Anti-Cheat Discussion Thread 2

[Bawbag]

[QUOTE=Cushie;34309957]Best way to not get yourself ddosed and your anticheat patched is to simply flag SteamIDs and manually ban people either after they leave or while they are in the server for breaking whatever rules that they most likely will (99% of them have no recoil on and dont toggle off if you spectate them, its so easy to see)

If you go ahead and ban some kiddy with the reason 'Sethhack', he is just gonna come back and try to show you who is 'boss'.[/QUOTE]

I drop them with a fake buffer overflow and manually ban sometime in the next week or two.

[frosty802]

[QUOTE=Bawbag;34309984]I drop them with a fake buffer overflow and manually ban sometime in the next week or two.[/QUOTE]

I just crash there client or make it freeze for a very long time.

[Ruzza]

I don't mind players hacking, I just give them a friendly ban for 5 minutes with the reason "Turn off hacks" They tend to come back without hacks on, or just keep getting kicked everytime they come back with it enabled.

[lorde banana]

[QUOTE=Ruzza;34318771]I don't mind players hacking, I just give them a friendly ban for 5 minutes with the reason "Turn off hacks" They tend to come back without hacks on, or just keep getting kicked everytime they come back with it enabled.[/QUOTE]

well you're pretty lucky, we tend to get 8GBit of DDoS for 3 days

[Ruzza]

[QUOTE=Banana Lord.;34318802]well you're pretty lucky, we tend to get 8GBit of DDoS for 3 days[/QUOTE]

We get a shit ton of spoofed ips using source engine queries, but limestone filters it out thankfully.

[lorde banana]

[QUOTE=Ruzza;34318887]We get a shit ton of spoofed ips using source engine queries, but limestone filters it out thankfully.[/QUOTE]

get 8Gbit and then tell Carl he's a messenger boy and you want to speak to Ryan, that's how I got them all mad at me

[Slayer3032]

I used to just run jpeg in timers on them, it's funny to watch them try to figure out why they are lagging then like 10 minutes later windows pops up that it's running out of free space.

It's also funny to put them in the windows folder and other shit.

[dingusnin]

This is where my surgestion for function pointers to be traceble would come into use ....

[hentie]

-removed due to threats-

[Aide]

[QUOTE=Hentie;34338025]I'm getting so close.
[lua]if not CLIENT then
return
end
print ( "SethHack V4.3 Loaded!" )
TEAM_CONNECTING = 0
TEAM_UNASSIGNED = 1001
TEAM_SPECTATOR = 1002
NOTIFY_GENERIC = 0
_G.SH_COMMANDNUMBER = nil
_G.SH_SETSPEED = nil
_G.SH_LUARUN = nil
_G.SH_PURECC = nil
_G.SH_SETNAME = nil
_G.SH_SETCVAR = nil
_G.SH_RUNSCRIPTS = nil
_G.SH_SUPPRESSIPLOGS = nil
_G.SH_WRITEFILE = nil
_G.SH_READFILE = nil
_G.SH_MODVER = nil
_G.SH_ISDORMANT = nil
_G.SH_REGWRITE = nil
_G.SH_REGREAD = nil
_G.hl2_shotmanip = nil
_G.hl2_ucmd_getprediction = nil
_G.SH_hl2_shotmanip = nil
_G.SH_hl2_ucmd_getprediction = nil
include ( "includes/init.lua" )
include ( "includes/extensions/table.lua" )
include ( "includes/extensions/string.lua" )
include ( "includes/extensions/math.lua" )
include ( "derma/derma_utils.lua" )
require ( "datastream" )
R37 = table.Copy ( _G )
R38 = table.Copy ( _R )
R39 = table.Copy ( _G )
R37.SH_SETCVAR = _G.SH_SETCVAR
R37.SH_SETNAME = _G.SH_SETNAME
R37.SH_PURECC = _G.SH_PURECC
R37.SH_LUARUN = _G.SH_LUARUN
R37.SH_SETSPEED = _G.SH_SETSPEED
R37.SH_COMMANDNUMBER = _G.SH_COMMANDNUMBER
R37.SH_ISDORMANT = _G.SH_ISDORMANT
R37.SH_MODVER = _G.SH_MODVER
R37.SH_READFILE = _G.SH_READFILE
R37.SH_WRITEFILE = _G.SH_WRITEFILE
R37.SH_SUPPRESSIPLOGS = _G.SH_SUPPRESSIPLOGS
R37.SH_RUNSCRIPTS = _G.SH_RUNSCRIPTS
R37.SH_REGREAD = _G.SH_REGREAD
R37.SH_REGWRITE = _G.SH_REGWRITE
R37.SH_hl2_ucmd_getprediction = _G.SH_hl2_ucmd_getprediction
R37.SH_hl2_shotmanip = _G.SH_hl2_shotmanip[/lua][/QUOTE]

[url]http://pastebin.com/qU0V1MBe[/url]

[Phoenixf129]

[QUOTE=Aide;34339373][url]http://pastebin.com/qU0V1MBe[/url][/QUOTE]

Lol. "_NOPENOPE", from my anticheat.

And i thought he patched it. Guess i'll just changed the command.

I am so going to laugh when GMod Beta goes live, sethhack requires datastream :V

[hentie]

-removed due to threats-

[Drakehawke]

-snip-

[LuaStoned]

[QUOTE=Hentie;34113847]Why don't VAC bans work for detouring vtables in CLuaInterface, CLuaShared, and CLuaCallback?
:([/QUOTE]

Because VAC does not work that way in GMod.

[QUOTE=OldFusion;34115755]A. Vac doesn't detect (propper)vtable hooks.
B. Nobody ever got banned other then a handful of people on outdated bacon-bot[/QUOTE]

VAC does not detect anything but modules garry got his hands on. How do you think do all those useful modules work?
[sp]Detours! (Which will get you banned faster than you can say VAC on any other Source game)[/sp]

[Nafrayu]

[QUOTE=Drakehawke;34342880][lua]R37[R63][R64] ( "coolvetica",64,500,true,false,"shmenufont" )[/lua]

Could you override "shmenufont" with an illegible one or something? Would that effectively make their SethHack menu unusable?[/QUOTE]

You just sparked a new anti cheat idea for me:
[LUA]--snipped, have fun if you were fast enough to grab this[/LUA]

[editline]22nd January 2012[/editline]

Wait, he didn't override that function did he [img]http://i.somethingawful.com/forumsystem/emoticons/emot-saddowns.gif[/img]

[hentie]

-removed due to threats-

[FaceLurker]

[img]http://www.zimg.eu/i/3243178075[/img]

[Chrisaster]

[QUOTE=FaceLurker;34345224][img]http://www.zimg.eu/i/3243178075[/img][/QUOTE]

Why did you post that as an image on Seth's site? Are you trying to get IPs (from/for Seth)?

[Dame Flawless]

[QUOTE=FaceLurker;34345224][img]http://www.zimg.eu/i/3243178075[/img][/QUOTE]

Good I like the smell of vac bans in the morning

[Map in a box]

But ok, even though avaster didn't make anything he claims to have.

[Dame Flawless]

[QUOTE=Map in a box;34346978]But ok, even though avaster didn't make anything he claims to have.[/QUOTE]

By working on I think he means paying someone

[lorikellerman]

Hentie, I was on Yahoo answers earlier and found a post from you. Don't be worried, 6" is perfectly fine.

[img]http://zeyuu.net/i/4f1c9242cbff9933107133.png[/img]

[highlight](User was banned for this post ("Flaming." - Dav0r))[/highlight]

[#NaN]

[QUOTE=lorikellerman;34347569]Hentie, I was on Yahoo answers earlier and found a post from you. Don't be worried, 6" is perfectly fine.

[img]http://zeyuu.net/i/4f1c9242cbff9933107133.png[/img][/QUOTE]

Why are you interested in these questions?

[hentie]

-removed due to threats-

[Dame Flawless]

[QUOTE=Hentie;34348337]-removed due to threats-[/QUOTE]

What kinda threats?

[Ruzza]

Rape threats. Seth threatens people with rape

[Gracie]

Why do you guys always have to derail a anti-cheat thread?

[hentie]

-snip lawyer advised not to-

[Aide]

[QUOTE=Hentie;34351357]-snip lawyer advised not to-[/QUOTE]
Stop making useless posts if your gonna just snip it later.

[wauterboi]

[QUOTE=Aide;34351579]Stop making useless posts if your gonna just snip it later.[/QUOTE]
It's a joke.