How do you detect a cheater?
Posted: Fri Dec 29, 2006 7:01 pm
It's been ages since I've had to deal with reviewing demos to look for cheaters when clans accuse each other in league matches (or wars as some call 'em).
So I was kind of wondering what y'all do now to make judgement calls for this kind of stuff.
I used to review demos with a wallhack on so that I could see if the player was targeting someone through walls when he could not have heard him, or if someone was just moving in general in response to people he could not have seen, that kind of stuff. That helped look for possible wallhacking and spiked models (but who the hell ever used THOSE anyway besides crazy Q2CTF players).
For autoaim bots, the demos were mostly easy to detect. People tended to use SSG and the bot would "pop" from the current crosshair to shoot at someone and then "pop" back. Hard to tell in-game but much easier to see in a demo. Most human twitch snipers don't magically return to their EXACT STARTING POSITION after the twitch time and time again, so that was pretty much a no-brainer.
Most AQ2 servers could detect M4 scripts, I think even Q2Admin added support for that. So that became a non-issue relatively early on. There might still be one or two that use some cl_angle crap instead of cl_pitchspeed, but I think that's kind of minor to worry about.
Requiring random screenshots took care of most glowskins. Or non-approved skins, at least. That also addressed, to a degree, gl_modulate and intensity settings.
Banned players used to be able to be found out by their MAC settings if they ran a Windows machine. Something like nbtstat -A [ip address] could resolve the hostname and MAC address, if you had an existing one to compare that to and you knew it belonged to a banned player.
You'd need access to server logs to check IP addresses, of course. And access to server logs could help detect edited demos. That was used to ban a clan from a league for editing/modifying their demos. They wanted to "force" a substitute player into the match so they told someone to disconnect their network cable so they would lag out and give them an excuse to sub a player. They edited that text out of the demo but it existed in the server logs. Busted!
I never really checked for sound/footstep cheating, I suppose that would be found out from the wallhack testing, but possibly not.
Ok, so that's:
aimbot
wallhack/spiked models/sound cheating(maybe)
M4 script (non-issue)
glowskins/non-legal skins
banned players circumventing the ban
modifying demos/evidence in disputes
What else is there?
And how do YOU blokes detect this stuff? What do you look for? Do you examine demos or is this all just in-game realtime guesswork that gets people banned or labeled as cheaters?
I am curious.
So I was kind of wondering what y'all do now to make judgement calls for this kind of stuff.
I used to review demos with a wallhack on so that I could see if the player was targeting someone through walls when he could not have heard him, or if someone was just moving in general in response to people he could not have seen, that kind of stuff. That helped look for possible wallhacking and spiked models (but who the hell ever used THOSE anyway besides crazy Q2CTF players).
For autoaim bots, the demos were mostly easy to detect. People tended to use SSG and the bot would "pop" from the current crosshair to shoot at someone and then "pop" back. Hard to tell in-game but much easier to see in a demo. Most human twitch snipers don't magically return to their EXACT STARTING POSITION after the twitch time and time again, so that was pretty much a no-brainer.
Most AQ2 servers could detect M4 scripts, I think even Q2Admin added support for that. So that became a non-issue relatively early on. There might still be one or two that use some cl_angle crap instead of cl_pitchspeed, but I think that's kind of minor to worry about.
Requiring random screenshots took care of most glowskins. Or non-approved skins, at least. That also addressed, to a degree, gl_modulate and intensity settings.
Banned players used to be able to be found out by their MAC settings if they ran a Windows machine. Something like nbtstat -A [ip address] could resolve the hostname and MAC address, if you had an existing one to compare that to and you knew it belonged to a banned player.
You'd need access to server logs to check IP addresses, of course. And access to server logs could help detect edited demos. That was used to ban a clan from a league for editing/modifying their demos. They wanted to "force" a substitute player into the match so they told someone to disconnect their network cable so they would lag out and give them an excuse to sub a player. They edited that text out of the demo but it existed in the server logs. Busted!
I never really checked for sound/footstep cheating, I suppose that would be found out from the wallhack testing, but possibly not.
Ok, so that's:
aimbot
wallhack/spiked models/sound cheating(maybe)
M4 script (non-issue)
glowskins/non-legal skins
banned players circumventing the ban
modifying demos/evidence in disputes
What else is there?
And how do YOU blokes detect this stuff? What do you look for? Do you examine demos or is this all just in-game realtime guesswork that gets people banned or labeled as cheaters?
I am curious.
)