False postitive with mousewheel

[finneus]

Hey there after installing your anticheat plugin on our cs go server we had one player who constantly triggered the autoshoot aimbot detection.

We read somewhere online that you can trigger this detection when using mousewheel to shoot. (bind mwheeldown +attack)

we tested this now on our own and got ourselfs banned pretty fast. Is this expected behavior ? How can we determine if a player really is cheating ?

And can you maybe explain in more detail how the detection works ? Why does shooting with mousewheel trigger this ?

thanks in advance.

[J-Tanzanite]

Is this expected behavior?

Yes it is intentional.

Reason being that if someone has to go out of their way to do something unusual (just like the perfect 180 bind trick https://github.com/J-Tanzanite/Little-Anti-Cheat/issues/86#issuecomment-830826938), then they've asked for it or were cheating and are lying about it. Any cheater can lie and say they used the mousewheel bind, and there isn't a way to distinguish between a cheater and someone using such a bind.

If you read the logs, you an see what weapon was used every time they got detected for Autoshoot, better yet if you have a STV demo. You can ask yourself what's more likely, that someone used mousewheel to shoot (with that weapon) given their circumstances/situation in-game (STV demos help you see that) - or that they simply used a cheat.

Autoshoot is when a cheat fires a perfect 1-tick shot, a lot of aimbots will do this due to the way they're programmed. Players will be detected for Autoshoot if this behavior is detected twice in a row. So why does mousewheel do this? Don't know, any binds to mousewheel in source games will produce a 1 tick input, you can do this with +jump, and your +jump input will be on for exactly 1 tick.

You can disable autoshoot detection by setting lilac_aimbot_autoshoot to 0. My recommendation is to keep it on, as it's rare for people to actually use mousewheel and not be trolling... Most of the time the people detected for Autoshoot are indeed cheating.

There have been discussions previously as to having a warning system for those with mousewheel bound to shooting, either displaying a warning to them or just outright kicking them. That would resolve the issue completely, as people can't lie about having bound mousewheel to shoot (since that would have gotten them kicked). I'm not sure if we're allowed to query for binds anymore, I know it used to be possible... So I'll look into that.

Hope this answers your questions.

[J-Tanzanite]

I did some testing and asked around, but it appears that a server cannot check the binds of players. Thus, if someone says they used mousewheel to shoot, it's up to you to assess how believable it is.

[finneus]

Thank you so much for the detailed explanation. Keep up the good work :)

[azalty]

Don't know, any binds to mousewheel in source games will produce a 1 tick input, you can do this with +jump, and your +jump input will be on for exactly 1 tick.

Based on my experience this isn't always true, I'd say 25% of the time it leads to longer than 1 tick inputs. Wasn't able to identify the reason. 64 ticks server, CSGO.

The percentage might be off, but I know for a fact that they're not all 1 tick perfect.

This might be the key to differentiate cheaters from legit players

[J-Tanzanite]

I've attempted this in TF2, and always had a 1 tick input from mousewheel; I know that if you spam it a LOT it won't be a 1 tick anymore. My mousewheel is "tactile", so I have a hard time sending several inputs at once.

I don't think you can use this to differentiate between legits and cheaters, as you only get an autoshoot detection if you get two kills in a row that were 1 tick shots. So if we assume a 25% chance of getting more than a 1 tick shot, it will reset the "two in a row" counter, but that won't get logged anywhere. So in the logs, you'll still end up with autoshoot detections.

The rate at which you get them won't help much either, as toggling on and off aimbot is a common thing to do to look more legit. I wish there was a way to just query player's binds, as that would have been the solution to this problem, but it isn't possible.