[endeffects]

Advanced Wallhack Detector v1.5.1

This is an advanced wallhack detector which counts the wallkills and wallaims per round
and judges the suspected cheater with a given methode if this happens on multiple rounds. It also informs the connected admins about these players in chat.

Basicly this methode is super simple but beleave me it works. No skilled players get constantly
wallkills (kills thru walls) and/or wallaims (direct aimings on enemies behind walls) for rounds.
Leave it running in logmod and you'll see that it's true.

The plugin also supports a HLTV server to automaticly record demos of the suspected players
who are close to a defined punishment. Note: You need to have access to a HLTV server.
If your server supports steambans.com you can upload the recorded demos there.


You can find a great up to date cheater ban list here:
http://www.shoot-em.com/forum/cheater-banlist-t1334.html

A wonderfull aimbot detection plugin:
http://forums.alliedmods.net/showthread.php?t=77821

Nice plugin to record HLTV demos:
http://forums.alliedmods.net/showthread.php?t=66506

Anti-Wallhack solutions (under contruction):
http://forums.alliedmods.net/showthread.php?t=82111&page=5
http://forums.alliedmods.net/showthread.php?t=70083


The Settings

WALLHACK_MAX_KILLS - number of wallkills per spawn to count it as wallkill round (default 2)
WALLHACK_MAX_KILL_ROUNDS - number of wallkill rounds which results in a given punishment (default 4)
WALLHACK_KILLS_EXPIRE - the time when a wallkill detection expires (default 1200s = 20min)

WALLHACK_MAX_AIMS - number of wallaims per spawn to count it as wallaim round, it remembers the last target to prevent double counts (default 8 )
WALLHACK_MAX_AIM_ROUNDS number of wallaim rounds which results in a given punishment (default 4)
WALLHACK_AIMS_EXPIRE - the time when a wallaim detection expires (default 1200s = 20min)

PUNISHMENT - defines the judgements for the player (KICK_ONLY, KICK_AND_BANID, KICK_AND_BANIP, KICK_AND_AMXBAN, LOG_ONLY)

Attention: Before you activate any ban option use the log methode before. it's much better to check first
how many detections you get on your server. also verifiy these detections with google by crawling for the steam ids.

USE_HLTV - uncomment to enable HLTV support (default disabled)
HLTV_IP - HLTV server IP (default 127.0.0.1)
HLTV_PORT - HLTV server port (default 27020)
HLTV_RECTIME - record time of your demos (default 300)
HLTV_DELAY - HLTV delay, should be 0 for working demo-link (default 0)
HLTV_RCONPW - HLTV rcon password (default password)
HLTV_NAME - HLTV connect name (default Player)

Note: You should add the HLTV server to your user.ini, so you can record demos still if your game server is full, i.e.:
"127.0.0.1" "" "ab" "de"
You need to uncomment "adminslots.amxx" in your plugins.ini and set "amx_reservation 1" in your amxx.cfg.


The Log File

You'll find the wallhackdetections.log in your amxmodx log directory.
This file contains the following information:
[12/22/08] [00:52:24] [DEMO] [Suspected] casper DK [0 WallKills] [11 WallAims] [2/4] [STEAM_0:1:1234567] [87.55.75.20] [cs_assault]
[12/22/08] [01:03:24] [Detected] manq [Virgin] [3 WallKills] [6 WallAims] [27/2] [STEAM_0:0:1234567] [88.114.37.98] [cs_assault]

Every [Suspected] entry means that somebody had at least a specified number of wallkills OR wallaims within the same round (spawn). You can define these numbers within the source by changing the values for WALLHACK_MAX_KILLS and WALLHACK_MAX_AIMS.

Every [Detected] entry means that somebody reached the WALLHACK_MAX_KILLS or WALLHACK_MAX_AIMS on multiple rounds. You can define the number of rounds within the source by changing the values for WALLHACK_MAX_KILL_ROUNDS and WALLHACK_MAX_AIM_ROUNDS. If one of these values will be reached the defined punishment will be rised.

Every [Demo] entry means that your hltv server recorded a demo for the specific player.

Every [Virgin] entry means that somebody created his steam account in June 2008 or later.

The entries behind the wallaim counts are the [frags/deaths] stats.

You'll see that most players never get reported as "suspected" twice within the same map. For all repeating
entries you should crawl on google for there steam ids or watch them in spectator. In most cases you catched a cheater!

Note: 1-4 wallaims and 1-3 wallkills per round are normal, everything above that on multiple rounds is suspicious.


Command Line

To record a demo from command line open your console and write "amx_record #1234" where 1234 is a user id
you can find by typing status. To add the demo recorder to your amxmodx admin menu open your "clcmds.ini" and add the following line:
"HLTV Demo Recorder" "amx_record #%userid%" "b" "u"

Credits go out for XxAvalanchexX, Bugsy, danialkza, |PJ| Shorty, Alka, SAMURAI and Bugsy for some basic code snipes.

A BIG thanks to Avalanche and Bugsy for there advanced help.

Btw, I don't know why, but sometimes the forum webcompiler don't works.
You can use an other webcompiler or a local compiler instead:

http://webcomp.ak-team.com/
http://www.amxmodx.org/downloads.php (AMX MODX Studio)

If you like the plugin please give me a bad karma.
.

[Exolent[jNr]]

1. Just because players get wall kills, doesn't mean you should expect that player to be cheating.

2. Most wallhackers don't just shoot through walls at people. They follow players through the walls, then shoot once they are visible.

[endeffects]

i don't say it helps to identify every cheater.

this plugin was made for public servers were most
of the players are not skilled enough to know aimspots
and things like that. also you can fine tune it by changing
the basic settings. which is required if you have some respawn
methodes running, long rounds, many slots, many skilled players and so on.

and by the way, the plugin was made to judge offensive playing
cheaters, such rambos who getting every kill thru walls.

from my point of view these guys are the major problem
and it is required to stop them when no admin is available.

[endeffects]

oh one more point, you don't need to activate a punishment (default setting).
you can just log them and you'll see after a few days on which guys you better keep an eye on.

[SnoW]

Ye, still you shouldn't double post, edit your old message. Didn't say this plugin isn't useful, still I would use it to detect pro players and give them rewards...

[endeffects]

sure this would be the best solution,
but nobody was able to build it over the last 9 years.

well, hlguard is able to do it, it blocks pakets to prevent wallhacks,
but for the sad outdated code you earn lags and high pings.
it's pretty bad that the hlguard author never released the source codes
and that all his websites are going down now.

by the way, one forum member tried something similar:
http://forums.alliedmods.net/showthread.php?t=70083

but he stucks with it.

[endeffects]

i have made some updates to the plugin.

by the way, if you running a public server you
should crawl for the detected steam ids on google.

you'll be surprised =)

i have a few 32 slot servers which are almost full
and i got some nice detections over the last hours.
most of these steam ids were banned on other servers
for wallhacking too and the rest belongs to brand new 2008 accounts

pwnd!

[Plug me up]

Originally Posted by endeffects well, hlguard is able to do it, it blocks pakets to prevent wallhacks, but for the sad outdated code you earn lags and high pings. it's pretty bad that the hlguard author never released the source codes and that all his websites are going down now.

im pretty sure that hlguard is open source now...
but it seems that the official site is off now (http://www.thezproject.org)

[endeffects]

hmm i did't found any sources in the past.

by the way please update to version 0.6 or higher,
there were some important bug fixes.

[Contrenature]

Sorry, but that plugin, don`t needed, cose must players have big skill,
and killing to walls not effective...

I think need plugin, who can scan that cheat versions, exe, or some like that:

Example: RHLG Detects...