Valve Script Detection - possible Countermeasures

[guikaua12]

Valve is detecting this and kicking from the match, any possible bypass?

[Daniel53245]

I guess the input pattern by snap-tap is pretty easy to detect. You might want to add random delay on the snap-tapping to it looks like a real person. However without knowing how they detect it, it might still be possible.

@wasiejen What's you point of view on add feature that adds random delay to the snap-tap.

[wasiejen]

Valve is detecting this and kicking from the match, any possible bypass?

@guikaua12 Hey thanks for your feedback.

Hard to say if they is a bypass - first we have to test out what causes it and then there might be a measure to circumvent it.

Can you give more details?

1. What game and OS do you run?
2. Do you run anything else that might get you kicked? ;-)
3. Do you use the exe or the py file?
4. What are your active Tap Groups and Key Replacements?
5. Is the kick reproducible?
6. What are you doing/have you done exactly? (spamming snap taps - fast direction switching?)
7. Video would also be helpful of the time before a kick. (if feasible) :-)

What I like you to test out:

1. If you use the exe, rename it to something else: maybe timer.exe, clock.exe or something else not related to Free-Snap-Tap. :-)
2. Test the exe if you used the py file or the py file if you used the exe and report back if you are still kicked.

Will post more shortly.

[wasiejen]

I guess the input pattern by snap-tap is pretty easy to detect. You might want to add random delay on the snap-tapping to it looks like a real person. However without knowing how they detect it, it might still be possible.

@wasiejen What's you point of view on add feature that adds random delay to the snap-tap.

@Daniel53245 Question is how it is detected. Maybe they detect input pattern or maybe it is more system based like recognition of the running background processes. Hard to say what will work if we are not knowing what causes the kick.

Reproducibility is the key here to test out some things.

Implementing delays in itself is very easy. The work in it is testing and checking if it works. And then making it optional or adjustable later on.

But is it the cause? Will put a list of possible causes online and solutions online shortly. Everyone is invited to comment, add or discuss on it. :-)

[wasiejen]

How to prevent Anti-Cheat from detection the script?

General Question of how is the script detected?

1. general identification of simulated key events (with the help of the data.flags)
2. recognition of 2 different sources of key events (with the help of the data.flags)
3. detecting the free-snap-tap.exe in background
4. detecting a running python instance in background

Ingame input pattern is recognised because of:

5. missing delay between release of "previous" key and press of "next" key
6. missing repeating input (e.g actual input is just a instead of aaaaaa...)
7. missing crossover of release and press (e.g. a press of "next" before release of "previous)
8. counting movement changes in a defined moving frame of time (e.g. toggling a and d more than a specific number of times in the last 1,2 or 3 seconds ...)

Possible things to test out:

in 1st cast:

• try to change the data.flags to be the same as original keyboard output
  • (1.1) fork pynput and change some things
    • short look into the package did not present an obvious place where the data.flags can be changed or defined
    • need to have a deeper look into it

in 2nd case:

• (2.1) suppress every original keyboard event and pipe everything through the program
  • result is that every key event will be send by the script and so only one source of input can be recognised
    • (may even be compatible with linux because no more selective suppression of events needed)

in 3rd case:

• (3.1) renaming of executable to something generic
  • in best case on an individual user basis or else it will just be blocked again
• (3.2) use the py file to run it as a python instance

in 4th case:

• (4.1) use the exe instead ;-)

in 5th case:

• (5.1) introduce fixed delay between release and press
  • very simple to implement
    • (needs a delay in ms to be defined)
• (5.2) introduce random delay between release and press
  • simple to implement
    • (needs the limits of the random delay in ms to be defined)

in 6th case:

• (6.1) add back repeating
  • very simple to implement

in 7th case:

• (7.1) simulate crossover of release and press event with fixed (always used) crossover
  • (7.1.1, 7.1.2, 7.1.3) without delay, fixed delay, random delay
• (7.2) simulate crossover of release and press event with random (sometimes) crossover
  • (7.2.1, 7.2.2, 7.2.3) without delay, fixed delay, random delay

in 8th case:

• do not spam snap taps ;-)

What can be done?:

• 3 and 4 are the easiest to test
• 1 and 2 would be the most likely cause in my opinion because it is very easy to detect without any input analyzation.
• 5 and 6 are easy to test out with a small test file.
• 7 a bit more effort
• 8 it is entirely up to you :-)

Everyone is invited to discuss this :-)

[wasiejen]

You can test out Anticheat measures 5, 6 and 7 with the py file on the new branch "anticheat_measures". (5.2) random delay with 5-15 ms time (6.1) repeating key input (7.2.3) random crossover 50% chance with random delay from (5.2)

that is the actual implementation.

will make a pre_release test build with an executable to test it out.

[wasiejen]

News from Valve: https://store.steampowered.com/news/app/730/view/6500469346429600836?l=german

Side-stepping Skill

Counter-Strike is constantly evolving. From art, to maps, to inventive plays, and even player input, the CS community shapes the game.

Scripting and automating player commands has always been contentious, but over the years some forms of scripting (e.g., jump-throws) have gained acceptance, as they enable plays that wouldn't otherwise be possible. In fact, jump-throws became such an important part of the game that we've done the work to make them reliable without any special scripting or binds (i.e., by jumping and quickly throwing a grenade).

Developing one's coordination and reaction time has always been key to mastering Counter-Strike.

Recently, some hardware features have blurred the line between manual input and automation, so we've decided to draw a clear line on what is or isn't acceptable in Counter-Strike.

We are no longer going to allow automation (via scripting or hardware) that circumvent these core skills and, moving forward, (and initially--exclusively on Valve Official Servers) players suspected of automating multiple player actions from a single game input may be kicked from their match.

To prevent accidental infractions, in-game binds that include more than one movement and/or attack actions will no longer work (e.g., null-binds and jump-throw binds).

If you have a keyboard that includes an input-automation feature (e.g., "Snap Tap Mode"), be sure to disable the feature before you join a match in order to avoid any interruption to your matches.

[dvgmdvgm]

You can test out Anticheat measures 5, 6 and 7 with the py file on the new branch "anticheat_measures". (5.2) random delay with 5-15 ms time (6.1) repeating key input (7.2.3) random crossover 50% chance with random delay from (5.2)

that is the actual implementation.

will make a pre_release test build with an executable to test it out.

If i got it right nothing is not working from pre-release. I change one by one "# Anticheat testing (ACT)" vars to true adnd when i jump into the game my character just moving so slow with Free-Snap-Tap activated. Several steps it workimg great and after serveral seconds of moving my character significantly slowed down Some video exaple: https://www.youtube.com/watch?v=qg--LXjPUvA

[wasiejen]

Thanks for testing this buggy pre-release xD Was written without access to a game to even test it.

If i got it right nothing is not working from pre-release. I change one by one "# Anticheat testing (ACT)" vars to true adnd when i jump into the game my character just moving so slow with Free-Snap-Tap activated. Several steps it workimg great and after serveral seconds of moving my character significantly slowed down Some video exaple: https://www.youtube.com/watch?v=qg--LXjPUvA

The bad performance of movement was due to the repeating key events from (6.1). Removed it entirely in V0.7.0 The ACT_ Flags were just some preparation - but not used in the pre-release. The random delay and crossover where always active in this build. :-)

Flags are now used in V0.7.0. Worked so far great for me in cs2. :-) See start-arguments or just edit py file :-D

[dvgmdvgm]

Thanks for testing this buggy pre-release xD Was written without access to a game to even test it.

If i got it right nothing is not working from pre-release. I change one by one "# Anticheat testing (ACT)" vars to true adnd when i jump into the game my character just moving so slow with Free-Snap-Tap activated. Several steps it workimg great and after serveral seconds of moving my character significantly slowed down Some video exaple: https://www.youtube.com/watch?v=qg--LXjPUvA

The bad performance of movement was due to the repeating key events from (6.1). Removed it entirely in V0.7.0 The ACT_ Flags were just some preparation - but not used in the pre-release. The random delay and crossover where always active in this build. :-)

Flags are now used in V0.7.0. Worked so far great for me in cs2. :-) See start-arguments or just edit py file :-D

-crossover=50 still got kicked from VAC server for input manipulation. -delay=50 working great now but need more time to test.

[wasiejen]

Crossover uses the same delay as defined by -delay. If you just use -crossover it will still send 2 key events at the same time, because thee is no delay defined.

Maybe not the best implementation choice looking back. xD

I tested both with 30 and no kick. But I must confess I was never kicked yet. :-D We should reduce that further for the delay. 50 ms is an eternity if you play cs2. E.g. in the worst case on a 144 Hz screen you might have to wait 7 frames until an action is even registered.

[guikaua12]

So far, playing with -delay=50 and -crossover=50 seems fine, no kicks

[dvgmdvgm]

Crossover uses the same delay as defined by -delay. If you just use -crossover it will still send 2 key events at the same time, because thee is no delay defined.

Maybe not the best implementation choice looking back. xD

I tested both with 30 and no kick. But I must confess I was never kicked yet. :-D We should reduce that further for the delay. 50 ms is an eternity if you play cs2. E.g. in the worst case on a 144 Hz screen you might have to wait 7 frames until an action is even registered.

I was kicked with crossover argument after 15 seconds of Dm. delay=30 working great 3DMs in a row.

Whats value of delay could be fine with 240hz monitor?

Any chance to implement "stopright..." alias by your application?

[wasiejen]

Would be interesting to see how close together the key events are allowed to be before a kick happens. :-) Can someone who gets kicked try that out? How low can you go? :-D

Based on the statement of valve they might just kick for multiple actions in a very short timeframe. And maybe that also needs to be very consistent. So they seem to just observe what the game is getting as input and not using background processes to identify the script.

A minimal definable value might be also useful for the delay.

[wasiejen]

Right now always use delay and crossover together. Without delay the crossover will still happen at the same time.

[wasiejen]

Crossover uses the same delay as defined by -delay. If you just use -crossover it will still send 2 key events at the same time, because thee is no delay defined. Maybe not the best implementation choice looking back. xD I tested both with 30 and no kick. But I must confess I was never kicked yet. :-D We should reduce that further for the delay. 50 ms is an eternity if you play cs2. E.g. in the worst case on a 144 Hz screen you might have to wait 7 frames until an action is even registered.

I was kicked with crossover argument after 15 seconds of Dm. delay=30 working great 3DMs in a row.

Whats value of delay could be fine with 240hz monitor?

Any chance to implement "stopright..." alias by your application?

The Hz measure was just an example, to get the most out of it the delay should of cause be as short as possible without being kicked. With a min delay maybe it gets more consistent.

On line 362 you can change the min delay by hand if you want to try it out. (just replace the 0) 362 delay = randint(0, ACT_MAX_DELAY_IN_MS)

My guess is that we might get lower delay in general with a higher minimum delay and a lower maximum delay. Maybe 5 and 15 ms. :-)

Min delay of 5 and max delay of 15 works for me with crossover active. Not kicked yet in dm.

And what is this stopright alias?

[dvgmdvgm]

Crossover uses the same delay as defined by -delay. If you just use -crossover it will still send 2 key events at the same time, because thee is no delay defined. Maybe not the best implementation choice looking back. xD I tested both with 30 and no kick. But I must confess I was never kicked yet. :-D We should reduce that further for the delay. 50 ms is an eternity if you play cs2. E.g. in the worst case on a 144 Hz screen you might have to wait 7 frames until an action is even registered.

I was kicked with crossover argument after 15 seconds of Dm. delay=30 working great 3DMs in a row. Whats value of delay could be fine with 240hz monitor? Any chance to implement "stopright..." alias by your application?

The Hz measure was just an example, to get the most out of it the delay should of cause be as short as possible without being kicked. With a min delay maybe it gets more consistent.

On line 362 you can change the min delay by hand if you want to try it out. (just replace the 0) 362 delay = randint(0, ACT_MAX_DELAY_IN_MS)

My guess is that we might get lower delay in general with a higher minimum delay and a lower maximum delay. Maybe 5 and 15 ms. :-)

python .\free_snap_tap.py -delay=5 working great for me.

[wasiejen]

min 0 and max 1 was definitely not working for me. yay first kick :-D

min 2 and max 4 -> kicked for spamming snap tap min 0 and max 5 -> kicked for spamming snap tap

So spamming is also a factor - how many key events in a timeframe are send out.

[dvgmdvgm]

What do you think about external configuration file to bind some macros stuff? Latest update remove jupthrow bind in CS2. For example i need to pull up some grenade, do jump, release grenade. Can we simulate this routine by one key using you app?

make configuration text file like: space > n, p — simulate two buttons space > n, o, p — simulate three buttons So when space is pressed your app can send to the game N & P buttons with some random delay beetwen both. It will be so powerfull app if it's possible.

[wasiejen]

What do you think about external configuration file to bind some macros stuff? Latest update remove jupthrow bind in CS2. For example i need to pull up some grenade, do jump, release grenade. Can we simulate this routine by one key using you app?

make configuration text file like: space > n, p — simulate two buttons space > n, o, p — simulate three buttons So when space is pressed your app can send to the game N & P buttons with some random delay beetwen both. It will be so powerfull app if it's possible.

I think this is possible. Strangely it might be easier to realize key combinations like control+n, because the change from a key replacement to a key combination is not this far. For aliases with multiple keys a new group might be necessary, or to add to the existing key replacements via a new syntax like you suggested with key > key1, key2, key3, ...

[dvgmdvgm]

What do you think about external configuration file to bind some macros stuff? Latest update remove jupthrow bind in CS2. For example i need to pull up some grenade, do jump, release grenade. Can we simulate this routine by one key using you app? make configuration text file like: space > n, p — simulate two buttons space > n, o, p — simulate three buttons So when space is pressed your app can send to the game N & P buttons with some random delay beetwen both. It will be so powerfull app if it's possible.

I think this is possible. Strangely it might be easier to realize key combinations like control+n, because the change from a key replacement to a key combination is not this far. For aliases with multiple keys a new group might be necessary, or to add to the existing key replacements via a new syntax like you suggested with key > key1, key2, key3, ...

If you will try to add this feature you can realize it however you want) But now some of instasmokes can be missed because of latest update :(

[wasiejen]

Have a look at the branch key-replacement-as-alias ;-)

Just define key_groups with more then 2 keys.

Menu should work for that, if not than just add in the key_group.txt a new line with more than 2 keys.

e.g. j, n, o, p If there are more than 2 keys it will be interpreted as alias and every key will be pressed and released in series on keypress of the first key (e.g. j).

ALIAS_MIN_DELAY_IN_MS and ALIAS_MAX_DELAY_IN_MS can be changed if needed.

have fun :-)

[wasiejen]

added

Have a look at the branch key-replacement-as-alias ;-) Just define key_groups with more then 2 keys. #Menu should work for that, if not than just add in the key_group.txt a new line with more than 2 keys. e.g. j, n, o, p If there are more than 2 keys it will be interpreted as alias and every key will be pressed and released in series on keypress of the first key (e.g. j). ALIAS_MIN_DELAY_IN_MS and ALIAS_MAX_DELAY_IN_MS can be changed if needed. have fun :-)

Keys like + or - can be recognized?

Added: , . - # + keys. :-)

You can also use the menu with the option 7 to find the virtual key codes and just add them to your vk_code_dict and then can be used as plan text in the menu or directly in the txt file.

you can do now things like:

• -k, p|10, o|5, i|15|3
  • when k is pressed , send p with a max delay of 10, then o with may delay of 5, then i with min delay of 3 and max of 10 (order of delays is free - it fetches the smaller one as min and the bigger one as max.
• +o,r,e,v,e,r,s,e,d,-left_shift,w,o,r,l,d,+left_shift
  • when o is released writes "reversedWORLD"
• -o,-left_shift,h,e,l,l,o,+left_shift,w,o,r,l,d
  • when o is pressed writes "HELLOWORLD"
• --,-+,++
  • when minus is pressed sends a + press and release
• +-,o,k
  • when minus is released writes "ok"

some explanation:

• `` nothing in front of a key is a press and release (normal)
• - in front of a key is a press (down)
• + in front of a key is a release (up)
• # in front of a key is a release and a key (reversed input)
• | behind a key is the the max delay for this single key (e.g. -k|10 -> press k with a max delay of 10)
• |*max*|*min* defines min and max delay (e.g. -k|10|2 or -k|2|10 -> press k with a max delay of 10 and min delay of 2)

This is only usable in key groups. not supported in tap_groups yet.

[dvgmdvgm]

added

Have a look at the branch key-replacement-as-alias ;-) Just define key_groups with more then 2 keys. #Menu should work for that, if not than just add in the key_group.txt a new line with more than 2 keys. e.g. j, n, o, p If there are more than 2 keys it will be interpreted as alias and every key will be pressed and released in series on keypress of the first key (e.g. j). ALIAS_MIN_DELAY_IN_MS and ALIAS_MAX_DELAY_IN_MS can be changed if needed. have fun :-)

Keys like + or - can be recognized?

Added: , . - # + keys. :-)

You can also use the menu with the option 7 to find the virtual key codes and just add them to your vk_code_dict and then can be used as plan text in the menu or directly in the txt file.

you can do now things like:

• -k, p|10, o|5, i|15|3

  • when k is pressed , send p with a max delay of 10, then o with may delay of 5, then i with min delay of 3 and max of 10 (order of delays is free - it fetches the smaller one as min and the bigger one as max.

• +o,r,e,v,e,r,s,e,d,-left_shift,w,o,r,l,d,+left_shift

  • when o is released writes "reversedWORLD"

• -o,-left_shift,h,e,l,l,o,+left_shift,w,o,r,l,d

  • when o is pressed writes "HELLOWORLD"

• --,-+,++

  • when minus is pressed sends a + press and release

• +-,o,k

  • when minus is released writes "ok"

It's fckmg amazing! All jumpthrow binds working perfectly! But how bout +mouse_left command? I wrote n, space, +mouse_left but my left mouse button is not released.

[wasiejen]

I guess you like it :-D

Oh mouse button ... :-), no mouse events are not yet handled in Aliases - only in direct key replacements like n, +mouse_left

Can you post some examples of what you are using? Would also like to try some :-D Or what other things might not work for you?

[wasiejen]

Added mouse functionality to Aliases. Nothing else broke so far and seemed to work but I have not an easy way to test right now. :-) But make a backup of the old py before testing :-D

Need a break. Have fun :-D

[dvgmdvgm]

Added mouse functionality to Aliases. Nothing else broke so far and seemed to work but I have not an easy way to test right now. :-) But make a backup of the old py before testing :-D

Need a break. Have fun :-D

Do you know what? It working so perfectly! The same as native CS2 binds before last update! Any chance to make it work while game window is on focus? And disable when game is not active? Thanks sir

[wasiejen]

Glad to here that it works. And thanks for getting me started on this last updates in the first place. I wanted to implement some kind of macro functionality for some time now - and this got even better than that. :-D And it was a fun Coding Night :-D

To only activate it when a game is in focus might be easier implementable than I thought 5 minutes ago. I imagine a start-argument with the name of the game is needed for it to work - it will then only work in that game. Or you just use the controls that are already implemented and toggle it by hand.

Please create a new Issue (Enhancement) with that - this it not really on topic here any more. :-D First small test so far seems promising, but no more coding for me today. :-D

And feel free to open other feature requests - lets get this repo a bit more lively :-D