Jump to content


Spotting Cheaters (Aimbots/Wallhacks) / Recording Demos

Recommended Posts

  • Snoopy changed the title to Spotting Cheaters (Aimbots/Wallhacks) / Recording Demos
Posted  Edited by Joshy - Edit Reason: Youtube videos had problem after forum update

The above videos gives you a good intuition and some things to consider before thoroughly investigating a player; however, I do feel that it is not exactly objective nor very confirming.  I want to be very certain that someone IS hacking before we take any action, and there are a lot of useful commands I like to use while reviewing demos on Counter-Strike: Source. I have seen these commands work in other Valve games, and you can find them on their Console Command List.


Also, some games do have an easier method for record.  Check the options to see if a record key option is available to you (GMOD has it).






Demoui opens controls for playback.  After loading the demo, you can control how fast the demo plays by percentage, jump to a specific "tick" or frame, and even DRIVE your demos.  Drive is really cool because you can effectively noclip in your demo.  You simply click "Drive...", press and hold your left mouse click, then use normal movement keys to noclip throughout your demo.  You will return to your actual position upon clicking "Drive..." again.





I also show some examples in this thread if you would like to see more.




R_drawothermodels allows you to see players through the walls, and it will help you confirm a wall or aim hack.  To see the players through the wall is r_drawothermodels 2, but you can revert back to regular settings using r_drawothermodels 1.







Aim hacks are often obvious; however, some aim hacks can be tuned to be more subtle, and they have become increasingly popular.  Some people might even simply remove the spread.  Spread is the movement from firing your gun...  if I fired a machine gun at a target, then not all of the bullets are going to hit one coherent spot.  It'll "spread" out.


You can use r_visaulizetraces 1 to see if the bullets are going in the correct direction; it'll even show the ricochet, and your actual position.  It is accurate to the shot, and you can "drive" your demo as shown above and in the following picture.  You'll see the red tracers showing the exact direction of the bullets following the player's gun.  Most interestingly and useful for reference...  you'll see where your position was at too.  Your position is represented by a floating vertical plane.







Always record your demos in firstperson!  Even if it looks like cancer, you'll be able to switch to thirdperson while reviewing the demo, and you can switch back.


Thirdperson doesn't work without setting sv_cheats 1.  While you cannot "drive" a player you were spectating away from their position (sorry, you're bounded to them), you can switch to thirdperson and angle the camera to something more convenient by driving the demo.  The following example came from an actual player report.  I'm using this example because it's an exaggerated or obvious case of aim hack, but this demo is frustrating to watch without these commands.





This simply dumps the console into a generic text document.  It's pretty helpful where copying information from the game can be frustrating or take time.  Counter-Strike: Source dumps it into your ../cstrike folder and it's typically named using the framework condump000.txt.  This might be helpful if you just used the Status command, if someone typed out something such as a command, typed something out that was against the rules, or you want to provide a bunch of information (ie. the server crashed and you may want to send console information to the Server Manager+).






You probably saw that strange purple/pink box enclosing things like the players, their weapons, and props earlier.  In Counter-Stirke: Source, this is useful for throwing knives because they don't follow the trace very well, and it's difficult to see them even if you pause the demo.  The renderbox will make it a lot more prominent.



R_DRAWBEAMS 1 (intermittent)


It's a better version of r_visualizetraces 1, but I saved it for later because it only works intermittently now.  It's meant to work for lights much like flashlight and grenades, and it used to work really well for bullets until an update.  I am not sure if it may work better for other games.








This one requires sv_cheats 1.  It shows you various triggers such as teleport spots, which many mappers use to use this yellow/orange looking box.  This might be helpful in a deathrun or bhop server.  The picture below (with ent_messages_draw 1) will show a CS:S Zombie Mod map with these orange boxes being at the teleports, and one spot being a safe spot for another trigger; it's a "secret" spot in that particular map.






This one also requires sv_cheats 1.  If you press a button or a series of buttons, then it would show you the button you pressed and what it was associated with.  For example, if I pressed a button that opens a door, then I would see a square appear around that button (even if it's hidden) and a white line from that button would go to the corresponding door or whatever it may be enabling.  I shot the sign in the above picture and a white line with the word "Open" at the end of it; in the example below, I pressed "E" on a button, and it enabled another button elsewhere.  This might also be helpful in deathrun.




Edited by Joshy
Youtube videos had problem after forum update


Share this post

Link to post
Share on other sites

If more people are willing to put work towards this and help others spot cheaters far easier then just PM me and let me know!



So everyone is listing their former stuff so I'll just be cool and list mine :3


Former @HackingPotato's White Knight and Boss Former Director Former TF2 Division Leader Former Community Advisor Former TF2 Technical Administrator Former TF2 Server Manager Former TF2 Trial Manager Former TF2 Admin Former TF2 Revivalist Former TF2 Player Former TF2 God Former Media Leaderish Former somewhat Media team person Former VIP Former Supporter Former Member Former TF2 Player Former Player

Share this post

Link to post
Share on other sites

Thank you both Snoopy and Joshy for taking the time to make this thread.


It looks the same just enough that it would work on GMoD? I think?


Either way, I'll be reviewing this information in more detail when I get home. :3













Share this post

Link to post
Share on other sites

  • Joshy pinned this topic
  • 4 months later...

Those only work for obvious cheaters, mostly pub cheats, ragers or total newbies.


Nowadays even the private and most public cheats have achieved the stage where even if the user of the cheat is dumb, you can't tell if he's cheating or not.  "Full legit cheats", there's many of those who only have legit features and disable any that might be suspicious and exclude all exploit and rage features.  Randomized curving smooth human like aimbot with overaims and other additional crap configs which improve you by a little bit of %, but that's enough for high level plays.


Even humanlike b-hop has been able to bypass all the anti b-hop plugins for a few years, unlike the normal b-hop scripts which spam at the same value.


The best way to catch a cheater is to cheat yourself and find out how to figure out how they work, that way you can figure out what type of cheat it is, who created it etc..every cheat code have their own ways on doing stuff which you can detect by eye when playing against them, of course I am not talking about c+p ones.


Of course there's specific things you can do to make many aimbots go crazy.. but yeah, there's a lot of shady stuff that gets improved every day, you'd be amazed at what's possible.

Share this post

Link to post
Share on other sites

  • 2 weeks later...
  • 3 weeks later...
Posted  Edited by Joshy

I'm seeing a lot of comments about "it's easy."


You're right for the most part, but that doesn't invalidate the information presented here.  The general hacker is very easy to identify, but a lot of these games have been around for a long time and there are some pretty advanced hacks that allow the users to tune the subtlety.  It's like a runner or a lifter on steroids running a little bit slower or simply grunting when they lift "heavy" weights in order to make things look more legit.


These commands aren't just for identifying hackers.  In modes like Surf RPG DM...  we're just going to have people who play 10 hours everyday for the past 7 years, and they are going to be REALLY good at what they do.  People still accuse them of hacks, and using these commands can also help the admin prove...  by contradiction... their innocence.  This can prevent some really bad decisions, and in the few cases where we have superstar players who are willing to check, this might prevent a few people from crying wolf as well.


Of course nothing is 100%, but these are tools and resources meant to supplement our intuitions.  It's silly to not use them when there are no costs or trade-offs associated with it.  Here: It's one of few times you can have your slice of cake and eat it too.  If the professors allow you to go to your exam with open notes and your books, then I'm pretty sure you'd bring them even if you were confident or comfortable with the material.

Edited by Joshy


Share this post

Link to post
Share on other sites

  • Create New...