May 26, 2015
Survarium - joewillburn
First of all, we’d like to say that Survarium network protocol prevents most cheats.
All of the possible cheats may show information inherent to the client but doesn't visualize:
* Enemy player’s position
* Enemy grenade position
* Enemy trap position
* Battery position
There are types of cheats which are simply not possible in our game: Speedhack, weapon modifications,
Map modifications and physics laws modifications etc. Our current protection system prevents changing game executable and resources files but modern cheats work on a system of so called 'overlays', which means they do not need to inject into game's code or resources but just read memory of the game's processes.
There are 2 approaches in anti-cheat systems: Either work on the client’s side or work on the server side. Well known Anticheat systems like Punkbuster, VAC and others constantly examine memory of other processes on the client side. They have a database of the cheat signatures and try to find known signatures in the memory of the running processes. This approach has an advantage: if the Anticheat system identifies a known cheat signature the player may be banned instantly which means that they cannot not ruin game for other players.
However this approach has its disadvantages:
* The need to have staff that constantly explores the Internet searching information about new cheats, purchase these cheats and add their signatures to the database.
* If the cheat is private or its signature is not in the database yet, then clients, who use this cheat, may do so without any punishment
* Already known cheats may change their code in such a way, that their signature changes, which leads to cheat database updates and makes searching among signatures much slower
* Anticheat processes may conflict with antivirus processes
* Anticheat processes must have enough privileges to inspect memory of other processes
* Anticheat processes work on the client-side, therefore one can't exclude possibility, that the user may turn the Anticheat off and just send an 'ok' status to game server.
There is another approach: Check game clients on server side. Players use cheats to gain an advantage over other players, which they shouldn't have according to the game’s coded rules. So, theoretically speaking if the game server understands that the player performs actions on a regular basis, which he/she does “accidently” then this player may be suspected of cheating.
We have a so called 'replay' system in our game: every match may be reviewed from the camera of every player after the match is finished. Using this information our support team banned a lot of players, on which we received many complaints which were ultimately confirmed by reviewing replays.
At the moment we developed a version of our new Anticheat system which analyzes every player in every match (i.e. during match is playing) and collects “suspicious moments” After the match is finished and its replay is stored the server analyzes the logged suspicious moments and if it detects really actions which it cannot explain it creates ticket and sends it to our support team, describing the match id, the player id, the suspicious actions with the time and description of what exactly it found suspicious.
We checked our new system in one of the matches, in which our support team banned a player:
The team found 4 game incidences, which they couldn’t explain, other than the player using cheats so user was banned. Our new anti-cheat system found all of these 4 moments.
Discuss on forum
All of the possible cheats may show information inherent to the client but doesn't visualize:
* Enemy player’s position
* Enemy grenade position
* Enemy trap position
* Battery position
There are types of cheats which are simply not possible in our game: Speedhack, weapon modifications,
Map modifications and physics laws modifications etc. Our current protection system prevents changing game executable and resources files but modern cheats work on a system of so called 'overlays', which means they do not need to inject into game's code or resources but just read memory of the game's processes.
There are 2 approaches in anti-cheat systems: Either work on the client’s side or work on the server side. Well known Anticheat systems like Punkbuster, VAC and others constantly examine memory of other processes on the client side. They have a database of the cheat signatures and try to find known signatures in the memory of the running processes. This approach has an advantage: if the Anticheat system identifies a known cheat signature the player may be banned instantly which means that they cannot not ruin game for other players.
However this approach has its disadvantages:
* The need to have staff that constantly explores the Internet searching information about new cheats, purchase these cheats and add their signatures to the database.
* If the cheat is private or its signature is not in the database yet, then clients, who use this cheat, may do so without any punishment
* Already known cheats may change their code in such a way, that their signature changes, which leads to cheat database updates and makes searching among signatures much slower
* Anticheat processes may conflict with antivirus processes
* Anticheat processes must have enough privileges to inspect memory of other processes
* Anticheat processes work on the client-side, therefore one can't exclude possibility, that the user may turn the Anticheat off and just send an 'ok' status to game server.
There is another approach: Check game clients on server side. Players use cheats to gain an advantage over other players, which they shouldn't have according to the game’s coded rules. So, theoretically speaking if the game server understands that the player performs actions on a regular basis, which he/she does “accidently” then this player may be suspected of cheating.
We have a so called 'replay' system in our game: every match may be reviewed from the camera of every player after the match is finished. Using this information our support team banned a lot of players, on which we received many complaints which were ultimately confirmed by reviewing replays.
At the moment we developed a version of our new Anticheat system which analyzes every player in every match (i.e. during match is playing) and collects “suspicious moments” After the match is finished and its replay is stored the server analyzes the logged suspicious moments and if it detects really actions which it cannot explain it creates ticket and sends it to our support team, describing the match id, the player id, the suspicious actions with the time and description of what exactly it found suspicious.
We checked our new system in one of the matches, in which our support team banned a player:
The team found 4 game incidences, which they couldn’t explain, other than the player using cheats so user was banned. Our new anti-cheat system found all of these 4 moments.
Discuss on forum
Share: 
