What is a hack?
a hack is something that gives one player an unfair advantage over someone else.

What do I do if I think someone is hacking?
Spectate them and record a demo. Submit it to the admin of the server if you honestly believe they are hacking.
see the FAQ for more on how to record demos.

Wallhacking

1. What is a wallhack?
For those who don't already know, a wallhack is basically a hack/cheat that let's you look through walls.

2. How do they work?
Wallhacks are usually OpenGL exploits or something similar. It can also be an extension of openGL or even an openGL replacement. So if a game is experiencing cheaters, in most cases there is nothing that game can really do about it.

3. How can I identify someone who is wallhacking?
Usually you can tell by their crosshair tracking a player through a wall. Also you could be surrounded on all 3 sides, hiding or something and the hacker would have a nex out and ready to strike. Use your own judgment, but don't falsely accuse someone of hacking, they might just be that good.

4. How can I prevent them?
There is a anti-wallhack feature in nexuiz. It is turned on and off with the cvar "sv_cullentities_trace". Setting it to 1 will enable the feature. In the next version (2.3 at time of writing) the anti-wallhack feature will be much less CPU intensive, and it will be turned on by default. If you're still having problems, the best solution is to ban the person, and keep a steady eye out for anyone else who may be wall hacking.

Aimbots
1. What is an aimbot?

An aimbot is a piece of software or a mod that lets users 'lock on' to players.

How do they work?
usually consist of a packet sniffer/server proxy and a mouse movement controller/packet alterer. Some give you hitboxes depending on the game (obviously not nexuiz), and some have "human simulating" features. Even with human simulation it's pretty easy to spot.

How do I identify one?
In most cases you will find that the player's movements are jumpy. See this video for an example: http://media.putfile.com/Aim-Bot-on-Enemy-Territory

How do I prevent them?
Almost impossible. If you find someone using one ban them, but that's about all you can do.

As for 2: Not necessarily exploits. Actually, WHs can be special OpenGL drivers, or libraries that hook into OpenGL driver loading and for example tell the driver to make everything transparent.

Sometimes, driver bugs act as wallhack - Vista's driver for the Quadro FX 540 lets walls and doors in CS:S flicker away sometimes so you can look through them while walking.

As for 3: As always, spectating or demos will give cheaters away - and this holds for basically every cheat out there.

As for 4: The anti-wallhack feature got improved and will be enabled by default in Nexuiz 2.3. The RBI servers actually run with that feature on and tuned even more aggressively (so it eats more CPU than usual), and they run fine.

I did a test match with [PGP]Dim, we tested the anti-wallhack feature for the next version. First a 'real' test match without wallhack and then one were i was using a wallhack (he knew about it), Compared to the first match i had no advantage over him nor did the scores change much. Maybe we can release a video of the anti-wallhack in action so people can see that this kind of cheat will no longer work in Nexuiz as it basicly prevents you from seening anything behind a wall.

updated it a bit based on div's post

I always thought wallhacking was noclip, but in the case of transparent walls, all walls in my game have always been flickeringly transparent. When an entity (player, weapon, health) is next to a wall, I can see it through the wall. Plus there are strange black lines in my textures like an overlap. But still, it really doesn't matter. Wallhacking at all provides very little advantage, unlike cliphacking, which is just stupidly unfair.

Operating system? Card? Driver? This must be really annoying...

added aimbots to the post

Please include that the only way to identify a cheater is to spectate them, and if you want to document it, make a demo of that.

Dave wrote:Please include that the only way to identify a cheater is to spectate them, and if you want to document it, make a demo of that.

yeah, good thinking

[TSA] Psychiccyberfreak wrote:4. How can I prevent them?
There is a anti-wallhack feature in nexuiz. In the next version (2.3 at time of writing) the anti-wallhack feature will be much less CPU intensive, and it will be turned on by default. If you're still having problems, the best solution is to ban the person, and keep a steady eye out for anyone else who may be wall hacking.[/b]

perhaps include how to switch on/off this feature

ZyanKLee wrote:perhaps include how to switch on/off this feature

added.

Probably the easiest way to add code to detect and auto-kick aimbotters is the keep stats on the weapon accuracy of beam type weapons such as the Nex. You won't be able to prevent "smarter" aimbotters, if there really *is* such a thing, but you can at least weed out the very obvious and obnoxious ones that just sit there and rack up 40 frags in two minutes and do it just to be jerks.

iSuck wrote:I always thought wallhacking was noclip

But still, it really doesn't matter. Wallhacking at all provides very little advantage, unlike cliphacking, which is just stupidly unfair.

A noclip cheat is basicly impossible as the server controls the player positions and it will stop you from going through walls

Depends on who you play against. If you know exactly were someone is going you can have a huge advantage. Someone got your flag and you are not sure were he is right now? Imagine you could know for sure with a wallhack.. But as mentioned already the wallhack prevention in Nexuiz (2.3) will stop such things for working.

Irritant wrote:Probably the easiest way to add code to detect and auto-kick aimbotters is the keep stats on the weapon accuracy of beam type weapons such as the Nex. You won't be able to prevent "smarter" aimbotters, if there really *is* such a thing, but you can at least weed out the very obvious and obnoxious ones that just sit there and rack up 40 frags in two minutes and do it just to be jerks.

Hard to do right. There was a fun saying 'real quakers do not use aimbots as they can aim better' and indeed there are some people that make aimbots look stale.

my movements are jumpy too o.O
I'm used to not follow a player with my crosshair but jump onto him when nexing :S

I did that all my live, maybe I got an aimbot implanted into my head!?!?!?!?!?
I WAS ABDUCTED BY AIMBOT-IMPLANTING ALIENS!!!



uh i still don't understand why wallhacks and aimbots exist :S
It's not just dishonorable, but... NO FUN!?

Very impressive post, Psych!

You also might want to add where we can get these hacks... to test them ourselves.

*ahem*

Dave recorded a demo for me of a Speedhack on my Minstagib server -- one I hadn't seen before.

Are Nex devs aware of this one? I can post up the demo if you like.

No, we are not aware of this. We still believe this isn't possible. First of all, were other players that fast too? Some maps have broken mapcfg files that change player speed - but for EVERYONE then (sideloop does that, for example).

If it happens again, can anyone make a packet dump using tcpdump or wireshark? That is, when using tcpdump:

tcpdump -s0 -w outfile.dump udp and host 1.2.3.4

where 1.2.3.4 is to be replaced by the IP of the alleged cheater, and keep that running for, say, 5 minutes? This file would then contain enough info to find out how the speedhack works, if there is really one. If anyone makes such a file, send it to me please in conjunction with a demo. I have seen the demo alone, but it doesn't contain useful information about the data sent from client to server.

divVerent wrote:were other players that fast too?

They were not. This also happened on Soylent Space, in the second half of the demo, so I don't think it was a map setting.
To clarify, tcpdump should be run from the server?

Another odd thing I've seen recently was a guy who would run around the map after the match had ended, during the voting. Can't say that was cheating, but he wouldn't say what he was doing either. I head-butted my dog twice for that.

I'll be ready with the tcpdump command. Catching it in the act will be harder. You said you've already seen the demo of this (even if it doesn't have useful client/server communication info, I think it should be seen)?

Demos contain all packets from server to client, but none from client to server. If this is really a hack, the interesting info would be in the client->server data stream, though. The demo does not show how this could happen, or what the client did to get that fast. But that info would be required to prevent it. Without that network dump, the bug will probably stay in every release until the hack gets released and developers finally get a chance to look at it.

As for the other thing, the "deadwalking" at the end of the match - that's a known but absolutely harmless bug. Might stay unfixed for fun...

I played with someone named Nick, and he was using that speed hack. He also told people where to go to get one.
He also hit me very accurately considering he was flying all over the place.
This was also on Galt's minstagib server.

Komier wrote:I played with someone named Nick, and he was using that speed hack. He also told people where to go to get one.
He also hit me very accurately considering he was flying all over the place.
This was also on Galt's minstagib server.

welcome!

anyways, a speed hack is very unlikely because physics and movement are done server-side. If he was jumping repetitively, he was most likely bunny hopping.

Komier -- you're present in the demo I have of this going on. Have you seen Nick doing this speedhack another time, or just the once?

Psycic, unfortunately this speedhack looks real. I haven't been able to capture a tcpdump of it as it's happening yet, but I'm on the lookout.

Komier wrote:I played with someone named Nick, and he was using that speed hack. He also told people where to go to get one.
He also hit me very accurately considering he was flying all over the place.
This was also on Galt's minstagib server.

Do you have logs? If he told people where to get the hacks, we (the devs) need that link so we can check out that hack and fix an engine bug if it is true.

His nick was actually "Nate" and he told people it was done with cheatengine. (cheatengine.org, I'm guessing)

I do have the console logs from the session, though I'm not sure there's more information to be had there.

Bah, the best way to avoid cheaters is simply to ignore them ... that way they don't find it so interesting and they usually quit. You can train on them anyways .

relevant chat lines at the time:

Code: Select all

^7^3[2007-09-19 18:54:51] [CI]Insanity^7: wtf?
^7^3[2007-09-19 18:55:14] ^9[I]^1OldSchool^7: hmm
^7[2007-09-19 18:55:41] ^4^9[I]^1OldSchool^4 is spectating now
^7[2007-09-19 18:55:47] ^4Komier^4 is spectating now
^7^3[2007-09-19 18:55:56] ^9[I]^1OldSchool^7: nate got a speed hacking going
^7^3[2007-09-19 18:55:59] Komier^7: i think nate is cheating
^7^3[2007-09-19 18:55:59] [CI]Insanity^7: He's got a hack
^7^3[2007-09-19 18:56:30] ^9[I]^1OldSchool^7: interesting
^7^3[2007-09-19 18:56:57] ^9[I]^1OldSchool^7: nate where you find that?
^7^3[2007-09-19 18:57:05] Nate^7: its chjeatengine
^7^3[2007-09-19 18:57:11] ^2* ^3[CI]Insanity^2 calls a vote for ^1kick Nate
^7^3[2007-09-19 18:57:17] ^2* ^3[CI]Insanity^2's vote for ^1kick Nate^2 was accepted
^7[2007-09-19 18:57:17] Client "Nate^7" dropped
^7[2007-09-19 18:57:17] ^4Nate^4 disconnected


Ok. I see how they did it. He basically changed the variable that controls movement speed, and the server just accepted it. This should be an easy fix without significant performance loss.

^7^3[2007-09-19 18:57:05] Nate^7: its chjeatengine

I doubt that. I think he means he uses a modified DarkPlaces engine. Which is much more likely.

And no, console logs are not interesting... what we need is a network dump of the cheat (tcpdump), or the cheat itself.

Trouble is, I haven't seen his IP since this infamous day. Otherwise, we'd have a tcpdump log by now.