Aimbot module
 

I have moved the aimbot module discussion into it's own thread.

Re: Feeback SMAC r107/r115
 

My results in 2 days test the aimbot, I attached the file smac.log

Re: Feeback SMAC r107/r115
 

Were you able to confirm if any of them were aimbotting?

Edit: One guy had it trigger 3 times at once. Must be a nade kill or something. Might be a bug.

Re: Feeback SMAC r107/r115
 

No, some of which have been detected are regulars on the server, others I do not know.

Re: Feeback SMAC r107/r115
 

example from our server:

L 05/24/2011 - 19:07:08: p!nK.LaMa (ID: STEAM_0:1:12906641 | IP: XXXXXXXXXXX) is suspected of having an aimbot (156 degree snap)
L 05/24/2011 - 19:07:35: p!nK.LaMa (ID: STEAM_0:1:12906641 | IP: XXXXXXXXXXX) is suspected of having an aimbot (155 degree snap)
L 05/24/2011 - 19:08:22: p!nK.LaMa (ID: STEAM_0:1:12906641 | IP: XXXXXXXXXXX) is suspected of having an aimbot (156 degree snap)
L 05/24/2011 - 19:11:21: p!nK.LaMa (ID: STEAM_0:1:12906641 | IP: XXXXXXXXXXX) is suspected of having an aimbot (149 degree snap)
L 05/24/2011 - 19:12:03: p!nK.LaMa (ID: STEAM_0:1:12906641 | IP: XXXXXXXXXXX) is suspected of having an aimbot (149 degree snap)
L 05/24/2011 - 19:12:15: p!nK.LaMa (ID: STEAM_0:1:12906641 | IP: XXXXXXXXXXX) is suspected of having an aimbot (149 degree snap)
L 05/24/2011 - 19:12:17: p!nK.LaMa (ID: STEAM_0:1:12906641 | IP: XXXXXXXXXXX) is suspected of having an aimbot (149 degree snap)
L 05/24/2011 - 19:12:20: p!nK.LaMa (ID: STEAM_0:1:12906641 | IP: XXXXXXXXXXX) is suspected of having an aimbot (149 degree snap)
L 05/24/2011 - 19:12:23: p!nK.LaMa (ID: STEAM_0:1:12906641 | IP: XXXXXXXXXXX) is suspected of having an aimbot (149 degree snap)
L 05/24/2011 - 19:12:44: p!nK.LaMa (ID: STEAM_0:1:12906641 | IP: XXXXXXXXXXX) is suspected of having an aimbot (149 degree snap)

This Player was using an real Aimbot and many more players are detected!

Re: Feeback SMAC r107/r115
 

For me the one who made ​​the biggest impact is:

Are there really aimbot? I do not know i was not there to see ...

If you can say what you think.

Re: Feeback SMAC r107/r115
 

Yea, I get 1 to 3 detections randomly on some people but when there is a real aimbotter, Ill have like 15 lines altogether of that single person.

Re: Feeback SMAC r107/r115
 

The Player use a Aimbot! The Demo can be Downloaded here:

http://sourceban.team-wb.de/getdemo.php?type=B&id=18395

Re: Feeback SMAC r107/r115
 

Another example:

L 05/24/2011 - 00:33:42: RAMPAGING BULL >_< (ID: STEAM_0:1:33863687 | IP: XXXXXXXXXXXX) is suspected of having an aimbot (91 degree snap)
L 05/24/2011 - 00:49:19: RAMPAGING BULL >_< (ID: STEAM_0:1:33863687 | IP: XXXXXXXXXXXX) is suspected of having an aimbot (60 degree snap)
L 05/24/2011 - 01:06:09: RAMPAGING BULL >_< (ID: STEAM_0:1:33863687 | IP: XXXXXXXXXXXX) is suspected of having an aimbot (86 degree snap)
L 05/24/2011 - 01:11:33: RAMPAGING BULL >_< (ID: STEAM_0:1:33863687 | IP: XXXXXXXXXXXX) is suspected of having an aimbot (82 degree snap)
L 05/24/2011 - 01:11:35: RAMPAGING BULL >_< (ID: STEAM_0:1:33863687 | IP: XXXXXXXXXXXX) is suspected of having an aimbot (87 degree snap)

Demo can be Downloaded here:

http://sourceban.team-wb.de/getdemo.php?type=B&id=18389

Re: Feeback SMAC r107/r115
 

Yes I believe you, you seen to be on the ^^

So through these examples we see how an aimbot can be detected with several lines of detection over a period of time

Re: Feeback SMAC r107/r115
 

^^ I hope I could help a bit with these examples

Re: Feeback SMAC r107/r115
 

Thanks for all of the reports! I think 10 detections and then a ban is an appropriate number. Should this value be controlled with a Cvar? It might not be initially but can be added if requested.

Do you prefer if we keep the warnings/logs in there as well? Or should they be removed?

That person was most likely aimbotting. A Google search of his SteamID shows he is on several banlists for cheating.

Re: Feeback SMAC r107/r115
 

Logs should be left to look may be able to whether this ban is justified or not

Re: Feeback SMAC r107/r115
 

Yes you are right

We must let the logs enabled for detection, it will allow us to better monitor our servers and thus can be relate to another possible connection aimbot. The number of detections for the ban of the player who aimbot should be adjustable through a cvar.

Re: Feeback SMAC r107/r115
 

The Next Players are detected for using Aimbot ^^!
The Scan/Log works very nice

Re: Feeback SMAC r107/r115
 

An auto-ban ConVar was added in r125. A new translatable phrase was also added which is shown to admins in chat for every detection.

Re: Feeback SMAC r107/r115
 

You may also want to limit the snap for an auto ban.

If you notice not only are there more logs for actual aimbots the snaps on them are much larger.

So maybe something like over X longs in Y time with snaps over Z value get auto bans. This will remove most obvious aimbots while lower values will be sent to admins for suspicion. Also I think there should be a warring level before sending to admins to prevent over zealous admins from freaking out. Something like what I said for auto ban but with lower thresholds.

Obviously the goal is to detect aimbots without causing false positives. Sometimes you even need to be careful what you tell the admins b/c they might overreact.

Re: Feeback SMAC r107/r115
 

I was just thinking about this. Have a confidence levels. If the client snaps 5 times greater then 40° (Random Variables here), either auto ban or inform an admin that there's a potential hacker.

If a client snaps 5/7 times, Confidence would be 71.5% (Could also get 'normal' snaps and compare, adding that into the equation would be excellent).

Re: Feeback SMAC r107/r115
 

French Translation :

Re: Feeback SMAC r107/r115
 

Big reply coming up. Please note that I'm completely open to new ideas and coming up with the best formula, but I just want to make sure that everyone understands how it already works.

Right now only snaps over 45° are counted as a detection. Is this what you mean?

While it's true that there are usually more logs for real aimbots, the snaps aren't always much larger than the 45° restriction in place.

Take a look at my log as an example (names and IDs removed): http://pastebin.com/ivfTYvDJ

Players 1, 3, and 4 are using aimbots. Player 3 has the most obvious one with rediculous angles on every kill, but Player 1 only slightly goes over 45° on many kills. Player 4 only had 3 detections, but the warnings were enough to have an admin spectate him and make the decision to ban.

I believe this is the method already being used. 10 detections (default value) of over 45° on the same map would lead to an auto-ban.

I agree with this and I think some admins would freak out when the warning shows up and they don't fully understand it. Maybe the warning should only show on the second detection and onward? Most false positives are only given one detection and nothing else. Other than that I think it's a good idea for the admin to check the player to make sure nothing suspicious is happening (as shown with Player 4 in my previous example).

I originally thought of using confidence and %, but the decision came down to what I thought admins could understand more. Showing a percentage value may be a little obscure compared to the number of detections and the degree of snap. At least then the admin knows what they are dealing with. What do you think would work best?

Added, thanks.

Re: Feeback SMAC r107/r115
 

"SMAC_AIMBOTDETECTED"
{
"fr" "[SMAC] {1} utilise probablement un Aimbot. (Détection #{2}) (Angle/Déviation: {3}°)"
}

But act as you like...
Have a nice day !

Re: Feeback SMAC r107/r115
 

I can't comment on the French, but "deviation" is probably a better word than "snap" for English as well.

Re: Feeback SMAC r107/r115
 

L 05/26/2011 - 15:51:10: (ID: STEAM_0:0:399**** | IP: *****) is suspected of having an aimbot (81 degree snap)

However, according to statistics, this player has never killed anyone.

Kills 0 Death 8



Do you think that means?

Re: Feeback SMAC r107/r115
 

I think he must no killed everyone, because as think shows the log just the extreme motion of the opposing players to hitbox!

Re: Feeback SMAC r107/r115
 

ok no worries, you can make the change on the "Deviation"
the start of translation is very good.

Re: Feeback SMAC r107/r115
 

It's amusing how it accuses my admins of cheating. It also accused me of cheating a few times with the aimbot detection module. lol

Re: Feeback SMAC r107/r115
 

He must have killed someone because his name was in the player_death event. His score could have changed for a number of reasons. What type of log is that from?

In r131 I've changed it to ignore the first detection. This will take care of that issue for the majority of the time.

Re: Feeback SMAC r107/r115
 

I think that giving admins the angle, number of detections and confidence level would be best so that they are equipped with as much information as possible. Ideally there would be a way to configure how the confidence is determined so that servers can customize the sensitivity. In addition there should be an option to auto ban if confidence level passes 100%

Re: Feeback SMAC r107/r115
 

Feeback r132 :

Hello, today I had an aimbot on my server:

I find that detection is not efficient enough, I find it is not sensitive enough. It took a while for it to be banned by the voteban players. Meanwhile there were only 3 detections on a player as above.

Re: Feeback SMAC r107/r115
 

So with the new ban cvar to ban the aimbotters in r132, how is the number of detectioins based?

Like by connection, by map, by day, etc?

Re: Feeback SMAC r107/r115
 

I'll see if I can come up with a good formula for a confidence percentage.

What is your smac_aimbot_ban cvar set to? If it was set to 4 (minimum allowed) then that player would have been automatically banned. The default is 10.

It's based on connection. That also means it resets on map changes too.

Re: Feeback SMAC r107/r115
 

I am just wondering on the compatibility of the aimbot module with Garry's mod?

I have had it enabled on 3 servers (Which I would say each average 16 players 24/7) for over 24 hours and I have not had one person being flagged.

I would hope that we have banned the majority of the cheaters already through a LUA-based anti-cheat but not to get any false-positives (or real detections) does not seem right.

Another question is, does the shot need to be a kill in-order to be considered for the aimbot detection routine?

Re: Feeback SMAC r107/r115
 

I put it by default to 10

So I'll put it to 3...

Re: Feeback SMAC r107/r115
 

Is anyone else experiencing a little jittery/glitching using the latest SMAC? I'm not sure if its aimbot + spinhack detection but I disable both for it to get less jittery to the server.

Re: Feeback SMAC r107/r115
 

It should work on any mod where cheaters use an obvious type of aimbot. Obvious meaning that a player (using a cheat) could spin around and instantly kill another player in one shot.

Yes, the player is only analyzed after a kill shot.

How many slots is your server running? Is it running at the default 66 tick?

If you're not using the anti-wallhack then it's the aimbot module and the slower ADT arrays.

Edit: Updated in r134. Performance was greatly improved.

Re: Aimbot module
 

Server has 32 slots but its pretty new so we usually only get about 10 players for now. Yeah we have anti-wallhack, smoke, and flash OFF. We only have speedhack, aimbot, and the basics checkup of cvars and protection wise ON.
Its an Deathmatch server incase you needed to know too. And thats why had smoke and flash OFF since unnecessary.

Great to hear. Will test the new update. :)

EDIT: Tested new update, definitely the performance got improved greatly. Thanks. Will report anything else I notice.

Re: Aimbot module
 

Hello, plugin is very helpful, but on some servers i have some troubles: it generates positives while player kills other players with knife I think it's not important to registry knife kills. Default angles is to big I think best angles are between 10-20. (I changed that to 10 and i don't see many false positives)
P.S. Sorry for my English. :(

Re: Aimbot module
 

In the past I had some skill and I used to play with mouse acceleration (wich was set by default under windows XP). I could kill someone in my back just after hearing a step or after he fires only 1 bullets, I was doing 180° spin with a perfect flick shot in head. It would have been detected as aim bot ?

I'm not able to do this anymore cause I don't use Mouse acceleration anymore and I'm not skilled as I used to be, but I remember i was doing it pretty often.

And now Aimbot are way more designed than they use to be, when you look at source TV if he uses it well you couldn't tell if he's a legit player or a cheater, even if you're behind him while he's playing. If his crosshair is near his target, the aimbot will just correct slightly the trajectory to the head and it will look like it's a totaly legitimate shot...

So a legit player who plays with very high sens / mouse acceleration could be detected more often than the one who uses advanced aim bots ?

Re: Aimbot module
 

I didn't want to make this mod specific, but I suppose I could have a list of weapons to ignore from any mod.

From my testing it was very possible to get a 10-20 degree difference on a legitimate kill. 45 may be a bit generous but it still generates the odd false positive so I haven't changed it. 35-40 is probably the lowest you should go.

This should not be detected as an aimbot because your mouse doesn't instantly skip its angle around 180°.

This isn't meant to catch those advanced aimbots. Only the more obvious ones that the majority of cheaters seem to be using in public servers.

Re: Aimbot module
 

I meant to add weapon_knife to ignore list for aimbot module.

Firstly, for test, server owner set this value to 5. We got only 2 bans with 42 players. Then we changed it to 10 and have one ban to player who had big packet loss and finaly we had set this to 15 and don't have any false-positives with any weapon, except knife.

And we got another bug: while player suicide it generates false-positives. Tested with bots.