Modifying player position

**flo8464** · 07-14-2009

Hi !

There are some so-called XYZ hacks out there.

AS far as I informed myself they are just add/subtract 0.13 to the players x/y/z position where 0.13 is the highest number which can be added/subtracted without getting problems with the server.

So far, so good.

Are there any routines implemented in WoW to detect that cheat?
Or is it just dangerous if player see someone hacking and report it?

If not...the server wouldn't care if a player is inside a mountain or outside instance walls ?

Thanks.

**BoogieManTM** · 07-14-2009

If you're moving faster your speed determines, the server can detect you without anything on the client side (no need for warden, or any other detection mechanism). This includes teleport hacks, and speed hacks.

If you're no-clipping, the server can again detect you at any time. Blizzard knows it's world boundries. It knows where the player can (should) be, and where it can't (shouldn't) be.

Doesn't need to be client side detection for any of this. it can all be done on the server side, which we all have no idea what is going on behind the curtains.

**lanman92** · 07-14-2009

Boogieman, could you propose a method that they would use to detect speedhacking? I know in private servers, they check the difference in actual serverside tickcount between the packets(seems unreliable due to lag).

**BoogieManTM** · 07-14-2009

Originally Posted by lanman92

Boogieman, could you propose a method that they would use to detect speedhacking? I know in private servers, they check the difference in actual serverside tickcount between the packets(seems unreliable due to lag).

Most common speedhack seems to be sending movement packets at a higher rate than they're supposed to be sent. each movement heartbeat is supposed to be 500ms apart from the last one, EXACTLY, not 1-2 ms off. You can compare the last heartbeat (server time), with a new incoming one, and they must be >= 500 (including lag factor). If they're less, they're obviously cheating.

so you're basically ignoring the timestamp in the packets, and verifying it in your server's real time that you know is accurate, and not effected by lag. Server also knows quite a bit about your lag, too. It's syncing up all the time with pings and other packets to verify your timestamp to compensate for lag. Emulators don't do this very well, so their anti cheat's don't work 100% (they also don't factor in alot of speed modifiers, which trigger false-positives). The above method should work just fine for them, too, though.

**lanman92** · 07-14-2009

Well. WoWInfinity only increases the rate of outgoing packets, not changing the timestamp. Is this why they're undetected? I'm still stumped at why the server isn't accepting my movements... Pfft.

**BoogieManTM** · 07-14-2009

Originally Posted by lanman92

Well. WoWInfinity only increases the rate of outgoing packets, not changing the timestamp. Is this why they're undetected? I'm still stumped at why the server isn't accepting my movements... Pfft.

WoWInfinity is most definitely vulnerable to the detection I mentioned then. As that's exactly what I'm talking about.

If your packets claim they're 500ms apart, yet in reality they came over the wire 50ms aparts, something is up.. You'd still have to keep an eye on the packet timestamps (and the client timestamp syncup), just to make sure it was just a lag spike and a bunch of packets flowed in at once, but it's still a pretty easy detection (at least to flag the account) mechanism to implement

**lanman92** · 07-14-2009

Ah. I wasn't sure if you meant packet timestamp or actual timestamp. Is there any detection like this in place? I know warden is somehow sensing it, but I'm not too worried about that. Will be pretty bad luck if it scans right as I teleport.

EDIT: Scratch that. Gonna be a nono to do russian roulette with my account...

**ramey** · 07-14-2009

Originally Posted by lanman92

Ah. I wasn't sure if you meant packet timestamp or actual timestamp. Is there any detection like this in place? I know warden is somehow sensing it, but I'm not too worried about that. Will be pretty bad luck if it scans right as I teleport.

EDIT: Scratch that. Gonna be a nono to do russian roulette with my account...

Warden's scanning function is called constantly.

**BoogieManTM** · 07-14-2009

Originally Posted by ramey

Warden's scanning function is called constantly.

every 15 seconds, actually. plenty of time to slip in between scans.

**ramey** · 07-14-2009

Originally Posted by BoogieManTM

every 15 seconds, actually. plenty of time to slip in between scans.

I did say Warden's scanning function.

**lanman92** · 07-14-2009

I'm guessing that the modules can have delayed loads/execution though?

**v3ntrix** · 07-20-2009

If speedhacking is so detectable, how come so many people are successfully doing it? Wowfinity claims it cant be detected by Warden.

**Nesox** · 07-20-2009

Because they do it in à fashion as discussed here.
But that doesnt mean its less detectable of blizzards they could just start measuring how fast clients send movement packages but im not sure if they could do it accurqtly enough to catch speedhackers. Suppose they do implement some new features to catch speedhackers imagine ppl getting banned for lagging.

**lanman92** · 07-20-2009

There could be a massive threshold, but again, people would get banned for lag. The most they could probably do for that is disconnect and monitor you. For ex, that person is lagging so bad(router is locked up?), and they reconnect, the flood of packets will come flying and their time would be off compared to yours.