[freak.exe_uLow]

Originally Posted by AcidCat Hi! First, I want to thank J_Tanzanite for this project, it's a really cool and helpful plugin! I have a problem with 1.7.0 beta version. I have created my tf2 server a week ago and started to test it. I wanted to test Interp Exploit Kicker. It's correctly detect interp abuse: lilac.log: ... 2021/04/18 22:53:56 [Version 1.7.0-Dev 14] {Name: "Acid Cat [test]" | SteamID: STEAM_0:0:55657362 | IP: 176.193.49.120} was kicked for exploiting interpolation (500.000ms / 105ms max). But it's not kicking me from a server. I can steel play, disconnect and connect again. (I should have no immunity because i have configured sourcemod admin with username and password auth method. And i set different steam username before testing) In sourcemod error log there are errors: L 04/18/2021 - 22:28:58: SourceMod error session started L 04/18/2021 - 22:28:58: Info (map "pl_pier") (file "/home/parsee/hlserver/tf/addons/sourcemod/logs/errors_20210418.log") L 04/18/2021 - 22:28:58: [SM] Fatal error encountered parsing translation file "lilac.phrases.txt" L 04/18/2021 - 22:28:58: [SM] Error (line 0, column 0): Stream failed to open L 04/18/2021 - 22:30:36: [SM] Exception reported: Language phrase "kick_interp_exploit" not found (arg 5) L 04/18/2021 - 22:30:36: [SM] Blaming: littleanticheat/plugins/lilac.smx L 04/18/2021 - 22:30:36: [SM] Call stack trace: L 04/18/2021 - 22:30:36: [SM] [0] KickClient L 04/18/2021 - 22:30:36: [SM] [1] Line 96, lilac/lilac_lerp.sp::detected_lerp_exploit L 04/18/2021 - 22:30:36: [SM] [2] Line 63, lilac/lilac_lerp.sp::timer_check_lerp L 04/18/2021 - 22:30:41: [SM] Exception reported: Language phrase "kick_interp_exploit" not found (arg 5)

apparently you forgot to upload you the latest 1.7.0 14 version translation: https://github.com/J-Tanzanite/Littl...hrases.txt#L14

[AcidCat]

Originally Posted by freak.exe_uLow apparently you forgot to upload you the latest 1.7.0 14 version translation: https://github.com/J-Tanzanite/Littl...hrases.txt#L14

It works now. Thank you!

[romanum]

Hello, I have the following question:

Is it just me or does this plugin have a lot of false positives in CS:GO. I managed to trigger an aimbot detection on four different occasions and I just always wondered why or what precisely triggers this ban, since banning legit players doesn't really look all that good for your plugin.

I'm hoping to get some sort of reply / explanation.

Thank you in advance.

[OneMore]

Originally Posted by romanum ... to trigger an aimbot detection on four different occasions ...

As I understand you, it is just triggered detection, but not banned you. You need to worry if it bans you false positive, right?

[J_Tanzanite]

Originally Posted by romanum Hello, I have the following question: Is it just me or does this plugin have a lot of false positives in CS:GO. I managed to trigger an aimbot detection on four different occasions and I just always wondered why or what precisely triggers this ban, since banning legit players doesn't really look all that good for your plugin. I'm hoping to get some sort of reply / explanation. Thank you in advance.

People rarely report issues with the aimbot detection, but when they do, it's usually about the autoshoot detection.
You can read more about it here: https://forums.alliedmods.net/showpo...&postcount=284

But in order for me to help you, I would need to know what version of Lilac you are using.
And if you're running a community made map and if you're using plugins that teleport players around, those are also important.

But most of all, the detection log would help a lot.
Note: if you share the detection log, please don't share IPs.
Remove IPs in the log before sharing, thank you.

[pedrotski]

Version 1.7 possible false detection?

2021/04/25 20:48:17 [Version 1.7.0-Dev 12] {Name: "Niko⚝ | ghostcap.com" | SteamID: STEAM_1:1:526518372 | IP: 103.xxx.xxx.xxx} is suspected of using an aimlock (Detection: 3). 2021/04/25 20:49:14 [Version 1.7.0-Dev 12] {Name: "Niko⚝ | ghostcap.com" | SteamID: STEAM_1:1:526518372 | IP: 103.xxx.xxx.xxx} is suspected of using an aimlock (Detection: 4). 2021/04/25 20:50:18 [Version 1.7.0-Dev 12] {Name: "Niko⚝ | ghostcap.com" | SteamID: STEAM_1:1:526518372 | IP: 103.xxx.xxx.xxx} is suspected of using an aimlock (Detection: 5). 2021/04/25 20:57:19 [Version 1.7.0-Dev 12] {Name: "Niko⚝ | ghostcap.com" | SteamID: STEAM_1:1:526518372 | IP: 103.xxx.xxx.xxx} is suspected of using an aimlock (Detection: 4). 2021/04/25 20:575 [Version 1.7.0-Dev 12] {Name: "Niko⚝ | ghostcap.com" | SteamID: STEAM_1:1:526518372 | IP: 103.xxx.xxx.xxx} is suspected of using an aimlock (Detection: 5). 2021/04/25 20:57:56 [Version 1.7.0-Dev 12] {Name: "Niko⚝ | ghostcap.com" | SteamID: STEAM_1:1:526518372 | IP: 103.xxx.xxx.xxx} is suspected of using an aimlock (Detection: 6). 2021/04/25 20:58:19 [Version 1.7.0-Dev 12] {Name: "Niko⚝ | ghostcap.com" | SteamID: STEAM_1:1:526518372 | IP: 103.xxx.xxx.xxx} is suspected of using an aimlock (Detection: 6). 2021/04/25 20:583 [Version 1.7.0-Dev 12] {Name: "Niko⚝ | ghostcap.com" | SteamID: STEAM_1:1:526518372 | IP: 103.xxx.xxx.xxx} is suspected of using an aimlock (Detection: 7). 2021/04/25 20:58:56 [Version 1.7.0-Dev 12] {Name: "Niko⚝ | ghostcap.com" | SteamID: STEAM_1:1:526518372 | IP: 103.xxx.xxx.xxx} is suspected of using an aimlock (Detection: . 2021/04/25 20:591 [Version 1.7.0-Dev 12] {Name: "Niko⚝ | ghostcap.com" | SteamID: STEAM_1:1:526518372 | IP: 103.xxx.xxx.xxx} is suspected of using an aimlock (Detection: . 2021/04/25 20:59:57 [Version 1.7.0-Dev 12] {Name: "Niko⚝ | ghostcap.com" | SteamID: STEAM_1:1:526518372 | IP: 103.xxx.xxx.xxx} is suspected of using an aimlock (Detection: 9). 2021/04/25 21:00:23 [Version 1.7.0-Dev 12] {Name: "Niko⚝ | ghostcap.com" | SteamID: STEAM_1:1:526518372 | IP: 103.xxx.xxx.xxx} is suspected of using an aimlock (Detection: 9). 2021/04/25 21:00:41 [Version 1.7.0-Dev 12] {Name: "Niko⚝ | ghostcap.com" | SteamID: STEAM_1:1:526518372 | IP: 103.xxx.xxx.xxx} is suspected of using an aimlock (Detection: 10). 2021/04/25 21:00:41 [Version 1.7.0-Dev 12] {Name: "Niko⚝ | ghostcap.com" | SteamID: STEAM_1:1:526518372 | IP: 103.xxx.xxx.xxx} was banned for Aimlock. Pos={-1439,-7621,0}, Angles={0.56899,1.68862,0.00000}, Map="de_mirage", Team={3}, Weapon="weapon_deagle", Latency={Inc:0.000029,Out:0.053602}, Loss={Inc:0.000000,Out:0.000000}, Choke={Inc:0.000000,Out:0.000000}, ConnectionTime={1196.999267 seconds}, GameTime={2739.703125 seconds}

Here is what the player said in his ban appeal you can read here (he also uploads a video to show his aim): https://forums.ghostcap.com/topic/29...lock-detected/

So we got bored and at that time we were waiting for other players to join GCL so we can start the game. so because puro is afk and im bored as well, i was shooting puro bunch of times on the head until i got 100 kills (his afk and not moving at all) suddenly i got disconnected and it said im using aimbot

[freak.exe_uLow]

Originally Posted by pedrotski Version 1.7 possible false detection? Here is what the player said in his ban appeal you can read here (he also uploads a video to show his aim): https://forums.ghostcap.com/topic/29...lock-detected/

I think the person is lying, 1 year account + Level 2 + not many hours in csgo and the video what he send would not be a prove for me. You can also use AntiDLL with Lilac (highly recommended), users who join with a DLL that has some hacks will be banned immediately. Currently not all, there are also cheats that are loaded differently, but I would recommend you to use it with Lilac

AntiDLL: https://github.com/JDW1337/AntiDLL/releases

[pedrotski]

Originally Posted by freak.exe_uLow I think the person is lying, 1 year account + Level 2 + not many hours in csgo and the video what he send would not be a prove for me. You can also use AntiDLL with Lilac (highly recommended), users who join with a DLL that has some hacks will be banned immediately. Currently not all, there are also cheats that are loaded differently, but I would recommend you to use it with Lilac AntiDLL: https://github.com/JDW1337/AntiDLL/releases

We already run this on all our servers.

The part that throws me off is farming someone AFK in warmup. Its very easy to snap to someone like that. You will also notice the detections expiring. It wasn't every time. But its fast enough to kill someone in Warm up on a comp server and kill them again within a few seconds.

[Ryan2]

Originally Posted by pedrotski We already run this on all our servers. The part that throws me off is farming someone AFK in warmup. Its very easy to snap to someone like that. You will also notice the detections expiring. It wasn't every time. But its fast enough to kill someone in Warm up on a comp server and kill them again within a few seconds.

This is a good point. Maybe LAC can have an option to not detect kills during warmup mode or something of that nature.

[J_Tanzanite]

Originally Posted by pedrotski Version 1.7 possible false detection? Here is what the player said in his ban appeal you can read here (he also uploads a video to show his aim): https://forums.ghostcap.com/topic/29...lock-detected/

Long post incoming, even if we find out this is a bug, I still would like to say these things in case they come up in the future so that I can just link to this post.

Sorry to say this, but video "evidence" is mostly useless (I know some people will fight me over this, but hear me out).
There's only one case where it has actual value:
1. The recording is of the player while they are getting banned.
2. Cheats are clearly visible.
If those two criteria are met, then you can be reasonably sure the player was cheating.

However, if this was the situation:
1. The recording is of the player while they are getting banned.
2. No cheats are visible.
That wouldn't prove the player is innocent...
There are cheat features that don't show up on video.
Wallhacks would be obvious if the recording is from a camera.
But if it's a game-recording or a screen-recording, then it would be useless as some cheats have "Anti-OBS"; which lets the cheater have wallhacks without the recording software being able to pick it up.
As for aimbot... There are humanized aimbots out there that slightly assist you when aiming.
They look legit and you wouldn't be able to tell a good player apart from a cheater.
So cheats not being visible in a recording of a player who is getting banned, is... Not proof of innocence... What do you think LAN cheats are for?


So video evidence can only prove (or at least make you very certain of it) that someone is cheating, it can't always prove innocence in these cases.


However, this video isn't of him while he is getting banned.
This video is of him playing *after* having been banned, to show his skill (which is also irrelevant).
Any cheater could record themselves without cheats *after* having been banned, that wouldn't prove that they were legit earlier.
It's fine that he wants to prove his innocence, and I can understand why that's a hard thing to do.
But this video can't be used against or for his case.



Now, as for the aimlock detection.
Aimbot isn't the only thing that can trigger an aimlock detection.
This may sound weird, but in some cases, anti-aim / desync can trigger aimlock detections.
Why is that?

Well, because some anti-aims / desync-methods are technically "snapping" a player's aim to different places, BUT, they are hiding it.
In most source games, you can hide these kinds of things with bsendpacket, I think in CS:GO a different method is used.
Either way, if those snaps happen to look in the direction of the player, that technically counts as an aimsnap.

Some Desync methods and Anti-Aim don't show up on demos; And like with silent-aim - wouldn't show up on the screen of the cheater.



The criteria for getting an aimlock detection is also pretty strict.
Here's what you have to do to get a single aimlock detection:
1. Be further than 300 hammer units away from all enemy players (If you are close to an enemy, you won't get tested).
2. The player's aim must change by 20 degrees or more between two ticks.
3. The aim distance to a player must suddenly shrink by over 90%.
4. The aim must stay on the target for 0.1 seconds (dead stop).
This is already pretty strict...
But it gets better, because this has to happen twice within 3 minutes to get 1 aimlock detection.
...
To add to this already strict requirement...
In order to get banned for this, you have to get 5-10 detections... Within 10 minutes; because aimlock detections expires after 10 minutes.



I'm not saying that he was 100% cheating, I can't know for sure.
But unless he can give steps to reproduce the bug - then it likely isn't a bug, and he was cheating.
It's possible you found a rare bug, or only a specific combination of events can cause it (whether they are unusual or not), in which case I would love to help nail down what it is so it can get fixed.
But I would need reproducible steps.


A few days ago, I did find out that some players use this script to do 180 degree turns while shooting: https://www.youtube.com/watch?v=HYu_k-JGy60
... Which I answered here: https://github.com/J-Tanzanite/Littl...heat/issues/84
TL;DR: If you use scripts or have to go out of your way to do something that is normally impossible - then you're basically asking for a ban.

However, I highly doubt he did this. So had he used it, then he probably would have mentioned it.



There is one more thing I can think of that might cause this.
Are you using a plugin that teleports players?



Edit while making this loooong post:
I was so slow to write all this, that several replies have been posted already... Meaning I now have to catch up

Regarding AFK farming, if you can consistently snap to someone (considering the requirements I posted above) and trigger this, then maybe some tweaking is needed... It would be pretty weird tho that it wouldn't also be logged as an aimbot detection (Aimbot and Aimlock show up as two different detections)... Still not impossible.

I've tried to do this before, and wasn't able to do it, anyone else who can reproduce it?
... Also, wasn't there an update to CS:GO that added small arena warmup rooms?
If you can re-create the detections, then that would help greatly

The thing that would surprise me about that, is that the min distance check of 300 units... That's longer than you think, and I don't think the small arena warmups in CS:GO are that big? So would be interesting to get feedback about that.