# Anti-Cheat for MMOs issues and solutions? [closed]

Most online games suffer for this problem and there are some software companies out there to cover this but recently from what I've seen most companies are trying to avoid those programs creating their own system (blizzard with warden, aion with their own checking, etc...) but it is a very difficult case to prevent such ...

Just wanted to say i made another question topic as community wiki specific for posting applications and it is features and the ideas behind this question here is not to list those but instead to know more about what were your attempts, issues along the road and possible solutions, piece of codes if application and so forth.

What sort of protection do you guys use in order to (try to) prevent such acts:

1. Anti-cheat Software ? (please state which, why and possible problems you faced, for example aion stopped using GameGuard at beta stage due to a huge amount of compatibility problems and complains from their users)
2. Your own code ? (what sort of verification do you usually run to make sure of the bad-faith players, for example speedhack, verify new location against speed+last location, etc...)
3. None, i dont care ? (any personal reason or input you did like to share ?)

Any interesting piece of code related to the issue you would like to post ?

Feel free to rework my text my english inst that great ?**

## closed as too broad by Josh♦Apr 21 '14 at 15:01

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

• Tag made. If you expect for this to have a large amount of answers please make it community wiki. It will allow multiple people to edit individual answers instead of people constantly restating them. – Jesse Dorsey Jul 25 '10 at 16:23
• For an example of how this could be beneficial. Check out this: gamedev.stackexchange.com/questions/480/… – Jesse Dorsey Jul 25 '10 at 16:23
• Thanks for the comment and links i will check it out now and see, in my point of view this kind of question for game development is a very good point for discuss but most for the MMO games i belive so i am not sure, also the community is pretty small at the momment and i was afraid of being negativated for such a question to begin with so i am not sure, thanks for creating the tag :) – Prix Jul 25 '10 at 16:49

Unfortunately it's really hard to stop people from cheating, which is why software like Punkbuster was created to try to catch some of them.

For an MMO, the biggest thing you can do is to just not trust anything the client sends you. The client should not be able to tell you where the player has moved to, how much damage they have dealt to whom, etc. Instead, you should send control input to the server, validate that it is practical (pressing the "attack" button 1000 times in 1 second, for example, is not valid), then update the simulation on the server. You would then send the relevant parts of the new state of the game back to the client.

While you are validating user input, it is also possible to look for trends in their input. If you don't allow macros, you could catch them here by noticing that the user has clicked the same button at the exact same pixel coordinates in perfect 1 second intervals for the last 30 minutes.

The client itself is the main place people can cheat, so programs like Punkbuster can cut down on wallhacks, aimbots, etc. Other than that, not trusting the client and validating anything sent to you by the client will help cut down on cheating.

• Thanks for your contribution i hope to see more people doing their input; Indeed this is a very hard issue to counter... There is also those who crack down the game to disable the anti-cheat engine and it is call from it ...which makes things even harder ... unless you have a online GM to verify that given person or others verifications like you stated. what would you think as this question for community wiki ? should i keep as is or change something to make it fit for it; – Prix Jul 25 '10 at 17:29
• Probably community wiki unless you are looking for a specific answer. – Sean James Jul 25 '10 at 17:42
• Any more details on how Punkbuster works for a more complete answer? – Chris Lloyd Aug 3 '10 at 21:04
• Good answer - there is not 'one solution to rule them all' - most games have multiple 'attack vectors'. Often it's about risk assessment more than anything else i.e. what is the impact on the community if someone can cheat system X etc – zebrabox Aug 3 '10 at 21:52
• I believe hacking is inevitable, even have the strongest anit-cheat program. Cheating is okay if offline technically but not online. Playing online is more on fairness. Is that so? – David Dimalanta May 3 '13 at 9:55

Logging. Everything that happens on the server should be logged, and ideally everything that comes from the client. The client is inherently untrustworthy, but even logging untrusted data can be illuminating.

Once everything is logged, cheat detection becomes a matter of analysing the data. Some cheats will be obvious (values out of acceptable ranges, for example being able to move between points far faster than the avatar normally allows), others are more insidious (like aimbots allowing pixel perfect targetting within artificially short timeframes). Some are even harder to detect (like wallhacks), but recording as much as possible allows both automated and manual detection. There are various articles on it, but generally cheats are very easily spotted in automated detection because they are so predictable/repeatable, in exactly the way that human players aren't.

Since recording absolutely everything is most likely infeasible, tiered logging is useful. For example reports of cheating by users, or simple basic logging that detects the possibility of cheating (score which are way above the statistical curve), would be enough to flag a particular client/account/CD-key for more verbose logging, which could then be used to prove beyond reasonable doubt that a cheat is in use.

What you do when you detect a cheat is another matter entirely. Account banning after the fact is good, especially when you have an automated detection mechanism that is sufficiently reliable. Banning early both alerts the cheats that they are being detected, and also runs the risk of false positives due to inconclusive detection mechanisms. Banning too late runs the risk of ruining the game experience for others. This is a very grey area, and requires the developers to make the judgement call.

Assuming all important work in your game is occuring server-side, there should be little or no cheating possible. If you want to restrict macroing or make it obnoxious for people to packet-edit, have your program periodically scan for modules active in its process. If you find for instance WpeSpy.dll, you'll know they have WPE attached. Do so for the other common tools. This can be got around, and is an arms-race and a lost cause, but if your game is relatively small, you can very easily cut the number of people screwing around by about a factor of ten... and that may be good enough for you.

• Thanks for the contribution, have you used any anti-cheat software or had this sort issue that you had to take care of ? if so it would be nice to hear about it. – Prix Jul 25 '10 at 21:00
• I haven't used any third-party anti-cheat software, no. When I first started coding an online RPG, however, my server just called 'attack' when the client sent 'attack', instead of putting the request into a queue, things like that. Those are the most important for preventing cheating. Speed hacks, do all the timing on the server so they get little advantage, but also send timestamps, and if you get too much drift, you'll know they are using one. Mark their account, but don't kick them immediately -- immediate feedback is a great way for someone to know what your software detects. – James Bellinger Jul 25 '10 at 21:52
• I like this part but also send timestamps, and if you get too much drift, you'll know they are using one. Mark their account, but don't kick them immediately -- immediate feedback is a great way for someone to know what your software detects. i was recently looking into implementing a timestamp and warn system from users marked, currently what i have put the player on a list what i am working on now is that if some has a high abuse usage it will send an alert to an online GM for verification ... – Prix Jul 26 '10 at 12:11