Questions regarding Autoshoot detection.

[biG-cAtTo]

Hello! Few days ago an important member from our staff got banned by lilac for aimbot and we were wondering if it’s possible that it was a wrong detection. He’s been playing on our servers for years now, invested a lot of money and time in the community and one day he just gets banned. We looked at the demo but it didn’t look like anything special, I will leave a youtube link with it. Thank you

link: https://youtu.be/900NSPOB55g

[azalty]

Hi, please also provide anonymized detection logs

[azalty]

They could try to better hide their wallhack lmao

Nice aimlock 3:19

This guy is pretty blatant, not the best legit cheater

[biG-cAtTo]

Logs image: https://ibb.co/7yHgYFZ

[J-Tanzanite]

I won't comment on the "wallhack" thing, as I don't play CS:GO, so I'll focus solely on the logs.

Your guy was detected for autoshoot, which is a cheat feature you cannot see while spectating, as it doesn't affect aim. Autoshoot, as the name suggests, is when a cheat shoots for you, think about triggerbot or smooth aimbot.

Due to how cheats are often programmed, Autoshoot will tend to do perfect 1-tick inputs when shooting. Lilac won't flag a player for autoshoot unless a player gets two such detections in a row leading to a kill.

It's common to see Autoshoot on legit cheaters (cheaters who try to look legit), and you can sometimes see it on rage hackers.

Is it possible this is a false positive? Yes, but very unlikely, especially in your case. If you bind mousewheel to "+attack", then you'll be able to do perfect 1-tick inputs, which would trigger this. But that means a player has to bind shooting to mousewheel, and that's pretty rare unless you want to spam shoot; And looking at your video, he doesn't spam, so it's even more unlikely.

And the higher the tickrate your server runs, the more likely this is to be a valid detection; the reason for this is that although it's possible to get a perfect 1tick shot with mouse clicking (although fairly rare, especially since you need two in a row leading to kills), the input time gets smaller with higher tickrates.

Sorry to say, but your guy is most likely cheating. Not impossible that he wasn't, just very unlikely.

[biG-cAtTo]

Thank you for taking the time to explain that! Also thank you azalty for the opinion.

Just to clarify things, would the only real way for it to be a false positive be if he had the bind for shooting on mousewheel? Considering the fact that the server has 128 tickrate, I don’t believe he could’ve clicked fast enough to get a perfect 1tick shot, especially because I’ve seen that you need to get 5 detections in order to be banned, which would make it impossible in such a short time span.

[J-Tanzanite]

Just to clarify things, would the only real way for it to be a false positive be if he had the bind for shooting on mousewheel?

No, but that is the most common way people get false positives, as false positives via other methods are much more rare.

Considering the fact that the server has 128 tickrate, I don’t believe he could’ve clicked fast enough to get a perfect 1tick shot

Not impossible, but very unlikely, yes, especially in that timeframe.

Technically speaking, he must have gotten 6-10 1tick perfect shots leading to kills in a row to get banned, detection wise, yes 5 (as at least two in a row are needed).

[azalty]

Even mouse wheel sometimes causes inputs over multiple ticks (is this a bug?). Tried with +jump on 64 ticks.

[biG-cAtTo]

I’m assuming it’s quite rare because I have checked the logs from the past week, and Autoshoot is not detected that often. Usually when it is, the player ends up getting banned, but I never saw it as a single detection.

So if it’s not something that a player can just accidentally get(maybe it happens but insanely rare, haven’t seen a case of it on the logs from the past week), then to get it 5 times in just a few minutes must be close to impossible without a cheat

I’m sorry for pressing the issue, it’s just pretty hard to believe in my community as the player has been with us for years, and I’m trying to gather as clear evidence as possible before making a decision

[azalty]

Understandable, it's always good to be curious and try to understand how ACs work.

You wouldn't want to false ban regulars. Thanks for taking the time to review their ban :)

I personally think it was a good thing to ask, though I didn't help much apart from saying that they looked at walls 80% of the time, and I found it super duper blatant. They always seem to be aware where to look at, spend a lot of time checking corners where enemies are, but instantly ignores the other ones.

[biG-cAtTo]

Understandable, it's always good to be curious and try to understand how ACs work.

You wouldn't want to false ban regulars. Thanks for taking the time to review their ban :)

Thank you! I do hope we’ll make the right decision on this one, and understanding the AC is quite interesting.

Not impossible, but very unlikely, yes, especially in that timeframe.

Technically speaking, he must have gotten 6-10 1tick perfect shots leading to kills in a row to get banned, detection wise, yes 5 (as at least two in a row are needed).

About this, I watched the demo and the logs again and there is one thing I don’t understand. In the logs, the detection started from 2, so there were only 4 of them (2, 3, 4 and 5). Also when I looked at the demo, the last detection was at the minute 4:02 and it was a single shot getting a kill, same about the 4th detection (minute 3:53). Shouldn’t it have been 2 shots?

[azalty]

Technically speaking, he must have gotten 6-10 1tick perfect shots leading to kills in a row to get banned, detection wise, yes 5 (as at least two in a row are needed).

About this, I watched the demo and the logs again and there is one thing I don’t understand. In the logs, the detection started from 2, so there were only 4 of them (2, 3, 4 and 5). Also when I looked at the demo, the last detection was at the minute 4:02 and it was a single shot getting a kill, same about the 4th detection (minute 3:53). Shouldn’t it have been 2 shots?

• the first detection is always silent in LilAC to prevent spam due to potential false positives
• there's an enforced delay of 1s (iirc) between autoshoot detections to prevent false positives
• autoshoot detections are only took into account if it was a killing shot iirc
• when pressing the left click, +attack is sent. When releasing it, -attack is sent. Autoshoot detections happen when the button is only pressed for 1 tick, which generally doesn't happen if it's done by an humain, especially on higher tickrate servers like yours.

Hopefully that answers all your questions, didn't quite get the last one.

[biG-cAtTo]

Thank you so much for all the information! It makes it pretty clear for us, I appreciate the help! About the last question, for some reason I understood that 2 shots may be necessary in order to get a detection, that’s why it was a bit confusing

[azalty]

About the last question, for some reason I understood that 2 shots may be necessary in order to get a detection, that’s why it was a bit confusing

Indeed, I didn't understand it that way

I'll let @J-Tanzanite clear that up, as I don't know much 😅

[J-Tanzanite]

Sorry for the delayed response.

So as an extra step to prevent false positives, you can only get an Autoshoot detection if your current kill and previous kill both had a 1 tick perfect shot.

• autoshoot detections are only took into account if it was a killing shot iirc

That's correct ;)

---

Anyway, thank you for taking time to ask questions to make sure the ban is correct. I hope this answers all your questions.

I'm closing this as this is resolved, feel free to ask questions in the future should there be anything :)

[lunatixxx]

Can you check you pm on alliedmodders?

[lunatixxx]

I am glad you pointed this issue with the mouse wheel as attack button, i tested it myself and got banned in less than 5 minutes without doing anything special. No comment and this makes me think about the potential players banned for nothing.. which is fortunately pretty much non existant on my server after checking.

Just it frustrate me that you seem to be aware of the problem and do not alert on the main page or i missed it?

[J-Tanzanite]

Can you check you pm on alliedmodders?

https://www.youtube.com/watch?v=umxmHpUPS5A

In short: I'll get to it when I get to it. If I'm not responding there, I'm busy.

---

i tested it myself and got banned in less than 5 minutes without doing anything special

If you're binding mouse wheel to shoot instead of doing the normal thing and using M1 to get kills... You're by definition doing something special.

No comment and this makes me think about the potential players banned for nothing [...] Just it frustrate me that you seem to be aware of the problem and do not alert on the main page or i missed it?

It's not a problem, if you have to go out of your way to do something weird/stupid to get a false positive or to look like a cheater, then that goes on you. It's the same with this: https://github.com/J-Tanzanite/Little-Anti-Cheat/issues/84

Also, it is written on the main page: https://forums.alliedmods.net/showthread.php?t=321480 Scroll down to the FAQ section for Autoshoot.

[lunatixxx]

Maybe detect if someone is using mousewheel and alert him that he has to change his key and in this case kick only?

[J-Tanzanite]

Having an alert system for such a bind isn't the worst idea, however, it doesn't really prevent anything... If anything, it becomes an easy way for cheaters to check if Lilac is installed (not all cheats check what's installed on a server) and give them a headsup about autoshoot, which can be a bad idea. Still, worth considering in some aspects.

That said, there's already a ConVar available for you if you're concerned about autoshoot (lilac_aimbot_autoshoot).

---

With that aside, I'm going to ask you lunatixxx to stop spamming (and commenting on closed threads). I've warned you before about spamming, and it doesn't seem like you've taken it to heart.

It's not an issue that you open threads asking questions or request features; that's all fine! It is an issue however, that you spam, comment a on a million things, are impatient, PM spam me, create duplicate issues etc. Perhaps I wasn't clear enough before, but seriously: Stop.

I'm going to lock this thread to prevent you from continuing this, because I can't trust you not to comment.

I have in the past invited you to add me on steam, and since you have so many questions and comments, it's preferable that you message me there, instead of spamming and creating duplicates everywhere (Aka: Making a mess). https://steamcommunity.com/id/J_Tanzanite