The game is full of cheaters - you don't need intrusive anticheat to fix it!

[SamuelTulach]

Your system information

• System information from steam (Steam -> Help -> System Information) in a gist: https://gist.github.com/SamuelTulach/af16b8d6398526eaf4cf94c9dd475cf0
• Have you checked for system updates?: [Yes/No] Yes

Please describe your issue in as much detail as possible:

On a Steam profile with level 101 and inventory with a value of at least 800$, 1100 hours of playtime, I am getting matched against level zeroes with 20 hours in game that are blatantly cheating.

Steps for reproducing this issue:

1. Invest lot of time and effort into the game while being on high tier profile
2. Play the game casually in literally any mode
3. Meet cheaters

Before you flag this issue as invalid and close it, please at least consider reading this.

You don't need any intrusive anticheat solution to stop cheaters. All that I am asking is for someone to actually start caring about the game. Have you ever trying looking online how easy it is to cheat in CS:GO? It has come to the point when where someone asks on a reverse engineering forum, how they should learn code injection and function hooking, instead of recommending them some CTFs or games like PwnAdventure, they are being told to just make a cheat for CS:GO because of how many public sources are available. There are literally sites and repositories that have updated offsets for the game that are being updated few minutes after each game update. This is the main issue with the game. Not only you are not doing anything against cheating actively, but you are even encouraging it by making it so easy.

Imagine following scenario. A person has really basic knowledge of C++ and wants to make his own cheat for the game. All that he needs to do, it to figure out how to read process memory, get base address of modules and then simply use some publicity available offset dumper or just strait up copy the offsets to loop though entities and enable glow on each of them. It does not require any reverse engineering skills. It does not require any advanced knowledge of system internals.

You have tried to fix this problem by introducing trusted launch, which literally only hooks LoadLibrary function on Windows to prevent loading of unsigned DLLs. I am sorry but is this a joke? Seriously there is nobody at Valve that would have basics understanding of how could cheats work? Not only it can by bypassed completely by patching one byte, but why would anyone do that when basically any public DLL injector supports manual mapping - in case you don't know, that means that memory is allocated in the process manually, imports and relocations are also resolved manually by the injector and then the entry point of the dll is called usually from hijacked thread. Hooking LoadLibrary did not help anything. It only annoyed bunch of people, because lot of legitimate programs (such as OBS), stopped working.

What can you do about it? The answer is pretty simple. Do what other game developers do!

• Encrypt strings in final build of the game, it is unacceptable that you can just open it in any disassembler and search for strings from Source SDK to easily find anything that you need (compile time XOR text encryption)
• Actively go onto game cheating forums and research how people are cheating in your game, look for things such as methods of entity looping, enabling glow, reading view matrix, then try to do everything you can to prevent them from doing so (reduce number of global variables - use dynamically allocated memory to store the information)
• Use compile time modifiers - how is it possible that there are automated dumpers that have been working for a long time, classes need to be changed with updates
• Mutate part of the code that you know is being used by cheats - for example ViewRender, you don't need to write any software for this yourself, there is commercial software such as VMProtect
• Completely visualize code that does not need to perform well (such as game initialization code), that will make reversing of the game much harder (again can be done with something like VMProtect)
• Do basics checks! Why not to store information about player glow in multiple memory locations and make a wrapper function around it. That way if someone externally edits one of those values, you will know that is being manipulated.

At this point, 99% of all cheats would be instantly dead and each update, it would take the cheat developers solid amount of time to get their cheats updated. If you want to go beyond that and make sure that cheating will be basically completely dead, you can also do some basic usermode checks like:

• Verifying program sections, if it is being changed, you know that there are some badly made jump hooks or strait up function patches
• Trying to actively find manual mapped modules
• Implement anti-debugging measures
• Implement some sort of HWID bans (I am not big fan of this, but flagging current OS install would from my point of view be perfectly fine)

I honestly don't know how to end this. I seriously love the game. It's counter-strike after all - one of the most famous FPS titles, but with such a massive cheating problem, I can't just enjoy the game at all. If you need any help with any of those things above, I can help (but I seriously don't think you would not be able to do it). If you need a proof that it's possible to write a glow cheat under 5 minutes from scratch and without even getting the offsets from some dumper, I am willing to show you. All I want is for the game to be playable.

Quick summary: The game is suffering from the amount of public sources for cheats available. It could be resolved without using intrusive anticheat solution. Make it harder to reverse engineer the game and make sure that old sources are not functional anymore.

Thanks.

[x4e]

I think there are some fundamental issues with your argument, even though I agree with parts.

Firstly, if you want to suggest changes I recommend you take time to write out a thoughtful, helpful and grammatically correct proposal. Your issue is long and feels like something you wrote out of spite in 5 minutes.

Secondly, the issue you present at first is not a cheating issue but a trust factor issue. Cheating is NOT an issue in this game. Over the past year I've come across 0 people in comp and 1 in casual who I actually thought were cheating.

Your problem is that you have a low cheating trust factor. Incorrect trust factors are a big problem, I myself have a very low toxicity trust factor (lots of team killers/griefers). I'm not sure what to do about this (if anyone from the csgo team wants to take a look my steam id is STEAM_1:0:91441613).

You recommend virtualization and specifically VM Protect. One, this is slow. CSGO is known for running fast on even shit computers, so I imagine valve would not want to sacrifice performance for security.

The devs also aren't able to use random anti debugging code that you link to because it doesn't have a license.

HWID bans are intrusive. It has been proven before that steam collects HWIDs, so I'm sure it plays a part in trust factor if your HWID has been involved in cheating previously, however banning people's computers is unnecessary and intrusive.

I do agree however the game needs better reverse engineering protections. Stuff like using a packer would help without degrading runtime performance.

Overall, in my opinion cheaters aren't a problem for CSGO. The majority of people complaining about cheaters have low trust factor / are getting tilted and accusing innocents.

[BlackYuzia]

CSGO is known for running fast on even shit computers, so I imagine valve would not want to sacrifice performance for security.

@x4e Ha. Good joke. This game is so fast that it has overtaken logic. And game developers are just as fast as the game. That's why they broke everything that can be "inject" into the game, EXCEPT CHEATS. IT'S INGENIOUS.

Oh yep. You forgot what with every update we get more and more players who is fps go down?

[BlackYuzia]

About trust factor. I have a high trust fucktor. so ... I suppouse I should not saw cheaters yep? But I saw. 2 guy (1 in my team and 1 in opponent team). They play semi-rage style.

Second example, I complete game (a few hours ago) with this guy (enemy) - https://steamcommunity.com/profiles/76561198068816674. IDK did he use 100% cheats, but he play weird. Weird lock on head (with x0.25 speed on demo), weird deagle headshots.

I am a bit PARANOIK with this game.

[SamuelTulach]

I think there are some fundamental issues with your argument, even though I agree with parts.

Firstly, if you want to suggest changes I recommend you take time to write out a thoughtful, helpful and grammatically correct proposal. Your issue is long and feels like something you wrote out of spite in 5 minutes.

Actually it took me solid 8 minutes I believe.

Secondly, the issue you present at first is not a cheating issue but a trust factor issue. Cheating is NOT an issue in this game. Over the past year I've come across 0 people in comp and 1 in casual who I actually thought were cheating.

Your problem is that you have a low cheating trust factor. Incorrect trust factors are a big problem, I myself have a very low toxicity trust factor (lots of team killers/griefers). I'm not sure what to do about this (if anyone from the csgo team wants to take a look my steam id is STEAM_1:0:91441613).

"Cheating is not an issue", "Incorrect trust factors are a big problem" - a bit contradictory isn't it?

I don't think I have low trust factor personally. I have been playing with a lot of people, and they never encountered warning that I have a low trust factor. In some games I was getting high tier profiles with legitimate players, that I have lost against, but that I know are just better then me. The issue that I have is that right after such a game, I start another one and I get completely different experience with low tier profiles and obvious cheaters.

Trust factor is not a solution. Even if it worked as it was intended to, it would still mean incredibly bad experience for new players.

You recommend virtualization and specifically VM Protect. One, this is slow. CSGO is known for running fast on even shit computers, so I imagine valve would not want to sacrifice performance for security.

I mean... Valorant is using VMProtect in particular. As I said, you are not supposed to virtualize performance dependent code. You can use mutation on code that need to perform well and virtualization on code that does not need it.

The devs also aren't able to use random anti debugging code that you link to because it doesn't have a license.

I am sure they have people capable of writing their own anti-debugger solutions. Speaking of VMProtect is has anti-debug features build in. If you need anti-debugging examples here is al-khaser under GNU v2.

HWID bans are intrusive. It has been proven before that steam collects HWIDs, so I'm sure it plays a part in trust factor if your HWID has been involved in cheating previously, however banning people's computers is unnecessary and intrusive.

I do agree with that.

I do agree however the game needs better reverse engineering protections. Stuff like using a packer would help without degrading runtime performance.

Overall, in my opinion cheaters aren't a problem for CSGO. The majority of people complaining about cheaters have low trust factor / are getting tilted and accusing innocents.

It's not just me. You can even look at big YouTube channels like timeisbutawindow.

[x4e]

That's why they broke everything that can be "inject" into the game, EXCEPT CHEATS. IT'S INGENIOUS.

Any dll thats been signed can be injected. It is very rare that you have a legitimate dll that you need to inject into the game that hasn't been signed. If it is legitimate - why not sign it?

About trust factor. I have a high trust fucktor. so ... I suppouse I should not saw cheaters yep?

Clearly you don't have a high trust factor, otherwise you wouldn't be against cheaters.

I am a bit PARANOIK with this game.

This is the problem, you are getting paranoid about cheaters, which means every time someone is slightly suspicious you think they are cheating.

[BlackYuzia]

Any dll thats been signed can be injected. It is very rare that you have a legitimate dll that you need to inject into the game that hasn't been signed. If it is legitimate - why not sign it?

Wtf. Valve say "You can't inject ANYTHING in to the game". So, for example, FPS Monitor didn't work for CSGO. What you mean by "signed can be injected"?

Clearly you don't have a high trust factor, otherwise you wouldn't be against cheaters.

lol. go to MM together (only start search and end search) and you didn't get message what my trust is lower like you.

[SamuelTulach]

Any dll thats been signed can be injected. It is very rare that you have a legitimate dll that you need to inject into the game that hasn't been signed. If it is legitimate - why not sign it?

Wtf. Valve say "You can't inject ANYTHING in to the game". So, for example, FPS Monitor didn't work for CSGO. What you mean by "signed can be injected"?

Microsoft Authenticode Signature

[BlackYuzia]

@SamuelTulach can you say about that to devs of FPS Monitor? https://steamcommunity.com/app/966610 If they can add support csgo in to his app it would be great!

[SamuelTulach]

@SamuelTulach say about that to devs of FPS Monitor. https://steamcommunity.com/app/966610

FPS monitoring usually works by hooking DirectX present function (or OpenGL swap buffers function). Apart from just checking signature, trusted launch checks for those hooks and therefore the program would have to be manually whitelisted (will not happen given the fact that OBS game capture is also not whitelisted).

Since this is Linux/macOS issues, you can consider using MangoHud, which works perfectly (trusted launch has no effect on Linux).

[x4e]

"Cheating is not an issue", "Incorrect trust factors are a big problem" - a bit contradictory isn't it?

The majority of players receive a fair and accurate trust factor, and for them cheating is not a problem. The only case in which cheating can be an issue is for the small amount of people who have incorrect trust factors. In this case, the fix is not to stop cheating itself but to adjust the trust factor algorithm.

I mean... Valorant is using VMProtect in particular. As I said, you are not supposed to virtualize performance dependent code. You can use mutation on code that need to perform well and virtualization on code that does not need it.

Valorant and R6 both use VMProtect and coincidentally both run like garbage.

Plus Valorant still has rampant cheating problems, so its clear this hasn't fixed the problem for them either.

Ultimately you have to understand that cheating will never be fixed. It simply isn't anything that can be fixed, especially while still supporting free operating systems such as Linux.

I could easily make a CSGO cheat by creating a custom libc and replacing my current one with that. It will be injected into the game and there is nothing the game can do to detect it since they can't manually whitelist every single legitimate libc build there is on every distribution there is.

I'm not sure how you can advocate for more advanced anti cheat methods while still being a Linux user, as ultimately it will harm you more than the cheaters.

[BlackYuzia]

No support linux - no cheaters from linux users? Best simple way :eyes:

[x4e]

Are you joking? If this would actually fix the problem why don't you think Valve has already done this? If I had to guess 90% of CSGO cheaters are on Windows. I haven't seen any commercial linux CSGO cheats online, or open source ones on github.

Are you on Windows? If so why are you commenting on an issue in a Linux/OSX github only?

[BlackYuzia]

Are you on Windows? If so why are you commenting on an issue in a Linux/OSX github only?

Wat. You know any github repo what have name csgo-osx-windows or semi?

[SamuelTulach]

"Cheating is not an issue", "Incorrect trust factors are a big problem" - a bit contradictory isn't it?

The majority of players receive a fair and accurate trust factor, and for them cheating is not a problem. The only case in which cheating can be an issue is for the small amount of people who have incorrect trust factors. In this case, the fix is not to stop cheating itself but to adjust the trust factor algorithm.

I've been discussing this with a lot of people and you are probably the first one that does not see a cheating problem is CS:GO. May I know where you live? It might be also much bigger problem in certain areas. I live in central Europe.

I mean... Valorant is using VMProtect in particular. As I said, you are not supposed to virtualize performance dependent code. You can use mutation on code that need to perform well and virtualization on code that does not need it.

Valorant and R6 both use VMProtect and coincidentally both run like garbage.

Valorant gets 144+ FPS with medium settings on 1080p with 750ti and 3600x.

Plus Valorant still has rampant cheating problems, so its clear this hasn't fixed the problem for them either.

Ultimately you have to understand that cheating will never be fixed. It simply isn't anything that can be fixed, especially while still supporting free operating systems such as Linux.

I completely understand that. Not a single multiplayer game in history was "cheater free". I just want it to be harder to cheat in the game then searching for "CS:GO cheat github", downloading and compiling the first thing that comes up.

I could easily make a CSGO cheat by creating a custom libc and replacing my current one with that. It will be injected into the game and there is nothing the game can do to detect it since they can't manually whitelist every single legitimate libc build there is on every distribution there is.

Why would you over-complicate things? Did you even read what I originally wrote? It's not about getting access to the game. It's about making it hard to actually develop a cheat for it.

Compare CS:GO with Valorant (or any other recent FPS title). You need to reverse engineer multiple parts of the game just to get basic entity loop to work. I can personally inject a dll to Valorant, but I would not be able to write an actual cheat for it.

I'm not sure how you can advocate for more advanced anti cheat methods while still being a Linux user, as ultimately it will harm you more than the cheaters.

I don't see how virtualization and mutation of code that would effectively break any signatures or offsets reversed from the game each update, would impact Linux.

If I was against Linux support, I would like to have kernel-mode anticheat driver which registers callbacks for handle creation and does all sorts of heuristic scans on all running processes.

[SamuelTulach]

Are you joking? If this would actually fix the problem why don't you think Valve has already done this? If I had to guess 90% of CSGO cheaters are on Windows. I haven't seen any commercial linux CSGO cheats online, or open source ones on github.

Are you on Windows? If so why are you commenting on an issue in a Linux/OSX github only?

You are right that basically everyone is on Windows, but sadly there are also cheats for Linux [Link removed by moderator].

[x4e]

I've been discussing this with a lot of people and you are probably the first one that does not see a cheating problem is CS:GO. May I know where you live? It might be also much bigger problem in certain areas. I live in central Europe.

I live in england but I'm mostly matched with french people and eastern europeans

Valorant gets 144+ FPS with medium settings on 1080p with 750ti and 3600x.

I'm talking about the general trend of relative framerates, not your personal absolute framerates

I completely understand that. Not a single multiplayer game in history was "cheater free". I just want it to be harder to cheat in the game then searching for "CS:GO cheat github", downloading and compiling the first thing that comes up.

If you do this you will get vac/overwatch banned within a week and matched with other cheaters within a day

Why would you over-complicate things? Did you even read what I originally wrote? It's not about getting access to the game. It's about making it hard to actually develop a cheat for it.

What I'm saying is that you can never prevent people developing cheats, so past a certain point any attempts are futile

If I was against Linux support, I would like to have kernel-mode anticheat driver which registers callbacks for handle creation and does all sorts of heuristic scans on all running processes.

You clearly do not care about your privacy or freeedom. And seeing as you are also clearly a Windows user may I suggest not posting on a unix only github?

[SamuelTulach]

I've been discussing this with a lot of people and you are probably the first one that does not see a cheating problem is CS:GO. May I know where you live? It might be also much bigger problem in certain areas. I live in central Europe.

I live in england but I'm mostly matched with french people and eastern europeans

Valorant gets 144+ FPS with medium settings on 1080p with 750ti and 3600x.

I'm talking about the general trend of relative framerates, not your personal absolute framerates

I completely understand that. Not a single multiplayer game in history was "cheater free". I just want it to be harder to cheat in the game then searching for "CS:GO cheat github", downloading and compiling the first thing that comes up.

If you do this you will get vac/overwatch banned within a week and matched with other cheaters within a day

Why would you over-complicate things? Did you even read what I originally wrote? It's not about getting access to the game. It's about making it hard to actually develop a cheat for it.

What I'm saying is that you can never prevent people developing cheats, so past a certain point any attempts are futile

If I was against Linux support, I would like to have kernel-mode anticheat driver which registers callbacks for handle creation and does all sorts of heuristic scans on all running processes.

You clearly do not care about your privacy or freeedom. And seeing as you are also clearly a Windows user may I suggest not posting on a unix only github?

Honestly I give up at this point. People like you are one of the reasons the game is like this. I literally said I am against any kernel-mode anticheat. The Valorant performance is taken from a youtube video doing benchmark on the given specs. I personally have been using PC with i5-7400 and 1060 (3gb version) when I was trying out the game on release on 1440p and I was getting stable 144+ (I believe around 160?). Let me ask you I question. Have you ever used something like VMProtect? Have you ever even tried to actually reverse engineer something? You just seem like a person that is going to defend CS:GO under any circumstances and just not agree that it can be done better. There are things to improve and those things are being actively used by other games.

I understand that you don't have those issues with the game, but you yourself said that there are people having them.

Look at my GitHub profile and tell me... Do you think I am just making this up?

Oh and I use Arch btw.

[x4e]

I literally said I am against any kernel-mode anticheat.

Yeah I think I misread your message, apologies

And with your valorant benchmark, the main thing I'm talking about is peformance on low quality computers. Source has always been able to run on absolutely terrible computers (I remember running CS 1.6 on my schools 15 year old intel pentium computers at 60fps). VMProtect won't make that much of a difference itself, but the overall point is that peformance should be considered when implementing security.

Have you ever used something like VMProtect? Have you ever even tried to actually reverse engineer something?

I've not personally dealt with VMProtect however I am a reverse engineer who has written CSGO cheats before and currently develops commercial Java obfuscators.

You just seem like a person that is going to defend CS:GO under any circumstances

To be honest, yes. This is the only modern competitive shooter that has Linux support. It is clear that Valve actually care about Linux users and about the privacy of users on every platform. Other developers don't bat an eye before adding intrusive kernel anticheats and system information gathering. VAC isn't perfect but it isn't meant to be. Valve could easily add more intrusive checks but they don't.

Anyway We should probably not turn this github thread into a huge back and forth argument so maybe we should stop there XD

[Col-E]

>meanwhile in tf2

"Oh you have cheaters? Damn, what a shame..."

---

I feel like VAC is not equal on all platforms, but maybe that's just because I have unlucky tastes in games ¯\_(ツ)_/¯

[ericek111]

Hey, that would make reverse-engineering CS:GO, reporting bugs and modding a PITA. :D I like my favourite game with barely any anti-cheat and no obfuscation beyond stripping debugging symbols (and they forget to to that once every two years :D)... The game is basically open-source, and it gave me a lot, from deeper understanding of Source Engine, to learning assembly, debugging and reverse-engineering-

Yes, it's sad. I don't even run the game with -insecure anymore when attaching GDB. It's incredibly easy to develop cheats for such game.

While I really commend Valve's respect for privacy, there are simple methods to at least discourage a lot of cheat-makers. Detecting VTable hooks, .text writes, glow array writes, those are the easiest to both abuse and detect.

Trust Factor is a great addition to VAC, but that's what it should be -- merely another barrier. I cannot fathom what a pain it must be for a newcomer to win 10 comp. matches and get a rank. I can feel the low TF world after a few weeks of inactivity, it always puts me into a low-TF lobby and takes two to three matches to get decent teammates.

 If you do this you will get vac/overwatch banned within a week and matched with other cheaters within a day

Many cheats are open-source (look at my profile, lol). You can see enemies through walls with literally 3 commands and not risk getting banned.

No support linux - no cheaters from linux users?

Yeeheey, that's 0.5 % less cheaters. Problem solved.

[BlackYuzia]

@x4e you say what valve care about privacy. You know what Windows have telemetry? So, about what privacy you talking? Lol

[BlackYuzia]

Yeeheey, that's 0.5 % less cheaters. Problem solved.

You do realize people play csgo on linux right?

@quadruple-damage how much guys play from linux? how much guys play from windows?

I think windows players > linux players. Of course we have linux players, but I talking about bigger part of players (who play on windows)

This is csgo-osx-linux after all.

Did't know/saw repo with name csgo-osx-windows. Do you know the way? But yep, you right in this.

[SamuelTulach]

Yes, it's sad. I don't even run the game with -insecure anymore when attaching GDB. It's incredibly easy to develop cheats for such game.

While I really commend Valve's respect for privacy, there are simple methods to at least discourage a lot of cheat-makers. Detecting VTable hooks, .text writes, glow array writes, those are the easiest to both abuse and detect.

This is exactly what I am talking about. It's just that I don't see Valve even remotely trying to do something. Just doing some basics checks around the glow array would ban so many people and if done right, chances of false ban would basically be zero.

[kisak-valve]

Good day everybody. Thanks for the suggestions in this issue report. Unfortunately, due to the nature of anti-cheat, this public issue tracker is a poor fit for this type category feedback because any meaningful change requires internal discussions by CS:GO and VAC developer teams and this can not be done publicly without diluting the effect of any anti-cheat changes to the game.

Feel free to use the csgoteamfeedback@valvesoftware.com email address to give anti-cheat feedback and please use it to let the CS:GO team know when you discover new cheating methods.

As a moderator for Valve's public issue trackers, thanks for keeping the discussion here civilized, but I am going to need to lock this issue report to prevent vandalism and the advertisement of publicly available cheats.