What methods do game hacks use to counter anti hack systems?

Question

In popular multiplayer first person shooter games, there are often hacks such as Aimbot, Noclip, Speed, and other similar hacks which I know game developers deploy anti hack features to combat, but, wanting to know why some of these hacks are able to get past these systems, I looked up a hack for the game I'm currently playing and they claim to deploy "counter measures" against the anti hack systems.

My question is, when everything happening is being seen by the game server, how can hacks avoid the anti-hack system? Movement that's too fast for example seems impossible to hide. Moving through walls also seems impossible to hide. Finally aimbot is a difficult one, maybe there's no very good solution to detecting it, if the hack developer, for example, purposely makes it imperfect.

My question to game developers is: How can anti hack systems fundamentally detect speed, noclip, and aimbot hacks, and how can hack developers fundamentally deploy counter measures against systems to detect those three types of hacks?

Answer 1

There are three types of "hacks" used for video games.

• Packet modification: Modifying the data sent to the server.
• Server hack: Gaining access to the server and performing unauthorized commands.
• Client modification: Modifying the client to perform something that only affects how you see the game.

We can sort these into different categories for examples.

Speed hacks: These are "packet modification" hacks. These modify the data that is sent to the server.

The best way to prevent this is to validate the information sent. Check if the player is moving faster than the default move speed.

Aimbots: These can be either "packet modification" or "client modification".

If it's client modification, it will just point yourself towards an enemy when it sends data to a server. To prevent this, make the player not able to turn extremely quickly, as that will be the result of this type of hack.

If it's packet modification, it will make your projectiles always point towards the nearest enemy. To prevent this, don't let the client update details about the bullet while it is moving.

Noclip: Another type of packet modification. Allows the player to move through walls, and if the server doesn't check if the player's in the wall, then this is possible.

See through walls/similar: This is client modification. There's no way to prevent this currently (correct me if I'm wrong).

Answer 2

Moving through walls also seems impossible to hide

Let's look at a simple scenario:

In this diagram, a player is running around this protruding wall. However, due to some connection issues, all packets along the red line are dropped and the server never receives them. The connection improves and the server starts receiving packets with the player now on the other side of the wall. Did the player cheat? Of course not, they moved correctly around the wall on the client side, but the perception of the server is now that they moved through the wall. This kind of situation is exactly what makes anticheat so difficult to implement. As a result, they tend to focus on other situations/methods for detection of cheating.

I saw VAC mentioned in another answer, however I feel the information provided there is either misleading or wrong. VAC accomplishes cheat detection by looking for known cheats in the game, using a library of previously discovered cheats. Getting around VAC detection is as simple as writing your hack in a novel way. As long as it's not similar to some other hack in it's execution, it'll likely be undetected by VAC. VAC Documentation Punkbuster works in a similar way, along with scanning game files in memory to verify they've not changed periodically.

So, I guess to put it simply. Circumvention of anticheat really is not too hard; It's as simple as coming up with a new way to hack the client.