[CS:GO] Custom map: "jb_legobels_corp_v1d" causes false positive bans for Angle-Cheats about little-anti-cheat

[J-Tanzanite]

Just need some clarification (Because the English language isn't always explicit).

Are you saying that angle detections are invalid and leads to the server crashing?
Or are you saying angle detections leads to the server crashing? (Implying that the bans were correct)

Also, I'm not French, so reading that log is somewhat hard, but I get the gist of it.
The detection log would be helpful too, not just if you think the bans were invalid, but also, how things get written to the log matters a lot, even if the detections are valid.
Note: Please remove IPs from detection logs before sharing.

Upon crashes, there should be a Sourcemod error log as well, if I remember correctly, would be nice if I could have a look at that.

Lastly, what game is this?
Sourcemod Version?
Custom maps? (Would be answered by detection logs if extra logging is enabled).

If you could provide these things and answer those questions, that would help a lot, thank you :)

[azalty]

Game: CSGO
SM: 1.10.0.6492 (stable), didn't update it after the new operation, maybe that's what causing this?
Custom maps: yes, jailbreak/ba_jail maps. The last banned user said he teleported using a trigger and got instantly banned

2020/12/18 12:02:49 [Version 1.6.1] {Name: "OCB Kaiiko" | SteamID: STEAM_1:1:546443266 | IP: XXX} was detected and banned for Angle-Cheats (Pitch: -80.47, Yaw: -119.22, Roll: 89.30).
Pos={-830,-1087,653}, Angles={-80.47241,-119.22063,89.30567}, Map="jb_legobels_corp_v1d", Team={2}, Weapon="weapon_knife", Latency={Inc:0.000293,Out:0.065930}, Loss={Inc:0.000000,Out:0.000000}, Choke={Inc:0.000000,Out:0.060227}, ConnectionTime={1398.631958 seconds}, GameTime={1792.000000 seconds}

2020/12/20 20:58:12 [Version 1.6.1] {Name: "[DIEU] Tacos_THC" | SteamID: STEAM_1:0:195792091 | IP: XXX} was detected and banned for Angle-Cheats (Pitch: 13.35, Yaw: -109.19, Roll: -67.80).
Pos={-805,-1059,676}, Angles={13.35203,-109.19087,-67.80888}, Map="jb_legobels_corp_v1d", Team={2}, Weapon="weapon_knife", Latency={Inc:0.000000,Out:0.072582}, Loss={Inc:0.000000,Out:0.000000}, Choke={Inc:0.000000,Out:0.000000}, ConnectionTime={1461.513671 seconds}, GameTime={590.578125 seconds}

I didn't get any error in the console, and I don't think accelerator will give a good crash log since CS:GO doesn't really give crash logs

So idk if the bans are actually correct, I might be able to get the actual demos but I don't think we'll see that much. If needed I can record the demo and send it.

[J-Tanzanite]

(Sorry in advance, little drunk atm, my language may be a bit off)

The thing that got them banned was their Roll angle, 89.30567 (Which is near a value cheats use, but not quite there, so I think it's a false positive) and -67.80888 (deffo not a value cheats currently use afaik).
Normally upon teleports, Roll isn't affected, so I'm guessing this might be a map issue, but regardless, this should be fixable by the plugin.
They also seem to have taken the same trigger (more on that later).

Based on this alone, it seems like there's an issue with that trigger on that map.

Not that long ago, I added a teleport fix for my stand-alone Backtrack patch plugin (https://github.com/J-Tanzanite/Backtrack-Patch) here: J-Tanzanite/Backtrack-Patch@f36af2e
Which made it so the backtrack patch wont' be applied on recently teleported players (teleported by the map itself, that is), and I suspect this issue could be solved similarly by adding that map-teleport detection method.

---

As far as I see it, you should unban those players because:

1. Their Roll isn't the standard value you'd see in cheats (89.999 / 90.0 / -89.999 / -90.0).
2. This was on a custom map, which unlike VALVe maps, tend to do some funny things.
3. Teleports (even from TF2 building teleports) could potentially mess with angles (although it's never been documented to have happened), which is why there is a check to see if a player teleported recently (and if so, it won't ban for Angle-Cheats) here: https://github.com/J-Tanzanite/Little-Anti-Cheat/blob/master/scripting/lilac.sp#L1599 - However version 1.6.1 doesn't check map teleports, because that was only recently added in the standalone backtrack patch plugin... It does account for players spawning, joining and taking TF2 teleporters though.
4. These bans were both on the same map and in the same coordinates (suggesting it was the same trigger).

---

Also, as a side note, considering the detection logs were successful and without errors, it seems like it's a map issue leading to the crashes?
Unsure about that one, but if it was a plugin issue, I'd expect the logging to fail or stop partly through.

---

I'll add a temp fix in version 1.6.2, which will be released soon (my time atm is a little all over the place - but as soon as possible).

Version 1.7.0 (Which is currently being worked on) will have map teleport checks added by default, not sure when that version will be released, but soon... It's still in development, and has some new cool features.

---

Edit:
Since you're playing on that custom map (Which I suspect is having issues) and you're playing CS:GO, I suggest disabling Angle-Cheat detections for the time being, until I release version 1.6.2 or 1.7.0.
You can do so by changing the line in cfg/sourcemod/lilac_config.cfg from lilac_angles 1 to lilac_angles 0

[azalty]

Thanks for your answer! I'll do that and I'll check the map :)

[azalty]

Update: this is what bans them: https://youtu.be/qemba5eZh9Y?t=185

And another game just banned someone in the same map, it was modifing his view as well

That's not related to a teleport trigger but to the map modifing their view, so I'll keep this plugin disabled for now

[J-Tanzanite]

Yeah, I watched the video, and instantly noticed the teleport wasn't the issue, it's their view getting modified.
So this is a map specific issue.

This means it can't be fixed by adding a check for map teleports, because that wasn't the issue.
I'm not sure it's possible to check if the map is modifying your view, but I suspect there might be a way...
I'll look into that.

As far as I know, you can set map configs, which I know is possible in TF2, should be possible in CS:GO as well.
Since this is a specific map issue, I recommend enabling the plugin, keeping Angle-Cheat detections on and adding a config for this map, which disables Angle-Cheat detections.

If map configs don't work or you can't get them working, then just disable Angle-Cleat detections, and you should be fine.

---

Anyway, thanks for the report, I'll look into detecting if a map is modify a player's view :)

[azalty]

Oh btw I forgot to add that, but I'm pretty sure that's the crash's reason too. However, this is now kinda old and I don't think I saw any error in the logs, so pretty unsure as why that would happen.

[J-Tanzanite]

Oh yeah, I forgot to reply to this...

A LONG time ago, I found this entity flag that relates to players FL_ATCONTROLS.
And I wonder if it's possible that this flag gets set when a player is controlling such a map object, like so:

if ((GetEntityFlags(client) & FL_ATCONTROLS)) {
        // Ignore angles?
}

The description of this flag from the SM api is:
#define FL_ATCONTROLS (1 << 6) /**< Player can't move, but keeps key inputs for controlling another entity */

I also found this flag, with this description:
#define FL_ONTRAIN (1 << 3) /**< Player is _controlling_ a train, so movement commands should be ignored on client during prediction. */
No idea what that's for...

[azalty]

@J-Tanzanite that could be interesting

I assume FL_ONTRAIN was for older games, or probably for something that didn't get finish as func_tanktrain? The only thing I can see is for Half Life and CS 1.6 where you could control a train, which was often used for controlling vehicles in CS 1.6 custom maps

FL_ATCONTROLS and FL_ONTRAIN should probably have the same effect and should be checked together imo

[J-Tanzanite]

Would you be able to run a test on this?
I currently don't have my computer (only weak laptops) and cannot do any testing myself.

Something like this as a standalone plugin should at least tell you if it works:
Pseudocode:

#include <sourcemod>

static bool flagged[MAXPLAYERS + 1];

public void OnClientPutInServer(int client)
{
	flagged[client] = false;
}

public Action OnPlayerRunCmd(int client, ... )
{
	if (!is_player_valid(client) || IsFakeClient(client))
		return Plugin_Continue;

	if ((GetEntityFlags(client) & (FL_ATCONTROLS | FL_ONTRAIN))) {
		flagged[client] = true;
		PrintCenterText(client, "You are flagged!");
	}
	else if (flagged[client]) {
		flagged[client] = false;
		PrintCenterText(client, ""); // Remove center text.
	}

	return Plugin_Continue; // Edit: Forgot to add this... Hope you enjoy my bad coding style btw ;) 
}

bool is_player_valid(int client)
{
	return (client >= 1 && client <= MaxClients
		&& IsClientConnected(client) && IsClientInGame(client));
}

[azalty]

else if (flagged[client]) {
		flagged[client] = false;
		PrintCenterText(client, ""); // Remove center text.
	}

wouldn't that break the purpose since OnPlayerRunCmd runs 64 times a sec (I think? I think it's based on the tickrate)

[azalty]

Works!

Forget what I said earlier, but for some reason, the text flashes (?, google translate told me that was the right word but i'm not sure). Basically it spams it.

Since i'm not sure it is intended or not (whether or not spamming PrintCenterText(client, "You are flagged!"); makes it flash), I'll test further

[azalty]

Quick update!

Changed how it works. New code:

#include <sourcemod>

int flagged[MAXPLAYERS + 1];

public void OnClientPutInServer(int client)
{
	flagged[client] = 0;
}

public Action OnPlayerRunCmd(int client, ... )
{
	if (!is_player_valid(client) || IsFakeClient(client))
		return Plugin_Continue;

	if ((GetEntityFlags(client) & (FL_ATCONTROLS | FL_ONTRAIN))) {
		flagged[client]++;
		PrintCenterText(client, "You are flagged! (%i)", flagged[client]);
	}
	else if (flagged[client]) {
		flagged[client] = 0;
		PrintCenterText(client, ""); // Remove center text.
	}

	return Plugin_Continue; // Edit: Forgot to add this... Hope you enjoy my bad coding style btw ;) 
}

bool is_player_valid(int client)
{
	return (client >= 1 && client <= MaxClients
		&& IsClientConnected(client) && IsClientInGame(client));
}

flagged becomes an int that increments every time OnPlayerRunCmd is called and player passes this check: GetEntityFlags(client) & (FL_ATCONTROLS | FL_ONTRAIN). It resets to 0 when the player no longer passes the check.

---

Video 1: https://youtu.be/FhKrq5qYojk
Behaviour: number increments normally, as intended

---

Video 2: https://youtu.be/qeURQetdvow
Behaviour: number increments unequaly, and resets after some time. The map could be using an hacky technique, but that could cause a ban, since if the number resets, it means the user is no longer counted as in FL_ATCONTROLS (I think FL_ONTRAIN doesn't do anything)

[J-Tanzanite]

I'm not overly concerned with the unequal increment, because we're going to use a timestamp as a timeout, and not this check on each tick to prevent Angle-Checks.

You see, when a player teleports, they are put into a 5 second timeout, where they cannot be checked for angle-cheats.
This is done to prevent map/game weirdness, as teleports can set player's angles.
You can see this effect here:

Little-Anti-Cheat/scripting/lilac/lilac_angles.sp

Line 22 in 7f819fc

|| playerinfo_time_teleported[client] + 5.0 > GetGameTime())

(Note, Angles are still patched during this timeout).

The trick would be to do this test per tick, and if a player is "ATCONTROLS", then set a timestamp to the current time.
And inside of the angle checker, just ignore players who recently had this flag.

---

As long as the sudden stop of the AT_CONTROLS don't last for too long, this shouldn't cause an issue.
That said, it's weird that it doesn't increment normally.
Are you aware of any other map with vehicles or something players can take control over?

[azalty]

As long as the sudden stop of the AT_CONTROLS don't last for too long, this shouldn't cause an issue.
That said, it's weird that it doesn't increment normally.
Are you aware of any other map with vehicles or something players can take control over?

Yes, but not ones that modify view angles to my knowledge. This "issue" is probably only related to edge cases like this one

[J-Tanzanite]

I ask because it would still be good to know if FL_ATCONTROLS is fluctuating when controlling objects, regardless if they affect your angles. :)

[sapphonie]

Need more info, closing until it is provided. Feel free to PR