Never trust the client • Hacker News Board

Re: Never trust the client

#151

Post by ultramancool » Thu, Apr 28, 2016, 6:21 PM UTC

cataflam wrote: post #149

ultramancool wrote: post #144

Earlier quoted context omitted.

You're right - you can never prevent that. Which means your client needs to offer it to keep it from becoming an advantage. If the players are already bright, recognizable colours you're basically already there. Transparent walls don't help when the server doesn't send you the enemies hiding behind them until the very instant they pop out. And if you're only spoofing mouse movement, well, that is getting pretty high…

Even all that still doesn't stop a very old type of cheats: aim bots. Even if the server only sends you information about enemies the instant they pop out, a computer will be faster and more precise to aim and shoot at this enemy than any human player could be. Add in some randomization and delays so the server can't easily differentiate the movements from a human player, and you're a mechanically world-class player.…

Sure, but aimbots aren't as much of a problem if they have to aim like humans - which you can enforce. You can buy some advantage like this, yes, but not much if it's implemented correctly. Additionally if you can't detect a player behind you for example, you're still dead, doesn't matter if you aimbot or not. "World class player" perhaps, but only if your bot can really play as well as a human within the confines of the game - knowing which corners to check, knowing when to look behind you, where to be aimed at a given time, etc. Your bot needs to be a hell of a lot smarter than a bot that's just given all the data and has to do basic trigonometry to aim at their head - your bot has to think a lot more like a human and may even underperform many humans.

Ultimately no matter what you do, some small percentage of your players will cheat. Every major game on the market has paid cheats which fully bypass the protections available for it. It's better if those cheats can only buy them a little than buy them a lot. It's not worth investing a lot of effort in more than basic cheat protection, it is worth investing it in handling as much as you can server side and exposing as much as you can client side as that is something cheaters can't game.

Re: Never trust the client

#152

Post by sdwisely » Thu, Apr 28, 2016, 7:00 PM UTC

grimmfang wrote: post #68

djsumdog wrote: post #54

Earlier quoted context omitted.

I saw a talk where a guy was showing how to cheat at some games. A lot of games will detect and crash you out if they detect a debugger attached to them. Things like Punk Buster, et. al. are more like anti-virus software: they try to find the signatures of known chat clients. So it's best to write you own...and rename your debugging process to "Google Chrome." He got pretty far with his auto-walker in some MMOs. He h…

Don't forget the incident where Punk Buster banned anyone with a certain string in memory...

I remember it unfortunately being timed around the same time an exploit string would cause one of the AV packages to drop connections.

Made gaming IRC channels utter chaos for weeks.

Re: Never trust the client

#153

Post by cataflam » Thu, Apr 28, 2016, 9:50 PM UTC

ultramancool wrote: post #151

cataflam wrote: post #149

Earlier quoted context omitted.

Even all that still doesn't stop a very old type of cheats: aim bots. Even if the server only sends you information about enemies the instant they pop out, a computer will be faster and more precise to aim and shoot at this enemy than any human player could be. Add in some randomization and delays so the server can't easily differentiate the movements from a human player, and you're a mechanically world-class player.…

Sure, but aimbots aren't as much of a problem if they have to aim like humans - which you can enforce. You can buy some advantage like this, yes, but not much if it's implemented correctly. Additionally if you can't detect a player behind you for example, you're still dead, doesn't matter if you aimbot or not. "World class player" perhaps, but only if your bot can really play as well as a human within the confines of…

An aim bot doesn't have to play all the game for you, it doesn't need to think. I don't know how it is currently as I haven't played FPS games in a while, but back in the day, there were aim bots that would just activate when a target is in sight and take over, aim and shoot.

Re: Never trust the client

#154

Post by 746F7475 » Fri, Apr 29, 2016, 3:49 AM UTC

jmnicolas wrote: post #146

746F7475 wrote: post #121

Earlier quoted context omitted.

I would love to play around with "botting" in some games, but I just don't even know where to begin. I tried to create super naive autoplayer years ago in C# by trying to just send keyboard keys into games, but most games didn't even receive the inputs.

If you're ready to throw a bit of money at it (and you're playing on Windows) I'd recommend having a look at Innerspace from Lavishsoftware. I used that to bot on WOW back in the day, this tool was fabulous and can be adapted to probably any game. Knowledge of C++ is required to create an extension, after that you can code your bot in C# or Lavishcript (their own script language, quite powerful).

Yeah, I'm not really willing to put up with monthly costs for this, but thanks for recommendation

Re: Never trust the client

#155

Post by ultramancool » Fri, Apr 29, 2016, 4:05 PM UTC

cataflam wrote: post #153

ultramancool wrote: post #151

Earlier quoted context omitted.

Sure, but aimbots aren't as much of a problem if they have to aim like humans - which you can enforce. You can buy some advantage like this, yes, but not much if it's implemented correctly. Additionally if you can't detect a player behind you for example, you're still dead, doesn't matter if you aimbot or not. "World class player" perhaps, but only if your bot can really play as well as a human within the confines of…

An aim bot doesn't have to play all the game for you, it doesn't need to think. I don't know how it is currently as I haven't played FPS games in a while, but back in the day, there were aim bots that would just activate when a target is in sight and take over, aim and shoot.

Yeah, modern aimbots are a lot more advanced than that. Mostly in that they'll know when someone's anywhere visible to you and they'll aim straight at their head.

This sort of behavior becomes impossible. If they have to aim in a fairly human manner, they can still be killed by anyone walking up behind them for example. It may provide some bit of unfair advantage. But not nearly as much as is possible in many games today.