Implement AntiCheat System - AntiHacks: by kvipka · Pull Request #23509 · TrinityCore/TrinityCore

kvipka · 2019-06-24T17:34:46Z

-ASH - AntiSpeedHack (+anti teleport hack)
-AFH - AntiFlyHack
-DoubleJump
-Wallclimb
-FakeJumper
-FakeFlyingMode

This system has been tested on some big projects with big online (project names are hidden).
Issues: No false positives

For some questions : discord -
https://discord.gg/GcJJfXG

youtube videos : https://www.youtube.com/watch?v=aZP3qm9Ql0Y&list=PLUpIDd4JDWyOOJhJRcfaVL0RaRH1Ra5Xy

Note:
This system using only mathematic operations, without additional manager as AC2, no using additional memory.

Part of code can be shorter, when PR with ACK-packet handlers will complete.

kvipka · 2019-06-24T17:35:51Z

since some began to sell this code (violating copyrights), I consider such behavior to be incorrect, and I post this code for free use

ELdoBA · 2019-06-24T18:09:45Z

onsider such behavior to be incorrect, and I pos

Nice. Anyway, we all know you are a real author 😜

FrancescoBorzi · 2019-06-24T18:25:13Z

@kvipka good job!

searcas · 2019-06-24T18:29:11Z

@kvipka Unfortunately people won't be thankful for this.
Anyway respect.

Killyana · 2019-06-24T18:52:48Z

We are thankful to everyone who contribute to the project, specially with this kind of PRs.

kvipka · 2019-06-24T19:16:25Z

+###################################################################################################
+#    AntiCheats.FlyHackTimer
+#        Description: Timer for AntiCheat FlyHack check
+#        Default:     3000 - 1 check in 1 second


1 check in 3 second
for big projects better (1500ppl +) set 5000 (5 sec) or more

so, add this description in conf file to clarify and not miss the information ;)

# Default: 3000 - 1 check in 1 second 1 check in 3 second # Default: 3000 - 1 check in 3 seconds

:P

Winfidonarleyan · 2019-06-24T21:26:47Z

Wow, very good

jackpoz · 2019-06-25T06:10:49Z


+        if (target)
+        {
+            std::string _canfly = handler->GetTrinityString(LANG_ERROR);


_canfly is initialized but then its value is replaced 1 line below

jackpoz · 2019-06-25T06:13:38Z

I will try to queue this PR to be merged in the test server (either by creating a new realm or waiting for the current PR in test to be merged)

Aokromes · 2019-06-25T08:29:58Z

few cosmetic things:

anticheat:919: trailing whitespace.
LANG_GM_ANNOUNCE_AFH_CANFLYWRONG = 6618, // AntiFlyHack - flying without canfly
anticheat:1051: trailing whitespace.
unitCaster->GetMotionMaster()->MoveCharge(pos.m_positionX, pos.m_positionY, pos.m_positionZ);
anticheat:1070: trailing whitespace.
return;
anticheat:1272: trailing whitespace.

Kittnz · 2019-06-25T09:04:55Z

When ack packet handlers are implemented we can also add teleport hacking detection

kvipka · 2019-06-25T09:08:28Z

Teleport hack also not working, just because it usual step with wrong distance, and blocked by ASH

jackpoz · 2019-06-25T09:47:34Z


 void Player::Update(uint32 p_time)
 {
+    if (!GetSession())


does this skip some more stuff than what the !IsInWorld() check below skips ?

This is an impossible condition.

Jildor · 2019-06-25T10:01:36Z

+        if (ToUnit()->IsFalling() || IsInFlight())
+            return true;
+
+        if (GetTransport() || GetVehicle() || GetVehicleKit())


So if we mount on vehicle and use hack, can we ignore hack check here?

Yes.We can get speed of vehicle? If yes, need to add it

I think we can get speed of vehicle, but I'm not sure if here we can.
in WorldSession::HandleMovementOpcodes I think yes

Jildor · 2019-06-25T10:03:34Z

+
+        GetPosition(x, y);
+
+        TC_LOG_INFO("anticheat", "Unit::CheckMovementInfo :  SpeedHack Detected for Account id : %u, Player %s", GetSession()->GetAccountId(), GetName().c_str());


Maybe should be:

"Player::CheckMovementInfo : ...

instead of

"Unit::CheckMovementInfo : ...

P yep, early it was in unit, and yes, need to rename

Riztazz · 2019-06-25T10:15:34Z

+        movetime = movementInfo.time;
+        realping = GetSession()->GetLatency();
+        ping = realping;
+        if (ping < 60)


use std::min instead
edit: derp ;p

maybe std::max ? =)

Jildor · 2019-06-25T10:15:52Z

@@ -0,0 +1,15 @@
+-- Strings for ASH + AFH allerts


well, the name of the sql will be renamed, so it does not matter much, but, better not use capital letters in the file name

Aokromes · 2019-06-30T08:54:14Z

a low level hunter on one elevator xd

Player::CheckMovementInfo : Climb-Hack detected for Account id : , Player , diffZ = 2.124893, distance = 0.000000, angle = 0.000000, Map = Kalimdor, mapId = 1, X = -5381.604492, Y = -2488.781494, Z = 49.361019

kvipka · 2019-06-30T15:17:02Z

added check for first step on elevator for except wallclimb this false/positive

Aokromes · 2019-06-30T16:44:50Z

plz don't push --force or we can miss sql changes.

Aokromes · 2019-07-01T11:02:46Z

creature 667 sometimes casts one spell on player making it to false positive
Ignore control Hack detected
plz add coords there too xd at least on log.
Player must have equiped weapon 7717, but i am unable to reproduce the log 100%

Aokromes · 2019-07-04T20:21:04Z

it looks hunter's feing dead is reason to this bug a lof of times.

kvipka · 2019-07-04T20:27:17Z

maybe you missed this code ?
https://github.com/TrinityCore/TrinityCore/pull/23509/files#diff-e896389d5b1073efabc2ffa33ec49d55R2239

kvipka · 2019-07-04T20:28:43Z

ohh, rly my mistake.
Bad copied from repo. good catch

Aokromes · 2019-07-04T20:29:17Z

nope, i git apply.

Aokromes · 2019-07-05T23:50:06Z

still false positiving xd maybe it's the hunter feigns when it's stunned?

kvipka · 2019-07-05T23:51:35Z

Can you add info from logs?

Aokromes · 2019-07-05T23:54:09Z

there is nothing more:

Player::CheckMovementInfo : Ignore control Hack detected for Account id : , Player

Maybe include a log of debufs can help?

kvipka · 2019-07-06T00:05:59Z

i think not needed.
Can you play this trigger yourself? Sure that the problem is really a normal player? And if you can to reproduce - record a video please. Neither me nor the players - it does not come out to get a similar result.

Aokromes · 2019-07-06T00:25:15Z

yes, she is a normal player, i even spoke with her and told to use feign a lot of times and sometimes it was show and most no.

kvipka · 2019-07-06T01:08:40Z

try this, i can't to check it on weekend. Strange, but it first idea

Aokromes · 2019-07-08T17:06:28Z

the coding standards of
Conflicting files
src/server/game/Entities/Object/Object.cpp
src/server/game/Entities/Object/Object.h
arent needed anymore

kvipka · 2019-07-08T17:13:28Z

wuuut?
https://github.com/TrinityCore/TrinityCore/pull/23509/files#diff-29afb15ead2a8204cac07d94f074f260R3120

anyway - all questions about some troubles here

-ASH - AntiSpeedHack -AFH - AntiFlyHack -DoubleJump -Wallclimb -FakeJumper -FakeFlyingMode

ghost · 2019-07-31T11:34:18Z

@kvipka I found false positives:

--GM account
2019-07-31_14:02:29 Player::CheckMovementInfo :  SpeedHack Detected for Account id : 1, Player Test
2019-07-31_14:02:29 Player::CheckMovementInfo :  oldX = 16222.987305
2019-07-31_14:02:29 Player::CheckMovementInfo :  oldY = 16245.895508
2019-07-31_14:02:29 Player::CheckMovementInfo :  newX = 16222.822266
2019-07-31_14:02:29 Player::CheckMovementInfo :  newY = 16246.409180
2019-07-31_14:02:29 Player::CheckMovementInfo :  packetdistance = 0.539534
2019-07-31_14:02:29 Player::CheckMovementInfo :  available distance = 0.483057
2019-07-31_14:02:29 Player::CheckMovementInfo :  movetime = 1152544896.000000
2019-07-31_14:02:29 Player::CheckMovementInfo :  delay sent ptk - recieve pkt (previous) = 0.000000
2019-07-31_14:02:29 Player::CheckMovementInfo :  FullDelay = 0.000007
2019-07-31_14:02:29 Player::CheckMovementInfo :  difftime = 0.060007
2019-07-31_14:02:29 Player::CheckMovementInfo :  latency = 0
2019-07-31_14:02:29 Player::CheckMovementInfo :  ping = 60

--Player account
2019-07-31_14:07:46 Player::CheckMovementInfo :  SpeedHack Detected for Account id : 2, Player Player
2019-07-31_14:07:46 Player::CheckMovementInfo :  oldX = -703.699951
2019-07-31_14:07:46 Player::CheckMovementInfo :  oldY = 2727.541260
2019-07-31_14:07:46 Player::CheckMovementInfo :  newX = -703.277954
2019-07-31_14:07:46 Player::CheckMovementInfo :  newY = 2727.940674
2019-07-31_14:07:46 Player::CheckMovementInfo :  packetdistance = 0.581045
2019-07-31_14:07:46 Player::CheckMovementInfo :  available distance = 0.420049
2019-07-31_14:07:46 Player::CheckMovementInfo :  movetime = 1152861952.000000
2019-07-31_14:07:46 Player::CheckMovementInfo :  delay sent ptk - recieve pkt (previous) = 0.000000
2019-07-31_14:07:46 Player::CheckMovementInfo :  FullDelay = 0.000007
2019-07-31_14:07:46 Player::CheckMovementInfo :  difftime = 0.060007
2019-07-31_14:07:46 Player::CheckMovementInfo :  latency = 0
2019-07-31_14:07:46 Player::CheckMovementInfo :  ping = 60

Anticheat falsely triggered when the client started on the same machine as the server.

jackpoz · 2019-08-02T14:06:26Z

could you fix the merge conflicts ?

Aokromes · 2019-08-14T01:15:02Z

if you wipe on malygos 3rd phase it false positives a lot.

ghost · 2019-08-14T04:24:08Z

@Aokromes Strange, but there the anticheat does not give false positives for me. In general, I noticed such a problem that false positives occur completely randomly. For an example: at any movement of the character on the GM Island, the anticheat falsely reacted to my character. The funny thing is that this problem was solved by restart the server, which in principle can mean that the problem may not be in the anticheat itself.

Shauren · 2019-08-14T06:57:33Z

@Infernales It actually can be anticheat, if the reason is something like uninitialized variable (even relog could make it behave differently) or if its related to timers (restarting resets the value for getMsTime())

Aokromes · 2019-08-14T07:39:09Z

@Infernales you wiped there on 3rd stage?

ghost · 2019-08-14T07:43:53Z

@Aokromes Yes.
@Shauren In fact, anything can be there, I just expressed my assumption. I also noticed that the longer the server runs, the more false positives the anticheat has.

ghost · 2019-08-14T08:46:29Z

@kvipka Thx for update.

Aokromes · 2019-08-14T08:55:57Z

Conflicting files
src/server/database/Database/Implementation/LoginDatabase.cpp
src/server/database/Database/Implementation/LoginDatabase.h
src/server/game/Entities/Object/Object.cpp
src/server/game/Entities/Object/Object.h
src/server/game/World/World.h

Killyana added Branch-3.3.5a Comp-Core Feedback-PatchFix Sub-Miscellaneous Sub-Movement labels Jun 24, 2019

kvipka commented Jun 24, 2019

View reviewed changes

jackpoz mentioned this pull request Jun 25, 2019

Test Realm Pull Requests to merge jackpoz/TrinityCore#74

Closed

2 tasks

jackpoz reviewed Jun 25, 2019

View reviewed changes