[Request] Add Macro detection about little-anti-cheat

[tornike015]

yes bro. sr for my bad eng. please add this commands.
"Detections should be in chat (Admins only, so you can secretly spectate them if they are suspicious)." this is important.
tnx

[J-Tanzanite]

Don't worry, I'm still alive and working on this project.
It's just that lately, I've been busy with real life because the Covid situation where I live has changed.

[J-Tanzanite]

Lilac is 2500 lines.. Ish...
And it's getting messy, because of this, I decided to update Lilac, re-structure/re-organize the code and do some overhaul.

And along that process, I've found a few bugs that needed fixing, no critical ones tho, just small stuff.
This has taken quite some time to do, especially since I've been so busy with real life stuff.
However, you are right in being impatient, it's been nearly 3 months...

So here's what I think I'll do, I'll create a new branch with the changes I've made so far, this branch will contain some untested code. It will also contain the macro detector.

That way, there is:

1. Master branch - Contains stable, official and supported code.
2. Development branch - Contains developmental stuff.
3. Restructured-Code branch - Contains the absolute latest changes, some untested stuff. I will probably delete this branch after it's stable enough to be put in the Development branch.

You can test the Restructured-Code branch once I make it and tell me how it goes.
This way, you also get to see that things have been going on.

I still have a few things I need to fix before I make the new branch tho, but it's coming. :)

[J-Tanzanite]

The new branch is made, you can find it here: https://github.com/J-Tanzanite/Little-Anti-Cheat/tree/restructured

Again, this new code may have issues, bugs and such.
And I'm not done restructuring the code! There's still a lot of changes I have to do.
However, testing it would greatly help me continue the development faster.

Also, this code has the Macro detector (which is in beta).
The default ConVars have Macro detection turned off, so you have to update the ConVars in the config file.
You might have to delete the old configuration file so it can generate the new one.

[tornike015]

okay, i will install now and write u later how it will work

[J-Tanzanite]

Let me see if I've understood you right:

• Add Macro detector.
• When players are banned for it, let it show up in MaterialAdmin / Sourcebans++.
• Detections should be in chat (Admins only, so you can secretly spectate them if they are suspicious).
• Banned players for Macro should show up in chat.

If I've misunderstood you, let me know.

As for if I will add this: Sure :)

---

When it comes to bans however, since Macros aren't cheating software, but scripts...
I think the default action should be to kick them.
I will add an option to ban them tho, but bans will be maximum 1 hour, and default to 15 minutes.

---

"Banned players for Macro should show up in chat."
Other cheat detections are shown in chat like so:

Player_1 left the game ([Little Anti-Cheat 1.6.1] Aimbot Detected).

I'm guessing these tempoary bans (or kicks) due to Macros should be shown like this:

Player_1 left the game ([Lilac] Macro Detected: Auto-Jump).

---

As far as I know, there are only two useful Macros for games:

• Shooting spam.
• Jumping spam.

I think hyperscroll might be detected as a Macro, but that's fine as they act the same (spamming).

[tornike015]

tornike015 commented on Aug 17.... rip this project?

[tornike015]

Bro, when will be the next update? :(

[tornike015]

this anticheat is really good. yesterday lilac catched faceit 3000k elo on aimbot and this was legit catch. this is reason why i want next update 🥇

[tornike015]

if test version is ready i can test it

[J-Tanzanite]

Yes, when it is ready, which is soon

[tornike015]

first time i got this message https://i.ibb.co/cxKtK5L/Screenshot.png now console is clear.
i removed old version with auto generated config and installed this new.

dude you added ingame detect message? like in this video https://www.youtube.com/watch?v=6lDLUtqVlNQ&feature=emb_title&ab_channel=CodingCow

[J-Tanzanite]

Alright, I fixed the error, I simply forgot to add PLUGIN_VERSION.
a601d46

Yes, there is a warning system in place, it's controlled by this ConVar: lilac_macro_warning
It as a few different modes:

1. Warns the player to stop using macros (Default). No one else gets the chat message.
2. Warns admins on the server (Admins must have either of these flags/permissions ADMFLAG_GENERIC, ADMFLAG_KICK, ADMFLAG_SLAY).
3. Warns everyone in chat.

[tornike015]

i want this warning messages on aimbot/aimlock/macro/ and etc what will be in panel log also will show ingame on server for admin

[tornike015]

add this warning messages on aimbot/amlock and etc. all anticheat's have this ingame warning messages

[J-Tanzanite]

I was considering doing this, and I think the best way of doing it would be to split up how logging is done.
Currently I'm using a single array to contain the entire detection info, if I were to split it up, I could use parts of the logging info to print to admins in chat

However, the only cheats that are currently worth (and possible) printing to chat are Aimbot, Aimlock and maybe bhop in some circumstances.

Before I do anything like that tho, I wanna first complete the restructuring of Lilac.
Just a question, how is the new version of Lilac going for you? Any issues?
And what's your lilac_filter_name and lilac_filter_chat ConVars set to?

[tornike015]

me and my friend tested macro jumps and its not working

[J-Tanzanite]

The current Macro detector works by checking if a key is pressed 1/3rd of the tickrate or more.
Perhaps that's too high of a threshhold, even if tickrate is normal.

What is the tickrate of your server (64, 128)?

[tornike015]

ofc 128 bcs i have auto mix server.
if you using discord add me:HAIT#5625

[J-Tanzanite]

128 / 3 = 42/43... That's the threshold...
Yeah I guess most macros won't even attempt to spam that much.

Perhaps I should limit it to 20 clicks/key presses per second.

[tornike015]

yes, go limit on 20 click or 15
make like variants 10/15/20

this is cow anticheat sp file . https://github.com/DJPlaya/Cheat-Acid/blob/master/GRAB/Cow%20Anti%20Cheat%20Private/New/AntiCheat.sp take from here
20 is default in this ac

[J-Tanzanite]

No, I will not take from other projects.

The problem with making variants, is that server owners may pick a value that's too low.
If someone is trying to spam keys/clicks fast to mimic a macro, then yeah, obviously the macro detector will pick up on it, but it should at the very least have a fairly high threshold to prevent players from getting wrongly accused of using a macro.

And a value of 10 or 15 seems awfully low as well.
Having a preset of allowed values doesn't really solve the problem either.

[tornike015]

okay then do it on 20. and this will be default

[J-Tanzanite]

Alright, I just uploaded version 1.7.0-Dev 6.
I changed a lot of things, so there may be issues.

But the maximum presses per second is now set to 20.
Try it out and see how that works :)

[tornike015]

oh now rip macro, sometimes shooting sometimes not shooting, when u will click 1x time on mouse shooting 3 bullets. wtf :D

[J-Tanzanite]

What do you mean?

[tornike015]

sometimes when i trying open smoke and wait for hold smoke shooting auto :D sometimes when u will click on mouse dont shoot. it blocking shoots and blocking open smoke or nades for long time and etc. D

[tornike015]

it think that scroll is mouse 1 or mouse 2 clicks and have problem on shooots without macro, on default players. when i turned off macro now working well anticheat.

[J-Tanzanite]

I still don't know what you mean.
I tested out Lilac with and without the macro option, and none of my shots were blocked.
At the very least, I assume that's what you meant...

Any specific steps you took to recreate this?

[tornike015]

in last update macro's have many problems. if u want add it in alliedmods for test and they will write you. somethimes have shooting block, sometimes when i'm trying shoot molly and smoke where i want its going auto. just u need test it good.

[J-Tanzanite]

I've been testing it, over and over, and I literally cannot replicate the issue you're having, at all.
Not in TF2, not in CS:GO. Not only that, but there is nothing in the code that would allow it to modify your button presses.

To modify your button presses, you have to change buttons inside of OnPlayerRunCmd(), like so:

	buttons = X;

And the only file which handles that forward, is in lilac.sp... Where buttons is never changed.
The only other way would be to pass buttons by reference, but it never is. It's always passed by value.

---

So there's nothing in the sourcecode that could cause this, so that kinda just leaves the binary plugin.
Try redownloading the plugin again, and see if that works (And try restarting your server as well).
If that doesn't work, then the issue isn't with the plugin, it's something else in your setup... No clue what that could be.

[J-Tanzanite]

Any updates?

[tornike015]

Is overly sensitive. Throw out players for a simple bhop.

[J-Tanzanite]

I thought that was the point, people who use macros or scroll to bhop get kicked out. Not sure what you mean by "simple bhop".
But you think 20 presses a second is too low?
Hmm...

Maybe you're right...
I guess I could add a setting so you could choose where the limit is, but the minimum being 20...
Maybe the ConVar for that should be called: lilac_macro_threshold

---

Btw: I'm assuming that the issue of blocking shots is gone, since you didn't mention it?

[tornike015]

this kicks was not 20 presses a second. they kicked on scroll or space jump. yes add this "lilac_macro_threshold" and i will test

[penalte]

scroll jump gives ban

[J-Tanzanite]

Due to a lack of response, I am closing this.