Ok so here’s some very useful information about the popular hacks used in Counter Strike. This is placed here for the sole purpose of making it easier to spot a hacker. If you know what to look for then it really helps.
The following information was provided by Cooliced, a former member of WildCards who has now co-created a clan call Fallen Wild. You can visit their clan site at http://www.fallenwild.co.uk/news.php and visit and support their new public server, it’s i.p is 85.234.148.18:29035
———————————————————————-
Hacks are sometimes confusing and hard to spot unless you know what they do and what you’re looking for. In this section they will be detailed to help you understand them more thoroughly.
Aimbot: Aimbots use the computer’s accurate knowledge of the enemy’s figure and aligns, and shoots automatically. Aimbots usually aim at the head, but some hacks have adjustable vectors to aim at different parts of the enemy body. Some have randomizing algorithms intended to make the identification of an aimbot user harder by spectators observing the player. In their most basic form, aimbots facilitate hitting the enemy player more accurately. However, that is where the similarities stop.
XQZ’s early, relatively primitive aimbot would be bound to a button on the keyboard or a mouse, and as long as the button was pressed, the aimbot would take care of properly aligning the crosshair on the head (or if necessary, a different body part). This button could be the same button as the fire button and thus could enable the aimbot to only aim while firing. But this gave away its presence to an alert observer by its tendency to “slave” (the all-too-proper, inhuman following of the motion of an enemy player).
Early OGC’s aimbot portion was already much more advanced, and could be configured in a variety of ways. Auto-aiming allowed automated proper aiming and slaving. Auto-shot was another feature, where the bot would automatically cause the player avatar to fire their weapon if the aimbot locked up. It could be configured freely with an aimbot FOV (field of view). XQZ style aiming could also be employed.
Later versions of OGC’s aimbot portion allowed for punctual aiming, where one hit of a button (commonly the fire button) would merely result in one single adjustment of aim, without any form of “slaving”.
Modern, so called “LAN-Proof” cheats implement what is called charged aiming which is yet another improvement over punctual aiming. Punctual aiming mode is only active (charged) when a specific button is pressed shortly before the aiming is needed, and firing in turn empties this charge. While this may be inconvenient, it allows anyone at a tournament to briefly check the suspected cheater’s game for any inconsistencies, only to find nothing.
Some highly advanced and private aimbots do not even bother to move the crosshair as they are proxies and work on the network level. While essentially charged aimbots with a small FOV, the hits appear to be the result of an overabundance of luck rather than anything magically moving the crosshair. The advantage of this is to make nospread (see below) cheats less obvious and thus increase the effectiveness of them while only minimally affecting stealth.
Lan proof aimbots:The first well known aimbot, XQZ, was specifically designed to work at LAN parties where other players could look over the shoulders of the cheater. A modern cheat is a highly sophisticated tool with the potential employed relatively undetected at a LAN party, making what most casual cheaters and anti-cheaters know as cheats (especially the infamous OGC) look like children’s toys.
Many modern stealthy aimbots employ ‘charging’, where only a subtle key combination (e.g. shift + the key to buy ammo, or strafe left and right at the same time) would load the aimbot for a brief time and only for a few bullets. Even if a tournament administrator were to replace the cheater in order to look for anything suspicious, they would find nothing, for they would not know the subtle key combination to charge the aimbot. A series of occurrences of people apparently using their “timeleft” key to charge their bot has eventually made observers dub this type of aimbot Timeleft cheat.
Furthermore, a stealthy aimbot is configured to use only a small FOV (field of view), forcing the cheater to actually move their mouse to aim the crosshair sufficiently close to the position of the enemy. By relying on the cheaters normal reactions for the initial part of aiming the cheat becomes more natural looking and harder to detect but still allows the cheater dead-on accuracy once activated. Alternatively an aimbot can be configured to be charged for auto-aim and auto-fire only when a player is in dire situations. Furthermore, well made stealthy aimbots don’t slave – they are aimed and fired the instant the mouse button is pressed, and do not move again until the mouse is pressed a second time. Even an experienced observer trying to verify if mouse and screen movements correlate would have a tough time seeing anything out of the ordinary, with the cheating being almost indistinguishable from a skilled player with good aim and reflexes.
There are rumors about a few exclusive and private aimbots which appear to work with a proxy-type lucking technique rather than actual aiming, to make the screen’s movement even less visible. The mouse would be dragged near the enemy, and upon pressing the fire button, the bullet magically hits the head of the target despite the crosshair not being directly on top of it. While this would be very obvious with large FOVs, it would be almost impossible to notice with sufficiently small FOVs due to Counter-Strike’s often inaccurate weapons and inexplicable hits/misses, which do not make such hits seem impossible, except for their extreme frequency.
Auto Recoil: Automatically reduces recoil for each gun individually or sets it to the best pre-designated value.
Auto Wall: Automatically shows when a person can be shot through a wall using piercing ammunition.
AVDraw: Draws a dot, like an extended crosshair, to show you where your weapon will hit.
Box ESP: Draws a box around player models. (Configure to be both teams, enemy team or friendly team.)
Barrel/FM Laser: Draws lasers which point out from players to show where they are aiming/looking. (Configure to be both teams, enemy team or friendly team.)
OCG Crosshairs: Customizable crosshairs which have much greater potential than the ones provided by the game.
Distance ESP: Draws text on each player model with customizable information.
Entity ESP: Like regular ESP it also draws information for things like dropped weapons, the bomb and hostages.
Flash Removal/Anti-Flash: Prevents flashbangs from effecting the player.
Font Style: Customizable text font for many of the games aspects.
Auto Bunnyhop: Automatically produces the Bunnyhop motion for a player to greatly increase their movement speed.
General Speed hacks:Speedhacks change the computer’s perception of time and lets the cheater act extraordinarily fast. Most of the time they are found in combination with other cheats. Speedhacks can offer high time rates to clean out maps within seconds, or very slightly increased time rates to subtly improve the performance of an aimbot. Any client with a speed hack installed will find that their in-game movement and weapon rate-of-fire are far faster than other players. Like no-recoil, a timehack (or speedhack) is most often used in combination with an aimbot. Depending on the rate of time acceleration, a timehack can be used to rush to the enemy team’s spawn point and kill all enemy players within the first seconds of a round, or it can be used with a very low time acceleration (e.g. a rate of 1.1 or 1.2) to improve total damage over time of weapons. A timehack with a low time acceleration can also be used to reduce the time required to reload weapons.
Knife Speed: Produces speed hack like speed when a knife attack launched.
Auto Speed: Automatically produces instant movement speed when a pre-designated key is pressed (usually the fire button).
Manual Speed: Produces instant movement speed while a pre-designated key is pressed and held.
Lock Target: Will lock the crosshair onto an enemy target until he is dead. Targets can be altered with a pre-designated key and the switch between targets usually takes less than 20 milliseconds.
Low Ammo Warning: Displays an on screen warning when a person is below a pre-designated %%percentage%% of ammunition.
Lambert: Removes all shadow and dark spots from game play.
Name ESP: Draws text on player model which shows the player name. (Can be configured to show other information as well, such as HP.)
No Sky: Removes the sky from game play.
No Spread/No recoil: Essentially the same thing, no-recoil and no-spread attempt to reduce the inaccuracy of weapons when firing. No recoil describes the automated compensation of recoil on the vertical axis, while no spread tries to compensate the horizontal spread of the weapon. As the recoil and spread of gunfire in Counter-Strike is pseudo-random, it can be reverse-engineered and predicted, allowing a cheat to compensate for inaccuracy.
The different names for no recoil and no-spread are mostly historical. No-recoil is much older and could be performed by protohacks – all that was necessary was to move the aiming reticle downwards in a distinctive way to accommodate for the vertical recoil of the weapons. No spread is by comparison, a relatively recent invention that can accurately predict the deviation and compensate for any inaccuracy, making all bullets hit exactly the same spot.
While both variants can be used independently, some older, slaving aimbots make the use of at least a no-recoil cheat a necessity, thus effectively making them part of the aimbot itself. Even with modern, punctual/charged aimbots it is very common to utilize no-spread if stealth isn’t as important as performance. More stealthy, chargeable aimbots usually link the spread-suppressing factor to the charge and state of the aimbot. This prevents any stray, unaimed shots at a wall from giving away the presence of a no-spread cheat. They may also only remove the spread from the first 3-5 shots, or even only the first two bullets fired from a gun. However, they can eventually be detected by observers from subtle, rapid movements of the crosshair and are thus often disabled completely when stealth is paramount, like at LAN parties.
Overview Radar: Draws the overview map in place of the radar, as if the person were in spectator mode.
No Fog: Removes all fog from game play.
Smoke Removal/Anti-Smoke: Removes all smoke from game play (disables smoke grenades against player view).
Smooth: Smoothly lock onto a target or move crosshair towards target, causing less suspicious action.
Spin Hack: Play appears to be spinning to everyone else in the game. A multi-hack which can be configured.
Team Recognition: Part of the customizable aspect of other hacks to allow selected aiming of players.
Third Person: Changes the player view to 3rd person as if they were in spectator mode.
Time: Draws an on-screen display of the players local time.
XQZ Wallhack/Wallhack: Shows just the enemy through walls or makes walls almost invisible (adjustable opacity level).
YHAM: Is an older multihack which causes a player to change their name over and over very quickly.
Weapon ESP: Draws text on players models of what weapon they are carrying and can also dis
Spiked modules:Long ’spikes’, visible through walls, announce the presence of another player on the computer of a cheater. These are the simplest to implement since a few changes, or sometimes even bugs in the graphics cards drivers, can lead to the ability of a player to see other players through walls.
Ball hack:A ball floating above all players that was visible through walls, even if the players themselves were hidden. But this so called “ballhack” gave the players less information, especially about the armament or the heading of enemies, and thus was not very popular.
Data file hacks:Replacing player skins with brighter colored ones which are easier to spot at a distance or in darker areas of the maps.
Replacing sounds of silenced weapons by their normal counterparts, making them more audible.
Currently, the Half-Life engine and the Source engine both prevent those sensitive data files from being altered in such ways. This means it is only possible to use maliciously altered data files online when combined with an executable cheat that suppresses the engine’s own integrity check.
Methods of creating hacks:Replacing client.dll and datafiles
One of the first type of cheats that appeared for Counter-Strike were the so called headshot scripts. They utilized an altered client.dll that offered additional functions to scripts, therefore a script written in extended CS script replaced the more common mouse/keyboard bindings for attacks.
Similarly, data file cheats exchanged data like sound files, but mostly models for variations that imposed some sort of drawback for the enemies of the cheater, like, louder silenced weapons or player models that were visible through walls and doors due to spikes, or in the dark due to luminous / brightly colored textures.
Neither of the two types of cheats are considered effective at this time. Regular aimbots prove to be far more powerful than headshot scripts, and client.dll, like player models / sound file changes are restricted as servers are provided checksums by clients and can choose to disconnect them if they differ from the checksum values on the server. Although theoretically a new generation of hacks could fake checksums or filesystem calls.
Hooks
Client Hooks make use of the fact that any system that employs Dynamically Linked Libraries allows the relatively easy replacement and/or redirection of function calls within those libraries. These systems include Linux, FreeBSD, Mac OSX, Windows, and just about every other modern operating system.
The reason why Counter-Strike is considered to be vulnerable to this attack is, because the mod is itself a separate entity from the Half-Life engine, and the two parties communicate to each other with easily-intercepted DLL calls. Most people consider this a special weakness of the Counter-Strike architecture that is not directly applicable to all games. However, few contemporary games are one monolithic executable, and almost all of them are utilizing DLL calls for various purposes – if not just driver calls.
The source of the loaddll library, written by the author of the original OGC was eventually released into open source, and lead to a multitude of OGC-like cheats that utilized the same facility to wedge itself between the game’s engine and the mod’s game logic.
The same thing may also have lead to the relative hook-proofness of current anti-cheats. VAC appears, and C-D even claims to be able to detect client hooks reliably, although there has been a history of hooks which managed to work without being detected by either one or both.
Amongst the first aimbots were color based aimbots, known to exist only for relatively early versions of Counter-Strike. They colored either team in its distinctive color (e.g. bright green or bright red) and would automatically fire on any pixel with this color. Since they could sometimes been foiled by using multi-colored logos, they did not have much success. A key was pressed to switch from auto-aiming at one team to the other.
Driver manipulation
Beginning with XQZ, Counter-Strike has had a long tradition of being susceptive to altered drivers. As any modern computer game, Counter-Strike makes heavy use of Win32 infrastructure – Windows API, DirectXfor input, networking and sound, and the ability to use either Direct3D or OpenGL for the graphics. Theoretically, each one of these components could be manipulated to gain an unfair advantage. Although almost all drivers could be used, in practice, almost exclusively OpenGL and DirectX infrastructure, and more rarely, mouse drivers are manipulated.
Cheating-Death, unless disabled properly by specialized support hacks, generally detects replaced OpenGL drivers, VAC at one time banned users with a certain ASUS graphics card because the drivers replaced the normal DLL supplied with Windows during installation. Coincidentally, certain ASUS drivers at some point also allowed for wallhacks without requiring any additional drivers. Such False positives have seriously harmed the efforts of the ban-them-all proponents. VAC currently does not detect these cheats, which are the easiest to create.
Driver manipulations are especially nasty to detect, as basically every file on the computer could be part of a legitimate driver or a cheat. Therefore it is essentially impossible for both a Lan-Party admin or an anti-cheat tool to detect such a cheat, even when being freely available to search the suspected cheater’s computer.
Proxies
There are no known public cheats that utilize proxies, and thus are never detected. But some people suspect that proxy-like cheats exist, which could allow a cheater to remain safe from both visual detection on a lan-party, and known client- and server-side anti cheat mechanisms.
Proxies are exclusively aimbots and are giving themselves away by not having the crosshair correlate to the position of the actual impact. With small FOVs however, these cheats can be both extremely stealthy and effective even in lan play, as hits can easily be attributed to Counter-Strike’s relatively inaccurate weapons, so called lucking.
.jpg)
