[SUGGESTION] Anti-Aimbot

Hello all,

Last year I created an aimbot for Nexuiz (I implemented it entirely in Darkplaces, so the same code with little modification worked for Xonotic 0.1, too). In the mean time, I've gotten records of another aimbot. I can't really say, but his was a little better than mine, I think.

Anyway, I used it in several games in HOCTF & HODM, and never got caught. Did the same in Xonotic. Personally, I was slightly surprised. Contrary to what several people have said before about Nexuiz (and by extension, Xonotic) not having a problem with cheaters... I'm inclined to think it could be.

Aimbotting exhibits some very specific behavior, that is very obvious to anyone spectating you, and I don't see why this couldn't be automagically detected by the server. Now, I haven't tried it against the latest Xonotic builds (not since last year), but I'm guessing nothing would be different.

Are there any plans for an anti-aimbot? I'm thinking probably not. Perhaps my posting this could help persuade the dev-team. I'm sure many others would appreciate it, too.

(If any project leaders would like to verify this, please PM for the source)

Sincerely,
me

To my understanding there is a way to check where players shoot on hitboxes as well as ban players completely in Xonotic, though I'm not sure how it works. As for anti-cheats, I don't think they exist for this game.

Well, we already have some preventative measures with respect to cheating and perhaps I can clear that up quickly..

First, we have entity culling: which is to say, we trim out un-seen objects from being sent to the client.. this basically makes wallhacks practically useless except for very closely around corners.. Second, we have a few checks which look for certain exploits with speedhacks and the viewangle, those which are not possible unless you're definitely trying to cheat... It looks for stuff like rotating the view too quickly in one frame or something like that, i'm not sure how that works exactly... but we've been down that road. Third, we have an anti-cheat system built into the game which looks for things like "special" cvars being set (known cvars of cheaters basically) and it also looks for client side modifications, like changing the models of players to be more visible or the like. Last, although this doesn't prevent aimbots exactly (just makes them have to be in darkplaces)-- the csqc progs have to match what the server sends, otherwise the client is sent a new csqc progs file... if it still doesn't match, the client is disconnected. This way you can't really make an "easy" aimbot in csqc.

Anyway, if you have any suggestions on how we can properly DETECT such aimbots without risk of false alarms, that would be great.

trim out un-seen objects from being sent to the client

I've seen such server-side anticheats in HL/HL2 games (written in Pawn). Quite a way to render wallhacks useless, yet they were consuming fairly big amount of CPU time due to many Line of Sight checks every frame. Plus, it's not only as easy as checking if there are any brushes in the way, you'll have to take surface material properties in account (translucency/alpha channel and so on).

although this doesn't prevent aimbots exactly (just makes them have to be in darkplaces)-- the csqc progs have to match what the server sends

I'm not really a C/QC programmer, but if I were, I'd first try just fooling the server-side part which checks genuinity of client progs.

IMO there is no need of actual anti-cheat system unless servers are full of cheaters. As long as 99,999% players are playing "legally", I think we shouldn't waste resources making working anticheat system.

Of course, if this happens, I think that system should be universal. Like the "open source PunkBuster" for open source games/indie games. Or something like that, you got the point, hopefully.

Last year I created an aimbot for Nexuiz ...

What type of aimbot and what did you use to track the other players?

This way you can't really make an "easy" aimbot in csqc.

Heh, I actually never tried to, I don't know QC, and was too lazy to learn it just for an experimental hack.
I was poking around Darkplaces when I saw cl_input.c...

Anyway, if you have any suggestions on how we can properly DETECT such aimbots without risk of false alarms, that would be great.

Well, I was thinking that the server would leave people alone. And, when it gets tripped. it just starts recording a demo of them for later review by the admin. False alarms wouldn't be much of an issue, then. But I'm not sure how much work that part alone would be.

On how to go about it: Monitor each player's aim speed and aim precision in parallel. If the speed goes high, then low right as the precision goes high, you watch for that. Now, I know many people's aim does this naturally, but there's a curve to both. If someone was aimbotting, that curve would be alot steeper. In the event of false alarms, one just needs set the curve sharpness sensitivity lower.
Granted, this is easier said than done, and I'm by no means an expert on this stuff. But I think it would work.

I noticed there's already an anti-triggerbot in the source?? I'm not sure if this is working code or not.

IMO there is no need of actual anti-cheat system unless servers are full of cheaters. As long as 99,999% players are playing "legally", I think we shouldn't waste resources making working anticheat system.

I would normally agree. But I personally think a lot more people cheat than the figure you gave ;-) I mean, this other guy, wasn't just toying with it, he was using using it. (I can post the demos if you like)

Of course, if this happens, I think that system should be universal. Like the "open source PunkBuster" for open source games/indie games. Or something like that, you got the point, hopefully.

Of course, that would be nice, but hardly needed. If someone does make one for Darkplaces or Xonotic, it being open source would enough.

What type of aimbot and what did you use to track the other players?

The client side "render" coordinates. As such, in order for it to work, you need to have client side culling enabled.
Yep, I know, dirty hack. ;-)

trim out un-seen objects from being sent to the client

I've seen such server-side anticheats in HL/HL2 games (written in Pawn). Quite a way to render wallhacks useless, yet they were consuming fairly big amount of CPU time due to many Line of Sight checks every frame. Plus, it's not only as easy as checking if there are any brushes in the way, you'll have to take surface material properties in account (translucency/alpha channel and so on).

although this doesn't prevent aimbots exactly (just makes them have to be in darkplaces)-- the csqc progs have to match what the server sends

I'm not really a C/QC programmer, but if I were, I'd first try just fooling the server-side part which checks genuinity of client progs.

The entity culling is actually quite sloppy, this is why it doesn't take up very much resources. It works well, but e.g. only updates once every second. This is why you can see players around corners with wallhacks for a very brief amount of time. Anyway, it's MOSTLY good and requires much lower resources than such a trace for every entity so often like those checks you referred to.

Also, it's quite difficult to get around that... you really have to modify the engine a lot to do that in fact.

Most weapons in Xonotic are non-hitscan weapons, which makes aimbot useless

Why did you revive a thread from nearly three years ago to say that, zwz? I might remove that post to take it back down the list.