How to catch a cheater with PenguinPlug BWAC mode

[superpenguin]

The bwac mode of penguinplug allow you to catch some maphackers. The first thing i would like to say is that it's not a perfect solution against cheating, it require to be very very carefull when you check and re-check the replay (read the paragraph about borderline case) and it doesnt works vs all hacks and you sometime need to check more than 20 to find a single proof.

So here is the big disclamer : DONT ENABLE BWAC MODE IF YOU DONT KNOW HOW TO USE IT PERFECTLY ! Read everything or read nothing (and more than once), but dont stop in the middle thinking you know it.

However this method to get some proof has some advantages :
- It's the only one you have :) if you dont use bwscanner you cant do anything more
- If you get one solid proof, then you have it, busted. You dont need 50 different proofs, but you need to have at least 1 that is perfect.

Here i will demonstrate how to proove that the player "SW)Lois", #3 on the TLT ladder is using a maphack.

The game i will use for this is this one : MgZ)Nookie vs LW)Lois (PvT)

Download here :
http://www.wgtour.com/match.php?action=dl&datab=broodwar&id=760928&url=upload/ladder/broodwar/1663PvT_SWLois2.rep

It's in the game list here (the last one of MgZ)Nookie) :
http://www.wgtour.com/info.php?datab=broodwar&id=71767&premium=1&bottom=25&type=


Let me announce the principles of this method : if someone act on an object he cant see directly at the the moment he do it, then it's a cheater.
- to act: to do a command on something, select, target, move on, cast
- on an object: an unit, a building, a mineral/gesyer
- "he cant see directly": something under either the full (black) fog of war or the partial (grey) fog of war
- at the moment he do it: if he has the vision of something, then he move away and after 1 minute or even 30 seconds, he lose the vision, it's still a valid suspcious action. However, if he lose vision on something, and then just 1 second latter clic on it, it's what i call a borderline case (because of lattency)

Edit: a lot of people pretended i was wrong about clics on previously visible things (grey fog of war). What i would like to say is : make your test game, clic attack something under the grey fog, move on it, use whatever you want even yamato or comsat... you will see, it's recorded differently in the replay, Penguinplug doesnt complain and bwchart display it as an action to a ground location and not to an object.

If it's not clear at this point, or if you dont beive me, i suggest before you come to shout "you are wrong", that you do your own testing. Run all the test you can imagine with bwchart or PenguinPlug bwac mode, you will be convinced that : "if someone act on an object he cant see directly at the the moment he do it, then it's a cheater"

But let's come back to the so unfamous "borderline cases". It's something you realy have to care when you want to get a proof of someone cheating. You cant just see a message "suspicious action" and imediately conclude that the guy is a cheater, you have to check with your eyes open... The people that say the method doesnt work are the one who doesnt understand it completely or the cheaters.

A borderline case is when someone select something that he could see just a second or 2 earlyer, but because of lattency, the command is only saved in the replay after this time. It's very common for a player to select a scouting probe in his base just a second before it run away, it's not a hacking proof. To avoid any borderline cases, you need also to check if the target was visible 5 second before.

So you have to watch the replay AT LEAST 2 time : the first time to know about when the suspicious action take place, the 2nd time you watch very slowly and you take some screenshot of the action with the supposed cheater vision 5 second before the action, and when the action is reported by PenguinPlug. note: if you watch it in x4 or more, it will not pause immediately, if you went too fast the first time, you will have to watch the replay at least 3 times, the next 2 times, you slow down before the suspicious action.

So you have proved that he is a cheater with PenguinPlug ? What is he going to say if you accuse him with a PenguinPlug proof ? i can read in his mind, the first words he will say will be "PenguinPlug sux, it's a bug"... i'm quite much sure there is no bug in this part of the code, but it's understandable that it's too much to accuse someone of cheating just based on 1 program.

It's not over : open bwchart, in the top checkbox options, remove "seconds", so the action list will be indicated in "game ticks", it's the unit that SC use internaly. keep all the players activated, and scrool down to the time indicated in game ticks, it's the first number indicated by PenguinPlug/bwac when it display a suspicious action, try to find the action in the full list (it will maybe not be indicated as "suspicious" by bwchart, but as long as the action exist, at the same time, by the same player and on the same object, it's still a proof that he did it, if by watching the replay you can notice he cant see the object, then your proof is valid with 2 different programs.


Here is what you need to do for the specific SW)Lois case :
- Download the replay (http://ste.gnux.info/ftp/scd/1663PvT_SWLois2.rep)
- Download PenguinPlug 0.3.95 if you dont have it already and read the readme/FAQ (http://ste.gnux.info/pp)
- Start the game
- Enable bwac mode in penguinplug by typing as a message "\bwac on" (note he backward slash)
- Set the vision to see only what Lois is seeing
- Set the speed to something not too fast (x1 or x2)
- Dont move the mouse too often if you know there will be a suspicious action, if you move it, it will not center the scree correctly on the target
- At around 7, you will see some suspicious action when lois drop 2 tanks, he aim some probes while they run away : it's a borderline case ! they are almost visible a second before he target the probes, this action doesnt count, it's not a proof
- At 10:31, it's geting more interesting : Lois target a nexus that he cant see, take a screenshot.
http://ste.gnux.info/ftp/scd/lois1.png

- Check the replay until the end to be sure it's not corrupted, or from an old starcraft version : if you see like 5 message every second, it probably means the replay is unusable
- To be sure, rewatch the replay, and pause 5 second before, check if he didnt had vision just before he did the action.
http://ste.gnux.info/ftp/scd/lois2.png

- Type "\bwchart" to open bwchart with this replay, remove "seconds" in the checkbox options so you see the time in game ticks, and go to 15025, the number displayed by PenguinPlug.
- The action is there, and on the same unit
http://ste.gnux.info/ftp/scd/lois-bwchart.png

- If the proof is not 100% perfect, dont use it
- If you didnt used this method before, it's better to ask someone experienced in this kind of analyse. You can try to ask someone in the starcraftdream hacker-police, but they are often very busy with those request, make sure you understood the method very well and that you are not doing any obvious beginner mistake.
- If you are 100% sure, inform those who need to be informed, post it in the right forum


I wrote this FAQ to help many people on SCD who realy want to use it (it's better to be informed than to missuse it) and it can probably be interesting too for the TLT players.

[PrEdAtOr]

You should make this sticky penguin,so it stays on top for people who need help

[sLeeT]

Good work penguin, helping all those nooblets out there. :)

[Funky]

Nice penguin. ;) It is very very good. :D Thank you for the help!<3.

[Sebboh]

Glad I quit SC before it got so damn complicated. :D Nice job on PP.

[Opi]

is there a reason you have ticks instead of seconds/min like in lasgo's version? :)

(just curious. i've always wondered why)

[superpenguin]

is there a reason you have ticks instead of seconds/min like in lasgo's version? :)

(just curious. i've always wondered why)
It's because it's the unit used internaly by starcraft, more exact :) the number will be exactly the same for all SC programs, if you convert it to time it can have precision lose, some program use "1 second = 23 ticks" some others use 23.something with a floating point value.

It's like the same question that : "why do they use dollars at wall street, cant they use euros or whatever other currency ?" :)

[Byakuya]

Great job penguin :)

[Funky]

We should all rebel and use pesos.

[Byakuya]

And a comment on a specific borderline case.

This can be tested yourself,but most of thetime when a susp comes up right after they lose vision of a unit or building(such as on a scout) it is because they had the unit or building selected when the vision finally left after the scout died. You can do this yourself many ways to test. This even happens when you click on a probe while obsing a game,right before it enters a geyser.

[sLeeT]

I do it in public games for fun just to see the "sleet has click on unit so and so". :)

[Sage]

quite the guilty pleasure ehh sleet?


anyways awesome job penguin, this was a good idea.

[Duke]

thanks, penguin. but now I need to know, what does losing vision to his own unit mean? I'm guessing it has something to do with stack hacking, but it happens when that isn't the case. =[

[Aggress]

wouldnt that be classified in like the probe entering geyser or something?

EDIT: what was the point of the bwchart thing?

[superpenguin]

thanks, penguin. but now I need to know, what does losing vision to his own unit mean? I'm guessing it has something to do with stack hacking, but it happens when that isn't the case. =[
For now those kind of message should just be ignored.

It mean that you loose the selection on your own unit, it's often legitimate like when your scv/probe enter a geyser, or if your selected unit get in statis field. But because of the behavior of some hacks it can sometime be used to detect cheaters, however it's not safe enough to accuse someone only based on those kind of proof IMHO (especialy because the code to know what exact unit he lost the selection to is not perfectly safe atm).

[Visions]

isn't it possible to create a way of saving reps, that when you look at it, you can chooce a modus where you see exactly where that player had his screen?? so you see the game like he did, and if he looks at black spots all the time without being able to see you would know for sure its a maphacker??

[eNtitY~]

isn't it possible to create a way of saving reps, that when you look at it, you can chooce a modus where you see exactly where that player had his screen?? so you see the game like he did, and if he looks at black spots all the time without being able to see you would know for sure its a maphacker??
No, But BWAC tell you when they click something.

[Visions]

hm ok, well ill let the hacking police stuff up to you guys, i don't know how to check it out, il just tell it when i suspect some1 ^

[Duke]

That was BWTV Observer mode, there is not one for the new patches, and I'm pretty sure it had to be live, not in a replay.