Druid with swift flying form always report teleport hack or speed hack

[kissingers]

Current Behaviour

Just like the picture, but they are norm flying, and only effect with durid, other's no problem.

And when the player is controlled by the monster, there is a high probability report an ingore control hack attack.

Expected Blizzlike Behaviour

they are seens normal fly , not cheat hack

Source

No response

Steps to reproduce the problem

Anticheat.DetectFlyHack = 1 Anticheat.DetectWaterWalkHack = 1 Anticheat.DetectJumpHack = 1 Anticheat.DetectTelePlaneHack = 1 Anticheat.DetectSpeedHack = 1 Anticheat.DetectClimbHack = 1 Anticheat.DetectTelePortHack = 1 Anticheat.IgnoreControlHack = 1 Anticheat.DetectZaxisHack =1 Anticheat.AntiSwimHack = 1 Anticheat.DetectGravityHack = 1 Anticheat.AntiKnockBack = 1

Extra Notes

No response

AC rev. hash/commit

All azerothcore and antcheat mode are laster original master

Operating system

debian 11 x64

Custom changes or Modules

No response

[acidmanifesto]

So results are as follows:

Druid Swift Flying

is flagging the anticheat when the aura is cancelled.

Creatures that are controlling players.

Will need more information, what is the creature's entry id that is doing it?

[acidmanifesto]

@kissingers

Druid Swift Flying false flag fix core side.

https://github.com/azerothcore/azerothcore-wotlk/pull/12692

[kissingers]

Update to https://github.com/azerothcore/azerothcore-wotlk/pull/12692 But still have the report for teleport hack detected

If flag Anticheat.StricterFlyHackCheck = 1 the report will case so busy that every 2 second report ones. and it seems not only Durid, any fly player down to the land digging grass and mining will case the report.

[acidmanifesto]

Update to https://github.com/azerothcore/azerothcore-wotlk/pull/12692 But still have the report for teleport hack detected

If flag Anticheat.StricterFlyHackCheck = 1 the report will case so busy that every 2 second report ones. and it seems not only Durid, any fly player down to the land digging grass and mining will case the report.

I will look into it more today. Do u have that creature information for the ignore control issue?

[kissingers]

I test an environment, when flying on Outland Blade Mountain, close the creature such as 21381 , which will cast a spell 37359, the report will happen. If flag Anticheat.StricterFlyHackCheck = 1 when flying and close any creature imcombat, also report.

[acidmanifesto]

If flag Anticheat.StricterFlyHackCheck = 1 the report will case so busy that every 2 second report ones. and it seems not only Durid, any fly player down to the land digging grass and mining will case the report.

I will need to see video of how that is false flagging, as i can not get it to false flag with those instructions. The druid it was false flagging when you remove the aura for its transformation, I added in a helper with that PR earlier and that resolved that false flag, but right now i can not get the teleport hack to trigger with the information you provided with flying and mining.

What revision of Azerothcore are you using? Is it a cherrypicked version or do you have all the commits with custom changes? Can you do a search for the helpers used in the source code for

SetCanTeleport(true);

and tell me how many search results you have? Right now it sounds like you are missing a helper, possible in the taxihandlier

[acidmanifesto]

I test an environment, when flying on Outland Blade Mountain, close the creature such as 21381 , which will cast a spell 37359, the report will happen. If flag Anticheat.StricterFlyHackCheck = 1 when flying and close any creature imcombat, also report.

i have been flying around that mob as well and i do not get a false hit for ignore control. spell 37359 does not contain root or stun effects. Please double check the spell and creature entry.

[kissingers]

2022-08-11 00-04-39.zip

The ZIP has 2 vedio for report the error. might I make mistake for some condition. The test video show not the creature problem, an error will be reported if you hit or approach uneven ground while flying.

[kissingers]

This vedio can see when flying down to land and not have not hit any thing yet, it also report error. 2022-08-11 00-23-25.zip

[kissingers]

both azerothcore and mod-anticheat have "git pull origin master" to now.

[acidmanifesto]

Thank you for the Video. I now have a clearer understanding of the issue. I will look into it now

[acidmanifesto]

@kissingers please test latest anticheat module and let me know if that resolves your issues now. https://github.com/azerothcore/mod-anticheat/commit/d17d2cdbe55ea8bfbb73e3b865ce0620b85b2600

[kissingers]

Thanks, it seems teleport hack has fixed.

But another ignore control hack still has problem. when play is running and suddenly be fixed by creature, then there is a small chance match the ignore control hack. I think maybe caused by the delay. but my delay only 9ms, still will error report. and the delay more than the 100ms's player will have big chance error report. (Can add a creature ID 17671 to test)

Please lookup the vedio: 2022-08-11 07-56-50.zip

[acidmanifesto]

Thanks, it seems teleport hack has fixed.

But another ignore control hack still has problem. when play is running and suddenly be fixed by creature, then there is a small chance match the ignore control hack. I think maybe caused by the delay. but my delay only 9ms, still will error report. and the delay more than the 100ms's player will have big chance error report. (Can add a creature ID 17671 to test)

Please lookup the vedio: 2022-08-11 07-56-50.zip

Thank you for the video. I will check into it tomorrow. Right now its late at night for me.

[Awixs777]

Hi, I'll add the topic. A similar problem, as with the druid, is also observed when dismounting from the mount. I am attaching a video. Last revision.

https://github.com/Awixs777/mod-anticheat/raw/a26657d60b939424233dfcecdfafc5fdbed31fe2/mount.zip (sorry for music)

[acidmanifesto]

Hi, I'll add the topic. A similar problem, as with the druid, is also observed when dismounting from the mount. I am attaching a video. Last revision.

https://github.com/Awixs777/mod-anticheat/raw/a26657d60b939424233dfcecdfafc5fdbed31fe2/mount.zip (sorry for music)

please try latest module update: https://github.com/azerothcore/mod-anticheat/commit/039ed9b782abf67f959aa80c1f6e3d0489059b78

[acidmanifesto]

Thanks, it seems teleport hack has fixed.

But another ignore control hack still has problem. when play is running and suddenly be fixed by creature, then there is a small chance match the ignore control hack. I think maybe caused by the delay. but my delay only 9ms, still will error report. and the delay more than the 100ms's player will have big chance error report. (Can add a creature ID 17671 to test)

Please lookup the vedio: 2022-08-11 07-56-50.zip

please try latest module update: https://github.com/azerothcore/mod-anticheat/commit/039ed9b782abf67f959aa80c1f6e3d0489059b78

[Awixs777]

Hi, I'll add the topic. A similar problem, as with the druid, is also observed when dismounting from the mount. I am attaching a video. Last revision. https://github.com/Awixs777/mod-anticheat/raw/a26657d60b939424233dfcecdfafc5fdbed31fe2/mount.zip (sorry for music)

please try latest module update: 039ed9b

Checked. Still , if dismounted mid-flight and continue moving forward with W pressed, defines a teleport hack. If you just get up in the air and dismount, there are no mistakes. https://raw.githubusercontent.com/Awixs777/mod-anticheat/b7e9e72e1796406d6fd8de7912f26e7974226c03/Screenshot_4.png

[kissingers]

2022-08-12 00-32-45.zip Updte to 039ed9b When player is moving, the creature 17671 cast spell 32588, still match the ignore control hack.

[kissingers]

2022-08-12 00-48-26.zip And I try Awixs777 way, when drop from the sky, if press any of "asdqwe" will report teleport hack.

[acidmanifesto]

Try again for hte teleport with new push: https://github.com/azerothcore/mod-anticheat/commit/144d8144323a71a1c419b84347f4c09e74260910 Will need to know what modules u have in your core for the ignore control issue. I still can not replicated. All i have on my end is the anticheat and azerothcore, nothing else.

[Awixs777]

Thank you so much. In the case of moving in the air and dismounting, fixed. https://github.com/Awixs777/mod-anticheat/raw/d7ac3f73277010830d4c3feb204d039b3ac5af4f/bandicam%202022-08-11%2020-38-24-491.mp4

[acidmanifesto]

Thank you so much. In the case of moving in the air and dismounting, fixed. https://github.com/Awixs777/mod-anticheat/raw/d7ac3f73277010830d4c3feb204d039b3ac5af4f/bandicam%202022-08-11%2020-38-24-491.mp4

Awesome. Thanks for the follow up. Will look at the ignire control issue once i get further details

[Awixs777]

Thank you so much. In the case of moving in the air and dismounting, fixed. https://github.com/Awixs777/mod-anticheat/raw/d7ac3f73277010830d4c3feb204d039b3ac5af4f/bandicam%202022-08-11%2020-38-24-491.mp4

Awesome. Thanks for the follow up. Will look at the ignire control issue once i get further details

This is a slightly different topic, but I'll add it here, because by teleport. The speed and fly hack collect reports quite quickly, and the teleport hack is very slow. That is, if a player uses speeds and a fly hack, he will be blocked in a few minutes. And a player using a teleporthack can teleport exactly as many times as specified in the config before receiving a punishment. Let's say if the value is 70, then 70 times. Is it possible to somehow change the multiplier for the teleporthack, for example, so that 5 reports are issued for 1 teleport?

[acidmanifesto]

Thank you so much. In the case of moving in the air and dismounting, fixed. https://github.com/Awixs777/mod-anticheat/raw/d7ac3f73277010830d4c3feb204d039b3ac5af4f/bandicam%202022-08-11%2020-38-24-491.mp4

Awesome. Thanks for the follow up. Will look at the ignire control issue once i get further details

This is a slightly different topic, but I'll add it here, because by teleport. The speed and fly hack collect reports quite quickly, and the teleport hack is very slow. That is, if a player uses speeds and a fly hack, he will be blocked in a few minutes. And a player using a teleporthack can teleport exactly as many times as specified in the config before receiving a punishment. Let's say if the value is 70, then 70 times. Is it possible to somehow change the multiplier for the teleporthack, for example, so that 5 reports are issued for 1 teleport?

The If statement that covers auto kick is here in the module source. https://github.com/azerothcore/mod-anticheat/blob/144d8144323a71a1c419b84347f4c09e74260910/src/AnticheatMgr.cpp#L893

Although there is a auto moderation feature. There are stats that are collected in the db if you look at the wiki incase u need to investigate for manual moderation of a player's account. But long story short, there is no perfect way in automatically moderating players for cheats, and sometimes manual observation or statistic reviews will be required.

[kissingers]

Thanks, the fall to ground teleport hacker report fixed.

Anticheat.zip But I test only with antcheat module and the above config file, still report ignore control hacker.

[acidmanifesto]

Thanks, the fall to ground teleport hacker report fixed.

Anticheat.zip But I test only with antcheat module and the above config file, still report ignore control hacker.

in one of your screen shots i notice you have eluna which is not native to azerothcore. What lua modules do you have in your build?

[kissingers]

In test server, I only have Anticheat module, but problem is same, with a message "error"

this is vedio 2022-08-12 09-49-48.zip

this is worldserver.conf worldserver.zip

this is antcheat.conf Anticheat.zip

[kissingers]

Normal logic when player is controlled, but the player gets out of control and continues to walk, then it is ignore control attack. If the player is controlled when walking, then can not walk, it is not out of control attack. The difference is time order, walking when controlled is not, walking after controlled is yes, the current logic should be the user walking with little delay, after being controlled, the server think player is still in walk status or still walk in a short distance, so match the ignore control attack?

[acidmanifesto]

Normal logic when player is controlled, but the player gets out of control and continues to walk, then it is ignore control attack. If the player is controlled when walking, then can not walk, it is not out of control attack. The difference is time order, walking when controlled is not, walking after controlled is yes, the current logic should be the user walking with little delay, after being controlled, the server think player is still in walk status or still walk in a short distance, so match the ignore control attack?

the real issue is, we can not get it to replicate on our local with the ignore control false hit. How this detection works is if the player has either the root or stun state and has a position change in their X and Y coordinates while having those state it will flag the anticheat as moving in those states are not possible in retail and should not be possible in emulation. So far the detections we had on this on certain servers have resulted in cheats but so far only seen in pvp, as for pve we have yet to encounter what it is happening in your videos at the moment. But we are going to look into readjusting the detection.

[acidmanifesto]

Normal logic when player is controlled, but the player gets out of control and continues to walk, then it is ignore control attack. If the player is controlled when walking, then can not walk, it is not out of control attack. The difference is time order, walking when controlled is not, walking after controlled is yes, the current logic should be the user walking with little delay, after being controlled, the server think player is still in walk status or still walk in a short distance, so match the ignore control attack?

can you try latest version of the anticheat module: https://github.com/azerothcore/mod-anticheat/commit/9bdcc96b52f6470e6940b0de57a9f732afce522a

[kissingers]

Update to https://github.com/azerothcore/mod-anticheat/commit/9bdcc96b52f6470e6940b0de57a9f732afce522a It seems remove SPELL_AURA_MOD_STUN, all work ok, thanks very much!

[acidmanifesto]

thank you for the follow up then. i will close the issue for now and i will rework stun back in at another time.