Raised This Month: $10 Target: $400
 2% 

[ANY] Little Anti-Cheat


Post New Thread Reply   
 
Thread Tools Display Modes
Author
J_Tanzanite
Senior Member
Join Date: Aug 2018
Location: Norway
Plugin ID:
6943
Plugin Version:
1.7.1
Plugin Category:
Server Management
Plugin Game:
Any
Plugin Dependencies:
    Servers with this Plugin:
     
    Plugin Description:
    A simplistic Anti-Cheat for source games
    Old 02-12-2020 , 20:05   [ANY] Little Anti-Cheat
    Reply With Quote #1

    Little Anti-Cheat 1.7.1

    Description:
    This is a simplistic Anti-Cheat for sourcegames, which will catch some cheaters/hackers (not all).
    Little Anti-Cheat also patches some exploits.

    Lilac is compatible with Sourcemod Anti-Cheat and will not conflict with it.
    That said, there are some notes about SMAC later on that you should read if you have SMAC installed.

    Lilac comes with Sourcebans++ support out of the box.
    It is not required for Lilac to run, you can use Little Anti-Cheat without it.

    Supported Games:
    • Team Fortress 2
    • Counter-Strike:Global Offensive
    • Counter-Strike:Source
    • Day of Defeat: Source
    • Left 4 Dead 2
    • Left 4 Dead 1

    Untested games, but should work in:
    • Half-Life 2 : DeathMatch


    Features:
    • Angle Cheat detector (Detects basic angle exploits used by cheats, like Pitch AA, Legit Anti-Backstab and Duckspeed).
    • Chat Clear Detector (Detects when cheaters clear the chat).
    • Basic ConVar checker (Checks clients for invalid ConVars, like sv_cheats).
    • NoLerp Detector (Detects invalid interpolation, done by some cheats to get higher aimbot accuracy).
    • Bhop Detector (Detects perfect bunny hops, shouldn't detect legit scripts or AHK).
    • Basic Aimbot detector (Doesn't detect all aimbots, but some. Also detects projectile aimbots).
    • AimLock Detector (Detects constant aimsnaping onto targets).
    • Anti-Duck-Delay/FastDuck (CS:GO only, detects duck delay bypass).
    • Newlines in names (Some cheaters do this in TF2).

    Extra Features:
    • Angle Cheat Patch (Patches angle-cheats. Also prevents console getting spammed).
    • Backtrack Patch (Disabled by default).
    • FakeLatency/High ping kicker (Disabled by default).
    • Interp Exploit Kicker (Kicks players trying to abuse interp to get easy facestabs (cl_interp 0.5)).
    • Macro detector (Disabled by default).
    • Chat Filter (Prevents invalid UTF-8 characters and wide character spam (Bismillah)).
    • Name Filter (Prevents illegal characters in name, wide characters are fine tho).


    Important Notice!
    I highly recommend re-generating the config file if you've used version 1.6.3 or earlier!
    The config file will be generated here: cfg/sourcemod/lilac_config.cfg

    The reason for this is that the default value for some ConVars have changed.
    And several new ConVars have been added, which don't automatically get added to the Config file.

    I also heavily suggest people enable the Backtrack patch.
    It is disabled by default, for SMAC compatibility (eye_test module).
    However, if you aren't using that module (or SMAC at all), it's better to enable the backtrack patch, as it can help weed out legit cheaters (cheaters who try to look legit / hide their cheats).


    Bhop Configuration:
    The Bhop detection method has been reworked and works completely differently from the previous versions.
    There are now "pre-defined configs" which you can pick from.
    You can think of these presets as "how aggressive" the detection method will be.
    They are as follows:
    • [1] Reserved, sets Bhop preset to Medium.
    • [2] Reserved, sets Bhop preset to Medium.
    • [3] Custom (Not recommended, unlocks lilac_bhop_set command).
    • [4] Low - Detect Bhop cheats that are VERY unlikely to be AHK or scroll. This method is VERY slow to ban.
    • [5] Medium (Default) - Detect Bhop cheats that are likely not AHK scripts or scroll, can be slow to ban.
    • [6] High - Detect Bhop cheats early, higher false positive rate, bans faster.
    It's important to note that how these presets work internally *may* change through updates, to improve accuracy and speed... Fine tuning, basically.
    At some point, I should write a tutorial on how to use the custom mode.



    FAQ
    As suggested by Effeff, I should have an FAQ section explaining some of the features and detections.
    Plus, I guess I could clear some things up here *before* people ask.

    Q: What is Autoshoot?
    A:
    Autoshoot is when a cheat fires a perfect 1-tick shot.
    It's quite common for cheats to do this when using aimbot.
    Autoshoot detections work by detecting 1-tick perfect shots that lead to a kill twice in a row (Autoshoot will get logged if another aimbot type was detected tho).

    You *can* get a false positive for Autoshoot, but that should be very rare.
    It is possible to trigger a false positive if you use "bind mwheeldown/up +attack", as scroll (for some reason) does perfect 1-tick input.
    That said, if someone has to go out of their way to do something stupid and abnormal to get a ban, they've basically asked for it.
    If this is a problem for you, you can set "lilac_aimbot_autoshoot" to 0.

    Important thing to note about Autoshoot, because this feature shoots for you, you cannot tell if someone is using Autoshoot by spectating them, or through STV demos. Autoshoot isn't visible in demos or for spectators.

    Q: What is Anti-Duck-Delay? There are so many bans for it, are they false positives?
    A:
    Are they false positives? In short: No.
    Anti-Duck-Delay (Most commonly called FastDuck) is a cheat feature in CS:GO that is available in a LOT of cheats.
    In fact, Anti-Duck-Delay is so commonly used by cheaters, that most bans issued by Lilac in CS:GO will be for this.
    Anti-Duck-Delay works by inputting a value into your usercmd buttons, that is impossible to input by legit players; only internal cheats can do this.

    I understand if this makes you anxious, since there are a LOT of bans for ADD, but this is completely normal.
    If someone gets banned for this, they were cheating.

    Q: What is NoLerp?
    A:
    "NoLerp" is when cheats set their interpolation to 0ms (or lower than the minimum possible).
    This is often done to increase their Aimbot accuracy.

    Q: What are Angle-Cheats?
    A:
    Angle-Cheats is when a player's view angles are set beyond the limits of the game.
    This is often done to create a desync between their model and hitbox, making it harder to shoot them.
    It can also be done to execute some other exploits; like in TF2 with Duckspeed.

    Note: Lilac currently does not check for yaw, so some desyncs are still possible and not detected.

    Q: Are Macros cheats?
    A:
    No.
    Macros are just when a player is using a script to input buttons for them (AHK), or by using scroll to spam some input.
    This is why Macro detections can only ban for 15 to 60 minutes, and no more.
    Macro detections are by default disabled, because most servers don't care about this.

    Q: Does lilac ban for high ping?
    A:
    Not quite.
    The optional high ping kicker (which is disabled by default) in Lilac bans players for 3 minutes, after that, they can reconnect.
    The reason for this is simple, if you only kicked high ping players, they could instantly reconnect.



    Installation and Setup:
    1: Download the ZIP file and unpack all the files to their respective folders.
    2: Type "sm plugins load lilac.smx" in console.

    Configuration and Detection Logs:
    All cheat detections are logged to addons/sourcemod/logs/lilac.log
    The configuration file will automatically be generated in your cfg/sourcemod/lilac_config.cfg
    The default values are fine as is, and should work optimally.
    Optional features are disabled by default.

    SMAC (Sourcemod Anti-Cheat) notes:
    If you already have SMAC installed, and have the convar/cvar module installed, it is recommended that you disable Little Anti-Cheat's convar checker.
    You can do this by changing "lilac_convar" to "0" in the cfg/sourcemod/lilac_config.cfg file.

    It is NOT advised that you run Lilac's backtrack patch (lilac_backtrack_patch) if you are running SMAC's Eye-Test module.
    Patching Backtracking while running SMAC's Eye-Test module may cause false detections for SMAC.
    Either disable the Eye-Test module, disable Eye-Test bans or disable the backtrack patch in Lilac.
    The backtrack patch (lilac_backtrack_patch) is disabled by default for this reason.



    Updates and Future plans:
    Updates:
    Spoiler


    Future plans:
    I wish to add more cheat detection methods, specifically for CS:GO.
    I also plan on supporting more games.



    Special thanks to:
    Azalty - for being (rightly) stubborn regarding an issue and for contributing database logging.
    Bottiger - For fixing the plugin not loading in CS:GO & General criticisms.
    foon - For fixing sourcebans++ support not working.
    MAGNAT2645 - For informing me of a better method of handling convar changes.
    Larry/Larrybrains - For informing about false Angle-Cheat detections in L4D2.
    Finishlast - For informing me about false Angle-Cheat detections in L4D (1).
    panikajo and CrazyHackGUT - For helping me add support for MaterialAdmin.
    M4rkey and Thundy - For Bhop report.
    4LEJ4NDRO/ALEJANDRO - For fixing a typo.


    Supported languages and authors:
    • Simplified Chinese - by RoyZ.
    • Dutch - by snowy.
    • Danish - by kS the Man / ksgoescoding.
    • Norwegian - by me.
    • French - by Rasi.
    • English - by me.
    • Russian - by an anonymous person.
    • Czech - by an anonymous person.
    • Brazilian Portuguese - by SheepyChris, Tiagoquix and Crashzk.
    • German - by two anonymous people.
    • Spanish - by ALEJANDRO.
    • Ukrainian - by panikajo.
    • Polish - by qawery-just-sad.
    • Turkish - by ShiroNje and R3nzTheCodeGOD.
    • Hungarian - by The Solid Lad.
    • Swedish - by Teamkiller324.

    Videos:
    Aimbot & Backtrack showcase (https://www.youtube.com/watch?v=mEuIBwln5ts)

    Download: Github Releases

    Last edited by J_Tanzanite; 07-31-2021 at 08:48. Reason: New release
    J_Tanzanite is offline
    MAGNAT2645
    Senior Member
    Join Date: Nov 2015
    Location: AlliedMods.net
    Old 03-09-2020 , 14:35   Re: [TF2] Little Anti-Cheat
    Reply With Quote #2

    In cvar_change, you can actually replace this type of check:
    Code:
    	if (StrEqual(cvarname, "lilac_enable", false)) {
    		icvar[CVAR_ENABLE] = StringToInt(newValue, 10);
    	} else if (StrEqual(cvarname, "lilac_sourcebans", false)) {
    		icvar[CVAR_SB] = StringToInt(newValue, 10);
    to:
    Code:
    	if ( convar == hCvar[CVAR_ENABLE] ) { // Store ConVar handles globally as Handle or ConVar (on new syntax) -typed
    		icvar[CVAR_ENABLE] = StringToInt(newValue, 10);
    	} else if ( convar == hCvar[CVAR_SB] ) {
    		icvar[CVAR_SB] = StringToInt(newValue, 10);
    
    	// etc...
    	// The thing is that ConVar Handle is never changed after creating so you don't need to check for convar name
    	// just directly check convar handle
    Also, you should probably add translation support for hardcoded messages.
    __________________

    Last edited by MAGNAT2645; 03-09-2020 at 14:41.
    MAGNAT2645 is offline
    CrazyGhostRider
    Member
    Join Date: Apr 2014
    Location: Russia
    Old 03-17-2020 , 21:40   Re: [TF2] Little Anti-Cheat
    Reply With Quote #3

    Ban through sourcebans ++ does not work. The player was banned in the usual way.
    lilac_sourcebans = 1
    CrazyGhostRider is offline
    J_Tanzanite
    Senior Member
    Join Date: Aug 2018
    Location: Norway
    Old 03-23-2020 , 10:29   Re: [TF2] Little Anti-Cheat
    Reply With Quote #4

    Quote:
    Originally Posted by MAGNAT2645 View Post
    In cvar_change, you can actually replace this type of check:
    Code:
    	if (StrEqual(cvarname, "lilac_enable", false)) {
    		icvar[CVAR_ENABLE] = StringToInt(newValue, 10);
    	} else if (StrEqual(cvarname, "lilac_sourcebans", false)) {
    		icvar[CVAR_SB] = StringToInt(newValue, 10);
    to:
    Code:
    	if ( convar == hCvar[CVAR_ENABLE] ) { // Store ConVar handles globally as Handle or ConVar (on new syntax) -typed
    		icvar[CVAR_ENABLE] = StringToInt(newValue, 10);
    	} else if ( convar == hCvar[CVAR_SB] ) {
    		icvar[CVAR_SB] = StringToInt(newValue, 10);
    
    	// etc...
    	// The thing is that ConVar Handle is never changed after creating so you don't need to check for convar name
    	// just directly check convar handle
    Also, you should probably add translation support for hardcoded messages.
    Ahh, cool, I'll update that then. ^-^

    As for translations... Never really worked with them, I'll look into it tho.
    I am ignorant on the topic of translations, so pardon my dumb question here, but but doesn't using translations also force the plugin to require them in order to load?
    One of the things I wanted Lilac to be, was a single file, so that it would be easier to install.

    Lastly, Sorry for my slow reply, been fairly busy with real life lately (who hasn't been).
    I have been working on a massive update tho, version 1.0.0 is right around the corner.
    I have tested it a bit, but I won't published version 1.0.0 here until I'm certain it isn't going to create problems.
    You can find the latest version here: https://github.com/J-Tanzanite/Littl...lac_rewrite.sp
    J_Tanzanite is offline
    J_Tanzanite
    Senior Member
    Join Date: Aug 2018
    Location: Norway
    Old 03-23-2020 , 10:32   Re: [TF2] Little Anti-Cheat
    Reply With Quote #5

    Quote:
    Originally Posted by CrazyGhostRider View Post
    Ban through sourcebans ++ does not work. The player was banned in the usual way.
    lilac_sourcebans = 1
    OOF...
    Ok so, I've never used sourcebans, and I don't really have a way to test it.
    So it's kinda hard to fix that...
    I'll try to look into it though.
    If anyone else have the same problem, please tell me, and if anyone know how to fix it... pls halp D:
    J_Tanzanite is offline
    venter25
    Member
    Join Date: Jul 2019
    Old 03-27-2020 , 12:31   Re: [TF2] Little Anti-Cheat
    Reply With Quote #6

    Thank you. Running this on my TF2 Server.
    venter25 is offline
    foon
    Member
    Join Date: Dec 2018
    Old 03-29-2020 , 12:24   Re: [TF2] Little Anti-Cheat
    Reply With Quote #7

    Quote:
    Originally Posted by J_Tanzanite View Post
    OOF...
    Ok so, I've never used sourcebans, and I don't really have a way to test it.
    So it's kinda hard to fix that...
    I'll try to look into it though.
    If anyone else have the same problem, please tell me, and if anyone know how to fix it... pls halp D:
    Since you are using the SB++ include, you need to be checking if Sourcebans++ exists, not Sourcebans.
    You have to replace it in three locations. Line 354, 398, 404 (in lilac_rewrite.sp). Replace "sourcebans" with "sourcebans++".

    Last edited by foon; 03-29-2020 at 12:55.
    foon is offline
    J_Tanzanite
    Senior Member
    Join Date: Aug 2018
    Location: Norway
    Old 04-01-2020 , 16:51   Re: [TF2] Little Anti-Cheat
    Reply With Quote #8

    Quote:
    Originally Posted by foon View Post
    Since you are using the SB++ include, you need to be checking if Sourcebans++ exists, not Sourcebans.
    You have to replace it in three locations. Line 354, 398, 404 (in lilac_rewrite.sp). Replace "sourcebans" with "sourcebans++".
    Ahh, thank you!
    I've updated the lines and added you to the credits for that patch (Will be adding a credit listing later).
    Also, added translations.
    Doing some final testing now before releasing version 1.0.0 here.
    J_Tanzanite is offline
    foon
    Member
    Join Date: Dec 2018
    Old 04-04-2020 , 16:24   Re: [TF2] Little Anti-Cheat
    Reply With Quote #9

    You also might want to tone down the log info, it wraps way to easy and makes it a pain to read.

    Code:
    2020/02/29 03:49:32 [Version 0.7.1] {Name: "A user name" | SteamID: STEAM_0:1:528111416 | IP: 72.10.10.10} is suspected of using an aimbot (Detection: 6 | Delta: 50 | TotalDelta: 50 | Detected: Aim-Snap Aim-Snap2 Angle-Repeat).
    
    2020/02/29 03:49:32 [0.7.1] {"A user name" | STEAM_0:1:528111416 | 72.10.10.10} aimbot (Detection: 6 | Delta: 50 | TotalDelta: 50 | Detected: Aim-Snap Aim-Snap2 Angle-Repeat).
    (I don't think you need to add "suspected" since you gave people a warning in your OP that there can be false positives).
    foon is offline
    J_Tanzanite
    Senior Member
    Join Date: Aug 2018
    Location: Norway
    Old 04-05-2020 , 13:33   Re: [TF2] Little Anti-Cheat
    Reply With Quote #10

    Quote:
    Originally Posted by foon View Post
    You also might want to tone down the log info, it wraps way to easy and makes it a pain to read.

    Code:
    2020/02/29 03:49:32 [Version 0.7.1] {Name: "A user name" | SteamID: STEAM_0:1:528111416 | IP: 72.10.10.10} is suspected of using an aimbot (Detection: 6 | Delta: 50 | TotalDelta: 50 | Detected: Aim-Snap Aim-Snap2 Angle-Repeat).
    
    2020/02/29 03:49:32 [0.7.1] {"A user name" | STEAM_0:1:528111416 | 72.10.10.10} aimbot (Detection: 6 | Delta: 50 | TotalDelta: 50 | Detected: Aim-Snap Aim-Snap2 Angle-Repeat).
    (I don't think you need to add "suspected" since you gave people a warning in your OP that there can be false positives).
    Yeah, I might wanna look into shortening those messages a bit...
    Or at least add an option to... Didn't even hit me that might be an issue.

    However, when it comes to "suspected"... I can't really remove that one.

    The first time Lilac is ran, it will add some lines at the top of the log file to reassure admins that there can be false positives for "suspected" detections.
    My reasoning behind doing this, is that I've seen people overreact to minor stuff...
    So I've attempted to make the language used in Lilac to be very clear so that admins don't think Lilac is "perfect" (nothing is).

    Also, I've finished testing version 1.0.0 now, and it is ready. Going to publish it here later today.
    I highly recommend you upgrade to that version, as it fixes some bugs and fixes some potential overhead.
    J_Tanzanite is offline
    Reply


    Thread Tools
    Display Modes

    Posting Rules
    You may not post new threads
    You may not post replies
    You may not post attachments
    You may not edit your posts

    BB code is On
    Smilies are On
    [IMG] code is On
    HTML code is Off

    Forum Jump


    All times are GMT -4. The time now is 00:30.


    Powered by vBulletin®
    Copyright ©2000 - 2021, vBulletin Solutions, Inc.
    Theme made by Freecode