Anti-Cheating system: Need expierienced help!

[Ouguiya]

Hello everyone!

The thread I am opening today requires that I write in some detail what this is about and how to achieve it.

As you probably all know, and all of you who have made maps which had some downloads probably have also painfully felt, maps are being hacked on a grand scale nowadays. The goal of the hackers mostly isn't stealing the map, but introducing cheats, which really ruins the good name of a map when unknowing players get blasted by cheats.

Besides being frustrated and protecting one's map, it's not really easy to do much about it, since the map script can be edited even with protection.

Most people don't know enough about JASS to introduce cheats, but some do, and these people found it worthwhile to make tutorials and "copy-paste-ready" JASS code for noobie-cheaters to directly import.


With this thread, I want to start something which will at least hinder their work. (And yes, to all the fine critics out there, I know, there is no perfect guarantee of stopping them. Yes, I know, a pro will have no problems at all with this, but the goal, like with map protection, is to stop noobs from doing it, since pros hopefully have better things to do with their skills.)


The important idea came from (thanks man!) Windexisback. I will quote what he said in the thread about map protection here:

there are multiple ways.
I don't know the exact name (or method) but there are scripts which detect the number of functions, and if it's higher than a set amount (aka: someone added more) it stops the game, or something akin to that. Someone needs to clarify this one.
Name functions weirdly, and use equations in place of set numbers. 5 = 2+2(2-1)-1 = 5 *hopefully* This method shouldn't be used in functions which are used often.

Monitoring variables such as hero level, kills to death ratio, average damage, resources, health, ect. A weird number either means one kick ass player, or one shitty ass one. Once again, fragment (and try to mislead) what the functions do. The messier you make them, the better.

The weakest anti-cheat method I can think of is simply detecting common cheat strings from your hacked map. Once again, fragmentation and misleading will make it a pain in the ass for the deprotector.


It's very hard to stop the map from opening, but you can make it a pain to do anything on it.

This, in my opinion, is a wonderful idea.

To his first suggestion: The script which can detect how many functions there are, and perform an action if it detects a change sounds really cool. However, I really wouldn't know how to do it. If anyone has any ideas or maybe even the script itself would do all of us a great favor by explaining how to do it here.

The second suggestion is also good: Monitoring all the important things and ringing the alarm bell when something is wrong would also be great.

The problem with this is the amount of things to be monitored. I hope here, to get a comment from any of you who have any idea how to do it.

I searched around the net a bit and found multiple tutorials how to deprotect maps, and they include pre-made cheats for all of this:

"-cheats on" Turns cheats on
-additem Adds random item
-mp x Sets your mana points to x
-hp x Sets your health points to x
-gold x Sets your gold to x
-lumber x Sets your lumber to x
-lvl x Sets your lvl to x
-xp x Sets your xp to x
-str x Sets your strenght to x
-agi x Sets your agility to x
-int x Sets your intelligence to x
-ms x Sets your movementspeed to x
-kill Kills the target unit
-invul Makes you invulnerable
-vul Makes you vunerable
-nocd Turns no cooldown on
-cdon Turns cooldown on
-mana Infinte mana
-nomana Turns infite mana off

So it's really difficult to monitor ALL of this, but like I said, if anyone has an idea...


Third, the idea with the strings of course is cool, although, like Windexisback said, it's quite easy for a would-be cheater to eliminate this, by renaming his functions, but it is a nice addition nontheless.


With this, I hope that some of you have an idea on to how to at least make it a pain for anyone who cheats. Hopefully, this will be sufficient to make these people think: "Yeah, I really have better things to do."

Thanks in advance, as always:

Yours,

Ouguiya

 

[Faust]

Why bother?

 

[Ouguiya]

Well, for two reasons mainly:

First, it ruins the any good name which your map might have had or could have, which is not really desirable.

Second, it is disadvantageous and frustrating for EVERYONE except the cheater. All others have the problem of not being able to win any more just because someone felt the need to cheat, which ruins the game fun.

As map creator, you, and only you have the power to do anything against this, so I actually almost see it as a responsibility of any serious map maker, to ensure that his map remains cheatfree.

 

[Faust]

As a player, you have the right to leave the game at any time.

No one is going to bother to deprotect a map not even famous. When it's very well known, you will probably have a forum or any website where the players should download it from.

Dota is not difficult to deprotect, they say, yet I've never seen a haxed version. I just download it from the internet when new one is out.

So stop being paranoid.
You don't even need to protect it, I only like it because it reduces map size.

 

[WolfieeifloW]

Yeah.
Not to be rude at all Ouguiya;
But I doubt your map will get good enough for people to truly take interest in hacking it.
It's not just you though;
Most of the maps made nowadays never get big due to DotA.

Sort of sad, but it's the truth.

 

[8uY_YoU]

Yeah.
Not to be rude at all Ouguiya;
But I doubt your map will get good enough for people to truly take interest in hacking it.
It's not just you though;
Most of the maps made nowadays never get big due to DotA.

Sort of sad, but it's the truth.

Yeah, except you create an Anime map
or map with fun models

 

[BlackRose]

you will probably have a forum or any website where the players should download it from

+1

eg:
DotA = getdota.com
Element TD = eletd.com

 

[cowmenace]

I don't understand why these assholes can't just have fun. The game was made for having fun, why spend time ruining countless hours of work? These fucking douchebags need a lobotomy if they're that addicted to never being bored or sad

 

[bOb666777]

@faust: Not everybody knows how to have a website, or a decent one, or are ready to pay for one.

I think this could be a good idea, except 2 anti-cheat systems already exist on this website. I made my own once, but decided not to release it..... for the reason mentionned above: we already have 2.

 

[TriggerHappy]

To his first suggestion: The script which can detect how many functions there are, and perform an action if it detects a change sounds really cool.

That has already been done, and someone submitted it on this site.

It's easy as hell to remove, though.

Stop finding ways to protect maps, just make sure you have an honest audience. People ruin the games for themselves if they cheat, let them decide.

 

[WindexIsBack]

He seems pretty set in this idea, so I doubt telling him to do something else will work.

 

[Ouguiya]

Hello all again!

First of all, a big thanks to all the smashing, yet a bit unnecessary criticism of the idea.

To respond to some here: First, I really do not care one iota, if my map becomes famous. I hope that this is clear enough.

Next, famous or not famous, creating a map which already contains cheats is seen as really bad and is mostly heavily criticized. Creating a map though which allows cheats isn't all that better is it?

The main problem for me is that when people download a faked version and get roasted because someone put cheats in it, this, like I said, is fun for no one, except maybe the cheater.

I see absolutely no reason to simply stand by and do nothing, while the people who I made the map for, and which I hoped would have fun with it, are having their fun ruined by a hacked map.


Also, what Triggerhappy said is very true. I really wouldn't be bothered if this were a campaign and the players had to play on their own. But here, 11 other players have their game ruined because one, as Triggerhappy put it "ruins it for himself".


Besides, let's not delude ourselves here, gentlemen. If Blizzard wouldn't have such a "shoot, and ask questions later"-anti-hack and cheat policy, the game would have been ruined by maphacks and all other similar things.

The fact that Blizzard relentlessly banned cheaters and inserted anti-hack-measures was what really did the trick to keep battle.net much more cheating-free than other platforms.


They were wise enough to understand the fact that cheats are fine in a single-player campaign, but that they suck and ruin everyone's fun when used in multiplayer.

And, like Blizzard, I do not intend to sit and watch.


So, in a way, Windexisback was quite right.

bOb666777s post was interesting, I will have a look at those Anti-Cheating systems, but also probably design my own.


Thanks anyway.

Yours,

Ouguiya

 

[the_ideal]

99% of the people who would want to steal credit for your map or insert cheats are noobs, and are too stupid or don't have the attention span to figure out how to deprotect a map.

99% of the people who have the knowledge/dedication to deprotect a map aren't interested in stealing your map or inserting cheats. For them, it's a waste of time during which they could be making a map better than yours.

 

[Xienoph]

Here's a foolproof way to do it:
- Generate a public and private key
- Take your map, hash it, and produce its digital signature using your private key
- Base64 encode the digital signature, and put it as part of the map's file name.

For other people to verify that noone has modified your map, they need to:
- Remove the digital signature from the map's name
- Hash the map.
- Take the digital signature, and use the public key to apply the one way function. Check that the result of this step equals the map's hash.

You can use SHA256 as Hash function, RSA for the public key cryptography and one way function.

Why does this work?
If even one bit of your map is changed, the digital signature will change, and the verification step will fail. This way, you can make sure that the map you're playing is unmodified.

The catch:
- You'll need to keep a website with your public key. Let's hope this site is safe.
- Digital signature tends to be long, especially after you Base64 encode it. You'll end up with a really long file name.
- Will anyone even bother going through all these steps to check if a map is unmodified?

</impractical suggestion>

Yeah, I'm :nuts:.

 

[Cookiemaster]

Warcraft 3 TFT Patch 1.23 Changelogs
--------------------------------------------------------------------------
- Features:
• Battle.net now uses a new banner ad system.
- Fixes:
• Fixed an exploit where an altered custom map would be seen identical to the original custom map .Fixed an issue where some patches could not apply on Intel Macs.

This problem was kind of fixed, wasn't it?

 

[Ouguiya]

Hello again!

Thanks for those two replies.

First, to Xienoph's suggestion: I must admit it sounds great, but what I want to do is really a system inside the map which prevents the cheater from using his injected code, or alerts the users at least that the map they are playing is cheated and modified.

@Cookiemaster: Yes, this bug has been corrected, but this does not really resolve the problem. Why? Well what the hacker does (at least in my particular case), he simply takes the map, inserts his cheat codes, and then uploads it to epicwar.

People then download it from there, thinking "hey this is the real thing", and then the cheater can use his cheats whenever he wants, as well as anyone else knowing the syntax.

So it's actually spreading a cheated version that is the problem.

 

[Cookiemaster]

Hello again!

Thanks for those two replies.

First, to Xienoph's suggestion: I must admit it sounds great, but what I want to do is really a system inside the map which prevents the cheater from using his injected code, or alerts the users at least that the map they are playing is cheated and modified.

@Cookiemaster: Yes, this bug has been corrected, but this does not really resolve the problem. Why? Well what the hacker does (at least in my particular case), he simply takes the map, inserts his cheat codes, and then uploads it to epicwar.

People then download it from there, thinking "hey this is the real thing", and then the cheater can use his cheats whenever he wants, as well as anyone else knowing the syntax.

So it's actually spreading a cheated version that is the problem.

Which is why you should put a site up, some random invisionfree board for that matter, with links to the real versions. Put that on the loading screen, map description and in the F9 (quests) menu, and you're done.


Ofcourse, there will still be people downloading the cheated version, but the amount who do that is greatly decreased.

 

[Ouguiya]

Well, yeah... I guess I should do so.

Problem is, I already wrote numerous times in the game that the people should download it from hiveworkshop (where things are more tightly secured than for example on epicwar).

I still however see many people download from elsewhere, even though it's not advised.

Don't get me wrong, I will of course do many things like that (like writing messages, an official download site etc.), but I still would love to make it even more difficult for cheaters to achieve their goals.

Thanks in any case.

Yours,

Ouguiya

 

[PrisonLove]

Ouguiya, what you're trying to do is very noble, but unfortunately I think it may just be a waste of time. There absolutely are cheaters out there who will try to steal your map, or insert cheats, but the fact remains that there aren't enough of them out there to warrant so much effort in stopping them. It's clear that you're going to push along with this, but I just want you to know that it may be a waste of time. You said it yourself, there is no 100% guarantee to stopping them. Even if you're just trying to stop the "noobs" (I hate that word with an undying passion), they are the ones that aren't a threat to your map.

I wouldn't worry about it, there aren't that many cheaters out there, and it's not really worth the effort. Besides, it's not like anybody is making money off of this.

 

[Legacyspy]

No one is going to bother to deprotect a map not even famous. When it's very well known, you will probably have a forum or any website where the players should download it from.

This isn't true. If your map has some sort save/load people will always make a hacked version, in order to load the code they want into the real map.

Dota is not difficult to deprotect, they say, yet I've never seen a haxed version. I just download it from the internet when new one is out.

Up until recently there were collided maps, where a hack map could be used in the same game with regular maps, yet only you would know. This would allow things like never ending spells. Also there are plenty of hacked DotA AI and 6v6 maps.

Anyone with no skill what so ever can insert cheat codes like the one listed in the O.P because of many step by step guides and copy and paste code. A lack of popularity won't stop a map from being hacked.

99% of the people who would want to steal credit for your map or insert cheats are noobs, and are too stupid or don't have the attention span to figure out how to deprotect a map.

99% of the people who have the knowledge/dedication to deprotect a map aren't interested in stealing your map or inserting cheats. For them, it's a waste of time during which they could be making a map better than yours.

The most common methods of adding cheats into a map don't even need it to be deprotected. You can simply use a couple programs to insert cheats into a map, and since the methods have already been figured out and written down in explicit steps any "noob" can do it. A lack of knowledge or skill doesn't prevent anyone from hacking a map.

If one doesn't even have the skill to follow directions, there are whole forums where you can upload a map you want and some one will add the cheats you want.