CS Source ANTI CHEAT thing (In the works)

Open discussion about any topic, as long as you abide by the rules of course!
Post Reply
SOAPboy
Posts: 8268
Joined: Sun Apr 13, 2003 7:00 am

CS Source ANTI CHEAT thing (In the works)

Post by SOAPboy »

Freakaloin
Posts: 10620
Joined: Tue May 07, 2002 7:00 am

Post by Freakaloin »

fuck u...
a defining attribute of a government is that it has a monopoly on the legitimate exercise of violence...
Doombrain
Posts: 23227
Joined: Sat Aug 12, 2000 7:00 am

Post by Doombrain »

Image
User avatar
PhoeniX
Posts: 4067
Joined: Fri Aug 04, 2000 7:00 am

Post by PhoeniX »

Too bad its CS.
Freakaloin
Posts: 10620
Joined: Tue May 07, 2002 7:00 am

Post by Freakaloin »

what?

btw... css rocks...yep i am gay now but its fun...
a defining attribute of a government is that it has a monopoly on the legitimate exercise of violence...
phantasmagoria
Posts: 8525
Joined: Wed Oct 22, 2003 7:00 am

Post by phantasmagoria »

That was class. Vavle have just put up their VAC thingy too \o/
[size=85]
sirstrongbad
Posts: 264
Joined: Tue Sep 12, 2000 7:00 am

Post by sirstrongbad »

it is a very interesting idea- but there are a couple questions i've got regarding the video i just watched...

1. is this tool only available for adminstrators who are spectating?

2. if it is only allowed during spectator mode, what's to stop people from hacking the code and allowing it during gameplay?

3. it detects pre-aim. i've played the maps enough to know where people like to hide. does that mean i'm hacking if i have my sights locked onto a particular corner or boxtop as i'm rounding a bend?

4. oddshot? yeah- that's one of the things this tool detected. there are so many oddshots in CS:S. i don't know why they included this.


the only good i see from this tool is the "firing through wall" and "lockbot" detection. other than that, i don't quite see the point. it will just make for some ban-happy admins.
sirstrongbad
Posts: 264
Joined: Tue Sep 12, 2000 7:00 am

Post by sirstrongbad »

also, Valve has already "released" their anti-cheat system (VAC2), though it is only running in "beta mode." supposedly during this time, they are logging hackers' steam id's to a database where they will be banned once the system is completely functional. sneaky.
AmIdYfReAk
Posts: 6926
Joined: Thu Feb 10, 2000 8:00 am

Post by AmIdYfReAk »

yea, i've seen some of the things that this incorperated in other anti-hacking programs that are floating around, and i must say this is the most in depth that i've seen.. allthough i can easly see some of the mad fluke shots being considered hacking.
Sevensins
Posts: 444
Joined: Tue Jul 17, 2001 7:00 am

Post by Sevensins »

sirstrongbad wrote:it is a very interesting idea- but there are a couple questions i've got regarding the video i just watched...

1. is this tool only available for adminstrators who are spectating?

2. if it is only allowed during spectator mode, what's to stop people from hacking the code and allowing it during gameplay?

3. it detects pre-aim. i've played the maps enough to know where people like to hide. does that mean i'm hacking if i have my sights locked onto a particular corner or boxtop as i'm rounding a bend?

4. oddshot? yeah- that's one of the things this tool detected. there are so many oddshots in CS:S. i don't know why they included this.


the only good i see from this tool is the "firing through wall" and "lockbot" detection. other than that, i don't quite see the point. it will just make for some ban-happy admins.
I read a bit about it today. If you read the main faq and some of the other forum posts, most questions you can think of are answered. The creator also seems to answer questions pretty nicely as well.

The system accounts for just about everything. Sounds, shadows, blood, static and non-static items, previous play habits, etc.

edit: 500mb size is old btw. He has brought it down to 75mb, I believe.


main faq:
To describe the entire HackCam project, or HC as we call it, would take several pages and many thousands of complex words. So, this thread will be your general overview of just what in the hell this thing is. If you have more specific questions regarding the project, its capabilities, how it works, or anything else not handled in this posting, please start a new one in this forum so that questions dont need to be repeated and a single vessel of knowledge can be created.

Let's get the dirty stuff out of the way first.

What in the HELL is HC?

HackCam is an anti-cheating utility designed for the first person shooter game Counter Strike designed by Valve, creators of Half Life and its many mods. Unlike normal cheat detection utilities, the checking is not based on what files are installed on the players machine, what scripts are running, what processes are functioning in the background, etc. It is based solely on what the player sees in game and how they react to their environment. Thousands of hacks exist, but in the end, they all do the same thing, so why search for the thousand of varieties, when you can simply search for the results of them?

Does it only work for Counter Strike?

Currently HC has been designed completely around the Counter Strike mod of Half Life but is in the final development stages of being ported over to Counter Strike Source, the Half Life 2 version of the game. In reality, the functions and systems could be ported to any of the Half Life modification games, or any other First Person Shooter game.

How long has this thing been in development?

Some of the more in-depth checking routines are over 7 years in the making. They were not initially designed for this purpose but fill the void they are needed in nicely.

How many revisions have there been?

There are currently 4 versions of HackCam in existence.

* HC v1: Scans and scores Steam 1.6 DEMo files
* HC v2: Scans and scores Steam 1.6 games in real-time while they are being played.
* HC v3: Counter Strike Source scanner and score system for real-time gaming
* HC v4: Server side modification for Counter Strike Source that performs scoring and scanning autonomously.

My server/clan/admins would love this utility. How can we get a hold of it?

Simply put, you can't. There are several reasons for this, the major one being a deal in the process with a gaming manufacturer to purchase and license the HC engine system for release in future games under development. Other reasons include the fact that the DLL system being used in the 1.6 version is over 500MB (yes, 0.5GB) in size. I'm certainly not going to let every person and their pet monkey download a file that size off of my small pipe, even with mirrors.

How many tests has this undergone? And how many false positives has it generated?

At this point in time, 437 demos have been scanned and more then 400 hours of gaming time have undergone scrutiny. HC has detected more then 100 cheaters in demos alone, and several dozen more in real-time gaming. Not one, I repeat, not ONE, has ever been contested, or another reason been given that could excuse the evidence given. Sure, cheaters say they aren't cheating and the program doesn't work, but in more cases then those, a player who has claimed they werent cheating at the time have come forward and said they WERE cheating in some regard at the time of them being caught, but were too proud of themselves to admit it.

What does a person have to do in order for it to claim they're cheating?

In the end, HC generates a score in the range of 0 - 100. In the original design phases, this number reflected the perecentage of time a player was aiming at someone they couldn't see, to aiming at someone they could. So, a score of 50 meant half the time their crosshairs were on someone, but they couldn't see them. Hundreds of detection routines have been added since then, so that methodology really doesn't work the same. Now the scores are weighted depending on the evidence gathered during a scan process. 95% of all players scanned by the HC system score below 50. A player scoring between 51 and 75 is considered suspect. 76 to 84 warrants another look at the person in future demos or future rounds. 85 or above is categorized as a confirmed cheater. As you can see, the average player can never get high enough to be considered a cheater. The scale is modified constantly depending on new systems added to ensure that legitamite players will be kept safe.

Does it check for wallhackers? And how?

The original design was made specifically to catch wallhackers, so you could say its done this job since its birth. Hundreds of other detections are also in the system, but this one still remains one of the best detection routines in the program. To use an example, consider the map de_dust. There is a long hallway from the Terrorist Spawn point to the bombiste. Now, a terrorist runs down that hallway heading to the bombsite. Fred, our cheater, is sitting outside the tunnel staring at the T running. If his crosshairs remain on that player during his run, well, he's definetly not kosure. That is a simplistic view of the detection routine, but it's nowhere near as simplistic as that. Take into consideration Fred isnt using an aimbot, that he's just following the player lazilly with his gun barrel as he runs. Each player has a logic box built around them, if the barrel crosses into that box during a hidden phase, the timer is marked. At the end, the timer is compared to the amount of time he wasn't aiming at him, how long the T was indeed in his view, and how long he was aiming at him but could see him. Score tabulation goes from there. In another more complex example using the above scenario, let's say Fred is a legit player, but happens to be strafing towards the bombsite with our T in his crosshairs the entire way (both travel at roughly the same speed). According to the logic boxes, he's wallhacking, but in reality, he's legit. What about this case?

This is where more of the indepth detection routines take place, including the ESP system and human response engine. A player will always react differently when they know there is a threat, when they think there is a threat, and when they know there is no threat. Movement changes, barrel positioning changes, whether they are running or walking changes, dozens of human response conditions exist that change between each of these 3 scenarios. Simply cross-reference the players behavior with the other available information and you can get some insight on whether they really DO know the person is there, or if they dont.

Does HC check for <insert item here>? And how?

Post a new thread, your answers will appear there.

I have a suggestion to make on the system...

Again, post a new thread.

Could you explain this part a little better...

Post a new thread, but dont be guaranteed on a straight-forward response. This is my intellectual property, so I'm not going to give away all of its secrets.
Sevensins
Posts: 444
Joined: Tue Jul 17, 2001 7:00 am

Post by Sevensins »

sirstrongbad
Posts: 264
Joined: Tue Sep 12, 2000 7:00 am

Post by sirstrongbad »

yeah, i read that FAQ at steampowered.com, but it didn't really completely answer my questions. although it does seem to judge pretty fairly, since it tallies up the probability based on a multitude of events. thus pre-aiming while rounding a corner may flag the Hack Cam, but my other actions (such as not dodging a flashbang that has been thrown but not yet visible to me - such as from behind a wall) would prove otherwise.

it's an interesting tool, but i still wonder what will stop people from bypassing the code to use it as a hack. let's just imagine that this Hack Cam won't be flagged as a cheat by VAC2 for a moment. the code gets broken by a group of programmers and now they have a perfectly "legal" hacking tool that VAC2 won't ban for.
Last edited by sirstrongbad on Thu Apr 07, 2005 7:59 pm, edited 1 time in total.
Sevensins
Posts: 444
Joined: Tue Jul 17, 2001 7:00 am

Post by Sevensins »

creators answer to number 2:
To clear this up, V4 is server-side (current release if you saw the video), V5 is client-side which will meet open-beta then released to the public. As for disabling/enabling the HC system while not in spec mode, there isn't one simple 'flag' that has to be changed by an outside system, if any, to circumvent the security protocal. In order to patch the system, several different areas would have to be modified first to even allow the system to be changed externally. To put it short, yes, there is a fairly large anti-circumvention system already in place.
SOAPboy
Posts: 8268
Joined: Sun Apr 13, 2003 7:00 am

Post by SOAPboy »

sirstrongbad wrote:it is a very interesting idea- but there are a couple questions i've got regarding the video i just watched...

1. is this tool only available for adminstrators who are spectating?

2. if it is only allowed during spectator mode, what's to stop people from hacking the code and allowing it during gameplay?

3. it detects pre-aim. i've played the maps enough to know where people like to hide. does that mean i'm hacking if i have my sights locked onto a particular corner or boxtop as i'm rounding a bend?

4. oddshot? yeah- that's one of the things this tool detected. there are so many oddshots in CS:S. i don't know why they included this.


the only good i see from this tool is the "firing through wall" and "lockbot" detection. other than that, i don't quite see the point. it will just make for some ban-happy admins.
1. Only for Spec, and Ghost
2.Dont work outside of Spec and Ghost
3. A few pre-aim warnings is nothing.. its not going to flag and ban you for a few preaims.. it bases it on "scores" , so you have to be flagged a few dozen times to get that "score" of 85%.
4. Oddshots can be hacks..
Post Reply