77 added, 43 removed. Audit A to A.
---
name: anti-cheat
group: Engineering
- description: >-
- Enforce server authority, validate inputs, and defend against speed hacks, memory editing, and
- exploits. Use when defending games against exploits or hacks.
+ description: Enforce server authority and defend against speed hacks, memory editing, and exploits. For networking setup, see unity-multiplayer. Use when defending games against exploits or hacks.
---
- # Anti Cheat
- Enforce server authority, validate client input, and defend against speed hacks, memory editing, packet replay and economy exploits..
+ # anti-cheat
- ## Process
+ ## Core Philosophy
+ In multiplayer games, the client is fundamentally compromised. The game executable runs in a hostile environment controlled by the user: memory can be modified via Cheat Engine, network packets can be intercepted, and GPU rendering pipelines can be injected with custom shaders. True anti-cheat engineering does not rely on invasive kernel drivers alone; it is built on an uncompromising architectural foundation: **Server Authority**. The client only sends input intentions; the authoritative server simulates physics, validates mechanics, and adjudicates reality.
- 1. **Intake & Scope Definition**
- - Identify specific objectives, inputs, constraints, and operational context.
- - Inspect existing project documentation, configurations, or relevant repository assets.
+ ---
- 2. **Analysis & Strategic Formulation**
- - Evaluate options against best practices, security posture, and domain requirements.
- - Deconstruct complex components into discrete, actionable phases.
+ ## 4-Step Server-Authoritative Anti-Cheat Architecture
- 3. **Execution & Synthesis**
- - Produce structured, production-grade deliverables matching the required format.
- - Ground all recommendations in concrete project evidence rather than abstract generalities.
+ ### Step 1: Server Authority & Movement Validation
+ 1. **Never Trust Client Coordinates**:
+ - The client must never send absolute positional updates (`player.position = x, y, z`).
+ - The client sends raw input vectors (Move forward, Jump, Delta time). The server simulates physics and returns authoritative state.
+ 2. **Speed-Hack & Teleportation Prevention**:
+ - Server tracks positional displacement per tick:
+ $$\Delta d \le v_{text{max}} imes \Delta t + \epsilon_{text{threshold}}$$
+ - If displacement exceeds maximum legal speed plus latency buffer, snap the player back to their last validated server position and flag anomalous telemetry.
+ 3. **Ray-Swept Collision Bounds**:
+ - Verify movement vectors using server-side ray sweeps to prevent clipping through solid geometry ("noclip" cheats).
- 4. **Review & Refinement**
- - Validate against the verification checklist and domain edge cases.
- - Highlight open questions, explicit trade-offs, and next milestones.
+ ### Step 2: Combat & Action Validation
+ 1. **Fire Rate & Ammo Accounting**:
+ - Track weapon state strictly on the server: cooldown timer between shots, reload animations, magazine capacity.
+ - Instantly drop firing requests if the time delta between shots is lower than the weapon's configured firing delay.
+ 2. **Lag Compensation & Rewind Bounds**:
+ - For hitscan weapons, the server maintains a circular buffer of past entity positions (typically 1,000ms).
+ - When a client claims a hit at timestamp $T$, the server rewinds player hitboxes to timestamp $T$, performs a raycast, and validates line-of-sight.
+ - *Security Bound*: Cap maximum backward rewind at **200ms**. If client latency exceeds 200ms, hits are rejected to prevent players behind cover from being shot by lagging clients.
- ## Deliverable & Output Format
+ ### Step 3: Statistical Heuristics & Aimbot Detection
+ 1. **Angular Velocity & Entropy Analysis**:
+ - Human aim exhibits micro-adjustments, tremors, and acceleration/deceleration curves.
+ - Aimbots snap instantaneously: angular velocity $ o \infty$, angular acceleration approaches a single-frame delta, and angular path entropy drops to zero.
+ - Log server-side telemetry on crosshair angular snap speed; flag players who consistently snap within 1 frame across $> 30^\circ$ angles.
- ### 📋 Executive Summary
- - **Objective:** Key goal addressed
- - **Status:** Complete / Action Required
- - **Primary Recommendation:** Core actionable conclusion
+ ### Step 4: Memory Obfuscation & Heartbeat Integrity
+ 1. **Encrypted In-Memory Variables**:
+ - Obfuscate high-value memory addresses (Player Health, Ammo, Gold) using dynamic XOR bitmasks changed every game tick.
+ 2. **Deterministic Simulation Hashes**:
+ - Run cryptographic checksums on loaded map geometry and weapon config tables at match start to detect modified local asset files.
- ### 🛠️ Detailed Implementation / Analysis
- - Concrete technical, operational, or strategic specifications.
- - Clear code, configuration, or documentation blocks where applicable.
+ ---
- ### 📌 Decisions & Next Steps
- - [ ] Immediate action items with designated owners.
- - [ ] Required dependencies or prerequisite milestones.
+ ## Deliverable Format: Anti-Cheat System Specification (`ANTI-CHEAT-SPEC.md`)
- ## Instructions & Operating Rules
+ ```markdown
+ # Server-Authoritative Anti-Cheat Architecture: [Game Title]
- - Lead directly with actionable findings and structured results.
- - Never introduce speculative abstractions or unrequested complexity.
- - Maintain consistency with existing architecture and naming conventions.
- - Provide explicit rationales for non-obvious trade-offs.
+ ## 1. Authority Model & Tick Rates
+ - **Server Tick Rate**: 64 Hz (15.625ms per tick)
+ - **Authority Scope**: Movement, Combat, Inventory, State Machine (100% Server Authoritative)
+ - **Lag Compensation Window**: Capped at 180ms maximum rewind
- ## Verification & Quality Checklist
+ ## 2. Real-Time Input Validation Rules
+ | Mechanic | Client Payload | Server Validation Logic | Enforcement Action |
+ |---|---|---|---|
+ | Movement | Input Vector + View Angles | Swept-sphere collision + max velocity cap | Hard snapback to last valid pos |
+ | Fire Weapon | Shoot Event + Target ID | Check ammo count > 0 & cooldown timer expired | Drop packet silently; log warning |
+ | Reload | Reload Request | Check reload duration >= 2.4s before resetting ammo | Reset reload progress on interrupt |
- - [ ] Deliverable directly satisfies all stated user requirements and criteria.
- - [ ] Edge cases, boundary conditions, and error states are addressed.
- - [ ] Output contains zero placeholder tokens, broken references, or unverified claims.
- - [ ] All cross-references and formatting comply with repository conventions.
+ ## 3. Server-Side Heuristic Detection Thresholds
+ - **Snap Angle**: > 45° angular displacement in <= 1 frame (15.6ms).
+ - **Hit Ratio**: Headshot ratio > 78% across 10 consecutive matches triggers manual review.
+ - **Speed Variance**: Accumulated distance delta > 1.15x theoretical max over 3 seconds.
+ ```
- ## Anti-Patterns & Constraints
+ ---
- - **NEVER** output generic boilerplate without grounding in specific project inputs.
- - **NEVER** silently omit unresolved contradictions or unverified assumptions.
- - **NEVER** make unrequested modifications outside the stated deliverable boundary.
+ ## Worked Example: Stopping Speed Hacks in a Fast-Paced Shooter
+
+ - **Exploit**: Cheaters modified client `Time.timeScale` to move 3x faster than normal players.
+ - **Server Fix**: Implemented server-side distance delta accumulation over rolling 20-tick windows.
+ - **Result**: Cheaters were clamped to legal speed caps and rubber-banded backward; exploit neutralized with zero false-positive kicks for high-ping players.
+
+ ---
+
+ ## Verification Checklist
+
+ - [ ] All positional movement and combat actions adjudicated on the server.
+ - [ ] Lag compensation rewinds capped at $\le 200text{ms}$.
+ - [ ] Weapon fire rates, reload timers, and ammo pools tracked server-side.
+ - [ ] Heuristic telemetry detects unnatural angular snap velocities.
+ - [ ] Asset checksums verify local map and weapon files before match entry.
+
+ ---
+
+ ## Anti-Patterns
+
+ - **Client-Authoritative Hits**: Trusting the client when it sends "I hit Player B for 100 damage", inviting trivial memory-injection cheats.
+ - **Unbounded Lag Compensation**: Letting 500ms ping players shoot people who ran behind concrete walls 2 seconds ago.
+ - **Client-Only Anti-Cheat**: Relying exclusively on client-side scanning software without server-side validation.