Little Anti-Cheat

Little Anti-Cheat

Lilac is a free and open source anti-cheat written for SourceMod
to support all source games.

List of currently supported games:

  • Team Fortress 2
  • Counter-Strike:Global Offensive
  • Counter-Strike:Source
  • Left 4 Dead 2
  • Day of Defeat:Source
  • Half-Life 2:DeathMatch

And many more source games.
They are not all listed as not all of them have been tested yet.
But even if they aren’t in this official supported list - they may still work fine.

Feature list:

Little Anti-Cheat currently detects these features:

  • Angle-Cheats (DuckSpeed, Anti-Backstab (TF2) and Pitch AA)
  • Chat-Clear
  • Basic Invalid ConVars
  • NoLerp
  • BunnyHop (Bhop)
  • Aimbot
  • Aimlock
  • Anti-Duck-Delay / FastDuck (CS:GO Only)
  • Infinite Noisemaker Spam (TF2 Only. In BETA! Doesn’t ban, only logs!)

Misc Features:

  • Backtrack Patch
  • FakeLatency (High ping) Kicker
  • Interp Exploit Kicker
  • Angle-Cheat Patch (Prevents server console from getting spammed)

Installation and Setup:

  1. Head over to the download section and Download Little Anti-Cheat.
  2. Place all the files in ther respective folders.
  3. Type sm plugins load lilac.smx in your server console.

If you did everything right, the message:

[Little Anti-Cheat VERSION] Successfully loaded!

will pop up in the server console.

Configuration Files:

Upon successfully loading, two files will automatically have been generated:

  1. cfg/sourcemod/lilac_config.cfg
  2. addons/sourcemod/logs/lilac.log

The config file is where all the ConVars are loaded from.
You can change the values and disable features if you like, but Little Anti-Cheat has already been optimized with the best values, so you don’t have to change anything.
Optional features like:

  • High Ping Kicker
  • Backtrack Patch

Are disabled by default.

When Little Anti-Cheat starts up for the first time, it will append some messages explaining how to interpret the detection logs. However, it doesn’t ever go into great detail, so lets do that here.

Detection logs:

Angle-Cheats:

Lets first start off by explaining Angle-Cheat detections.
Angle-Cheats is when a cheater attempts to set their viewing angles to something above the normal game limits.

Pitch:
For most Source games, that means pitch is restricted to be between -89 and 89.
However, cheats can go beyond this restriction to create something called Fake angles.
The most common values used by cheats are as follows:

  • -271 or 271 (Fake Down/Up)
  • -91 or 91 (Plain AA)
  • -90 or 90 (Plain AA as well)
  • -3256 (“Fake” Center)

Lesser used Pitch values:

  • -411
  • -404
  • 310
  • 180
  • 150

Note: Just because someone is detected of using Angle-Cheat and don’t have any of these values - doesn’t mean they aren’t cheating.
These are just the most common values, there are many more that are often used.
If the Pitch value is above 89 or less than -89 - they are cheating.

Roll:
Anything larger than 50.0 or less than 50.0 means the player is cheating.
Roll can be manipulated to achieve something called DuckSpeed, which is when a player is ducking down, but moving at full running speed.
Usually, the Roll value will be 89.99. Which is a rounding error, it’s actually 90.00

Yaw:
Yaw is completely ignored by Little Anti-Cheat; as there are no out-of-bounds values for Yaw.
Usually yaw will be between -180 and 180, however, some games act weird and may go beyond those values, even when not cheating.
Hence why Little Anti-Cheat doesn’t check it.

That’s not to say you can’t do some manipulation of Yaw, but Little Anti-Cheat currently doesn’t detect the usage of Yaw Anti-Aim.

Chat-Clear:

Chat-Clear is what it sounds like, it removes the chat.
Cheats can do this by spamming new-line or carriage return characters to chat.
A lot of people call this “Spamming chat with spaces”.

You can’t normally insert these characters into chat messages, and only cheats can do this.
If someone gets banned for Chat-Clear - they are 100% cheating.

Note: Chat-Clear does not get checked in CS:GO.

Invalid ConVar:

Invalid ConVars is when a player has set their ConVars to an illegal value.
Such as sv_cheats 1 when the server has it set to sv_cheats 0.
Little Anti-Cheat only does basic ConVar checks.

NoLerp:

NoLerp is something cheats do to remove interpolation, this is almost always done in order to increase their aimbot accuracy.
It’s not normally possible to do this without the usage of cheats, but some server owners have reported that they’ve been able to do it.

Sadly, they have not elaborated further with any steps on how to reproduce this. So players banned for this are 99% likely cheaters.

BunnyHop (Bhop):

BunnyHopping (Or Bhopping) is when a player jump at the same tick they touch the ground.
This is done to gain slightly faster speeds.

Little Anti-Cheat has two main detection modes, controlled by lilac_bhop:

  1. Simplistic detection.
  2. Advanced detection.

1 means it will ban on their 10th perfect consecutive Bhop.
2 means it will ban on their 5th consecutive perfect bhop IF they aren’t spamming their jump button.
If the jump button is spammed, then it will resort to banning on the 10th consecutive perfect Bhop.

The likely hood of a false positive is tiny, ranging from about: 0.01% to 0.1% chance of getting falsely banned.

Aimbot:

There are several “types” of aimbots out there.
Little Anti-Cheat detects projectile aimbots as well as hitscan aimbots - but ignores melee aimbot.

Upon an Aimbot detection, Little Anti-Cheat will list what exactly it detected, which are as follows:

  • Aim-Snap
  • Aim-Snap2
  • Autoshoot
  • Angle-Repeat
  • Total-Delta

Aim-Snap and Aim-Snap2 basically detects unnatural aim movement where the cursor suddenly “teleports/snaps” to an enemy.
Autoshoot detects when cheats automatically shoot for the player (This type of detection can be disabled with the ConVar lilac_aimbot_autoshoot set to 0).
Angle-Repeat basically means silent-aim. Note Not all types of silent-aim are detected with this flag, this only covers one type.
Total-Delta is when the player were moving their aim around abnormally much leading to a kill.

Aimlock:

Aimlock is similar to Aimbot, but whereas the Aimbot detector will only run upon a kill - Aimlock runs all the time and will detect when a cheater aimlocks onto other players.
However, since testing for Aimlock can be an expensive process, it won’t always run all the time.

The when the ConVar lilac_aimlock_light is set to 1 (Which it is by default), Aimlock detections will only run when a player is acting suspicious or recently joined.

Aimlock is by far the most expensive detection feature, and can be disabled by setting the ConVar lilac_aimlock to 0.

Anti-Duck-Delay / FastDuck:

ADD (Anti-Duck-Delay, more commonly known as FastDuck) is a CS:GO cheat exploit that bypasses ducking delays. Normally when you spam duck, you start to slow down and get “tired”.

Cheats can bypass this restriction and spam Duck as quickly as they like.
This exploit cannot be done by legit players, as it requires that you send an input bit in your UserCMDs, which is inaccessible by legit players.

Infinite Noisemaker Spam:

Infinite Noisemaker Spam is a cheat in TF2 where cheaters can spam their noisemaker indefinitely, even if their noisemaker has limited usages.

This detection method is still in BETA, and will ONLY LOGS players it suspects of using it.
Banning for this has been disabled for now, if no one reports bugs with it, auto banning will get enabled in a later version.

Misc Feature Explanations:

Backtrack patch:

Backtracking is an exploit cheats can do which abuse lag compensation to hit players where they used to be up to 200ms. There is a trick called “fake latency” which is sometimes used which bumps this value up to 400ms.

Little Anti-Cheat’s Backtrack patch will monitor players for their “tickcount” value and check for unexpected and unnatural changes.
If one is detected, it will patch the backtracking preventing lag compensation abuse.

There are two patch methods in Lilac:

  1. Randomized.
  2. Lock.

Randomized isn’t recommended, as it can affect laggy players, and it may not always work.

Lock is the recommended patching method, as it locks the tickcount delta for a second. This patch method shouldn’t affect laggy players as much.

High ping kicker:

This misc feature is somewhat meant to help deal with fake latency abuse.
However, it’s not possible to know if someone just has a high ping or if they are using Fake Latency.

As the name suggests, it detects players with a higher ping than the server limit, and temporary bans them from the game.
Note: It doesn’t ban them permanently, it ONLY temporarily bans them for 2 minutes, so they can’t instantly rejoin the game.

This misc feature is disabled by default, as some server owners may not mind having laggy players on their servers.

Interp Exploit Kicker:

In Team Fortress 2, there is a well known exploit that is commonly used to make it easier facestabbing players.
It’s done by setting your interpolation to 500ms (cl_interp 0.5).

As the name suggests, this patch will simply kick the player out of the game if they attempt to abuse interpolation. Unlike the other misc features, this one is enabled by default, with a value of 105.

This means that players with a higher interp than 105ms, get kicked with a message telling them to lower their interp. The default interpolation value in Source games is 100ms, so players with normal/default settings aren’t affected.

It is not possible to set the threshold lower than 105, as that is the smallest value possible in Lilac.

Angle-Cheat Patch:

Whenever cheaters use angles above the normal game’s limits, the server console will get spammed with warnings. This patch simply prevents player angles from going beyond the game’s limits, thus, preventing the server console from getting spammed.

Even if you disable Angle-Cheat detections, this patch will still work, and prevent server console spam.
It will also break some cheat features like:

  • Legit Anti-Backstab (TF2).
  • Pitch AA.
  • Duckspeed.

Like the Interp patch, this one is also enabled by default.