'right' to play how I want as in to play the game as intended--and if my opponents are using wallhacks and aimbots, well, that's not playing the game as intended.
I don't see what gives YOU the right to dictate how *I* should play or enjoy playing a game. Perhaps you feel the same way. However, I must point out that of the cheater and the non-cheater, it's the cheater who is going out of his way to ruin the gameplay experiences of other players.
Maybe it's that additional feeling of power that's the lure?
When we had the [balle] server (well guid0[balle] ran it) I honestly don't know what anticheat we ran but most in the clan had rcon of some sort and actively used it against clear cheats, lameplaying fake/no-nickers etc. Being no. 1 on the statswhore site TheCLQ said a lot about the servers popularity.
And regarding sanity:
I don't care either if some bloke, an entire clan or the whole world cheats in World of Warcraft. I don't play it so why the fuck should I? Stop posting here.
And regarding sanity:
I don't care either if some bloke, an entire clan or the whole world cheats in World of Warcraft. I don't play it so why the fuck should I? Stop posting here.
thats the one.Clown wrote:When I had RCON to Jolt, I basically kicked everyone I didn't liked or who was annoying everyone.
another way is to write "OMGOMGOMG CHEATER U SUXXOR!!!!!!! IM GOING TO TELL ADMINS YOUR IP!!!!!!!!!".
those who disconnect are cheaters.
- Killing today in old fashioned way -
- Beware of Beavers -
- -
- Beware of Beavers -
- -