CSHP
Client Side Hack Protection


RELEASE 3 - Version 00.12.06

(c) 2000, Creative Carnage, LLC


What have you just installed?

CSHP3 is a mod that will monitor clients that connect to your server. It works as follows:  When a client connects to your server, CSHP3 scans the client looking for client-side mods that exploit known holes in UT.  If it detects a hole, CSHP3 takes action.  What action depends on how CSHP3 is setup.

Completing the Installation...

Before you can protect your server with CSHP3, you to have to manually edit your UnrealTournament.ini file.  Open up your "UnrealTournament.ini".  For those that don't know, this file is located in the \System directory of your main game path.  Scroll down until you see the section [Engine.GameEngine].   Now, add these 2 lines:

ServerPackages=CSHP3
ServerActors=CSHP3.CSHPServerActor

!! IMPORTANT !!  On some systems, the names you enter here are case sensitive.  Make sure you make the changes EXACTLY as they appear above.  Failure to do so might cause CSHP3 to not work properly.

You are ready to go.  All of CSHP3's options are set in the CSHP3.INT file. 


USING CSHP3 in Simple Mode?

CSHP3, offers two different operating modes.  The default installed mode is called "simple" mode.  This mod is effective on 95% of all servers out there.  It's designed to catch FunBot, the only hack that's actually in distribution via the web.  Anyone caught cheating is logged and kicked. There is no mess, no configuration, it's just "Simple"...

What are the benefits to running in Simple Mode?

Simple mode is the most forgiving way to use CSHP3.  Since FunBot is the only hack that's readily available, CSHP3 targets just the exploit it uses.  By doing this, CSHP3 remains tolerant of other "client-side" modes such as Old Skool, The Admin Console, Decal Stay or No Smoke.  

How good is the simple protection?

Remember, Simple mode's job is to target and eliminate FunBot, and it does it's job well.  Anyone attempting to use FunBot in anyway will be stopped.  They can rename funbot.u, they can even alter the class name and CSHP3 will still detect it for what it is.

But that's all it will detect.  

Who should run in Simple Mode?

Anyone running a public server is probably just fine with Simple mode.  Server ops who are looking to return to the exact same environment that existed before the leak of FunBot.. Simple mode is also for you.  Let's face it, Simple mode will stop 99.5% of the cheaters.

How do I setup CSHP3 to run in simple mode?

When you did this install, CSHP3 was automatically configured for simple mode.  When operating this way, only 3 variables are needed in the INT file.  For most servers, the defaults for these variables are more than adaquate.  They are:

bSimple=True

The bSimple variable tells CSHP3 to run in simple mode.  Confusing huh! 

bTrackFOV=True|False

This variable tells CSHP3 to watch for people using the FOV zoom cheat.  See the section on FOV cheating below for more information.

Advertise=0|1|2

When set to 1 or 2, this will cause CSHP3 to append the tag [CSHP] to your server name.  This allows players to easily tell where a fair game can be found.  If you don't want the tag, just set bAdvertise to false.  Setting Advertise to 1 will cause [CSHP] to appear in the beginning of the server name and setting it to 2 will cause it to appear on the end.

That's it.  I told you this is simple!

Advanced Mode!

So, your super paranoid about hacks huh!  CSHP3 still has all the power it used to, I've just hidden it under an advance mode.  In this mode, CSHP3 will actively search out all modifications to UT and report them to the server.  While I think this mode is as good as Uscript security can get, it still has the same drawbacks.  Namely false positives.  But even in this catagory, I've taken steps to make life better.

What are the benefits to running in Advanced Mode?

This is as good as it can get.  Any package out of the ordinary in any part of UT is recorded and returned to the server.  Hacked consoles, any rogue actors, even altered huds are detectable.  CSHP3's advanced mode is aggressive and will insure your server is as close to pure as possible in uscript.

Who should run in Advanced Mode?

THE ONLY TIME ADVANCED MODE SHOULD BE USED IS DURING CLAN MATCHES, TOURNAMENTS, OR IF SOMEONE IS TRULY SUSPECTED OF CHEATING ON YOUR SERVER.  AS I HAVE SAID, FUNBOT IS THE ONLY BOT IN DISTRIBUTION SO SIMPLE MODE SHOULD BE FINE FOR 95% OF THE SERVER.

I hate to have to shout here, but the # of people who just disregarded the last bit of advice was staggering.  If you do not fall in to this category, don't run in advance mode.  Any type of hack tends to appear in the clan matches first.  I also have many people watching the net looking for new hacks.  

Using Advanced Mode?

Ok, let's look at all the changes you need to make to your CSHP3.INT file to use Advanced mode.  Most are exactly the same as previous versions.

bSimple=False

Setting bSimple to false tells CSHP3 to run in Advanced mode! 

bTrackFOV=True|False

This variable tells CSHP3 to watch for people using the FOV zoom cheat.  See the section on FOV cheating below for more information.

Advertise=0|1|2

When set to 1 or 2, this will cause CSHP3 to append the tag [CSHP] to your server name.  This allows players to easily tell where a fair game can be found.  If you don't want the tag, just set bAdvertise to false.  Setting Advertise to 1 will cause [CSHP] to appear in the beginning of the server name and setting it to 2 will cause it to appear on the end.

SecurityLevel=0-2

God no other feature has caused me more problems.  I hate to be right, but I said I'd probably have to kick myself and I did.  I've removed level 3 by popular request.  This does not mean you can't determine who is cheating online.  See the section on console commands below.  Here is what the SecurityLevels do..

Level 0    - Log the user to the "Server.log" file (or UnrealTournament.log on a listen server).  No other action will occure.

Level 1    - Same as 0, but this time kick the user from the game

Level 2    - Same as 1 but the user will also be banned.

I DO NOT SUGGEST USING LEVEL 2 UNLESS YOU FIND A RASH OF IDIOTS CONSTANTLY GETTING KICKED.  A KICK SHOULD BE ENOUGH.

CSHP3 will now display a message to the user when they are flagged.  This message is sent to the console, and the console is displayed.  

SecurityFrequency=0 to XXX seconds

This variable tells CSHP3 how often to police the client.  The good news is CSHP3 no longer has to replicate data across the network when this happens (not like it sent a large amount of data).  The bad news is now much more is checked.  My suggestion is to leave this at the default 30 seconds.  

bOnlyAdminKick=True|False

This variable allows you to limit the use of the "Mutate CheatKick" command to just people with Admin Access.

bKickOnTimeOut=True|False

The previous versions of CSHP3 would sometimes timeout users.  To this day we have not been able to figure out why.  It might be because there is too much packet loss or it might be a bug.  We simply do not know.  bKickOnTimeOut allows the server op to decide what to do.  If you set it to false, CSHP3 will allow people to stay online if they should have timed out.

I still suggest leaving this to true.  Since (A) advanced mode should only be used in somewhat controlled situtations a timeout every now and then isn't a huge deal and (B) I've added some output code when this happens to help try and track it down.  If you are a client and get Timed Out.. please email me your log.  If your the server, do the same.

bCleanUpRogues=True|False

This option deals with the "Rogue Actors" which I'll cover in a bit.  When set to true, CSHP3 will first attempt to clean up rogue actors.  Only when the Rogue actor keeps reappearing will CSHP3 consider it a cheat.  If set to false, CSHP3 will act as it used to and log any rogue actors as hacks.

So why allow the option.  It's conceivable that deleting a rogue actor could cause a system crash.  It shouldn't but since I don't have control over what's happening, it could.  I have tested CSHP3 with several client side mods (both legit and hacks) and the cleanup did nothing but disable the mod.  But I wanted to be on the safe side.

AllowablePacks[x]=<package_name_without_the_dot_u>

The AllowablePacks array stores the name of any client-side packages the server will tolerate.  Simple add the package name to an empty slot.  Make sure you do not include the .U when you add it.  For example, if you wanted to allow NoSmoke, you would add the line..

AllowablePacks[0] = NoSmoke

There are downsides to allowing packages.  Any package you allow can be used to sneak a hack in.  But it's your call.  Also, keep in mind that CSHP3 will auto-detect any packages that are running on server and auto-add them to the AllowablePacks array.  You have 35 slots.  Use them wisely.

What's are "Rogue Actors"?

The advanced mode protection has been redesigned to be more flexible.  There are 3 major types of exploits in UT.  Two of the exploits are very straight forward, but the third is not.  I call this third type rogue actors.  What happens is a hack (or mod) will create an item on the client that is used to provide script time to the cheat (or mod).  

In Advanced mode, CSHP3 will not flag rogue items right away.  By default, CSHP3 will first attempt to remove the rogue item.  In 99% of the cases, this will disable the cheat (or mod).  My goal here is to stop the insane amount of false positives.  However, it still has the annoying side effect of shutting down harmless mods.  Another source of false positives is the method in which Epic handled user skins/models.  This hopefully has been fixed. 

However, should rogue item reappear in the world, CSHP3 assumes this is a cheat.  This is unavoidable.

The Authentication Key

Whenever CSHP3 logs a cheat, it will generate a Authentication key.  This is done to stop server-ops from faking their logs.

FOV Cheats!

It's possible to use certain console commands to adjust your FOV irregardless to the rules set on the server.  CSHP3 allows you to stop this cheat.  While some people in the InstaGib community are not happy with my method, here is how it works.

If bTrackFOV is true and the server's bAllowFOV setting is false, CSHP3 will record the FOV setting a player has when they enter the game.  This setting is automatically verified by UT to be in the 80-130 range.  Any attempt by a user to change their FOV (if they don't have the sniper rifle) will result in CSHP3 forcing it back to the original setting.

But since the InstaGib community asked for it, you can now toggle this off so CSHP3 works better with EZTeams.

CONSOLE COMMANDS!

CSHP3 has 3 mutate commands available.  Right now they are available at any time.  I do plan on allowing the server op to limit the kicks to just admins but time is short right now.  The commands are:

MUTATE CHEATINFO

This command will display the current CSHP3 settings to the user.  

MUTATE CHEATSHOW

This command will display any players who are using a hacked client.  It's only really valid in SecurityLevel 0.

MUTATE CHEATKICK 

When used, all cheaters will get the boot.

How can I tell if CSHP is autodetecting my packages?

Look to your logs baby.. look to your logs.  When CSHP3 starts up, it will create something like the following message:

ScriptLog: ###############################
ScriptLog: # Client Side Hack Protection #
ScriptLog: # version 00.12.06 #
ScriptLog: ###############################
ScriptLog: Defulat Security Level is...... 0
ScriptLog: Security Frequency is.......... 30.000000
ScriptLog: Clean up Rogue Objects......... True
ScriptLog: Tracking FOV................... False
ScriptLog: .INT Allowable Packs ..

This message shows you what the current settings of CSHP3 are, and it also shows you what packages are forced using the AllowablePacks settings in the INT file.  This is helpful, but you need to search for the follow line:

ScriptLog: [CSHP] Final Allowable Packages: CSHP3?

This line "[CSHP] Final Allowable Packages:" will list all of the packages that were autodetected by the server, with the exception of the 19 default epic packages.  These default packages never changes and are removed to save on bandwidth during replication.  If you do not see your package on this list, then you need to add it to the AllowablePacks[x] section of the CSHP3.INT file! 

Are you completely confused yet? :)

CSHP3 Log Messages

At various times, CSHP3 will log information to the server's log file.  This is usually information about a suspicious client.  Most people do not know how to interperate this info so I figured I'd cover it here.

Illegal Console [XXXX.YYYY] is not allowed.
This message occurs when you are running in Simple mode.  If someone attempts to log on with a FunBot, you will get this message.  The XXXX.YYYY is the package.class of the bot.  Usually it will be FunBot.FunBot, but a clever idiot might try and use a hexeditor to change that.

Suspicious Console [XXXX.YYYY]
This message also occurs only in simple mode.  When someone logs on to your server with a non-pure console, this message get's logged.  Most of the time, it's someone using ACC1.AdminConsole.  This is a harmless but usefull mod.  This message is there to help us detect new console hacks without limiteding the servers.  If someone seems to be cheating (ie: you see them using an aimbot) and they are running a non-standard console, chances are, they are!

Illegal Console [XXXX.YYYYY]
This message will occure in advanced mode.  It means the user's console is not allowed.  Either it's not the UT default console, or it's not part of an allowed package (see allowablepacks).

Illegal SpeechWindow [XXXX.YYYY]
If you see this message, CSHP3 has detect an alternate speechwindow.  Like the Suspicious console above, if someone seems to be cheating and they have an alternate speechwindow, they probably are.

Illegal Hud [XXXX.YYYY]
If the player has altered their hud, this message will appear.

Illegal Level Actor [XXXX.YYYY]
Illegal EnteryLevel Actor [XXXX.YYYY]
Every time CSHP3 polices the client, it checks all actors in the game to make sure they belong there.  On first glance, if it finds a rogue actor, it will just remove it.  However if the actor returns, CSHP3 will send this message to the server.  

Remember, even with the latest versions of CSHP3, it may still be possible to get a false positive.  I prefer to consider all players innocent.  These log messages are there simply to allow you to check on a suspicious player.  Please use your best judgement.

If CliffyC is on your server and just happens to have an Illegal Console named ACC1.AdminConsle he probably isn't cheating.  However if the same CliffyC is sitting on top of Face racking up godlikes with the pistol.. you might want to ban him.  

 

Making CSHP show up as a mutator in the Server List

The latest version of UT has a bug where mutators are not displayed.  However, if your server is an older version that does show the mutators, you can force CSHP3 to show up on that list.  By default, CSHP3 now installs and uses a server actor to activate.  This makes setup for the server op really easy, but keeps it from showing in the list.

You can cause CSHP3 to show up in your list of mutators (or so you use the mutator= command line switch or the menus in game) by adding the following lines to the begining your CSHP3.INT file.

[Public]
Object=(Name=CSHP3.HackProtection,Class=Class,MetaClass=Engine.Mutator,Description="Client Side Hack Protection")

Using CSHP on multiple servers

Many server ops running multiple UT servers using the same files in the same directory.  It's been pointed out to me that this can cause a problem using a .INT file for CSHP3's settings.  Unfortunately there doesn't seem to be a way around this.  The # of servers that benefit from the easy to install and configure CSHP3 that uses the .INT file far out number the others.  But I'll keep looking for a solution.

Reporting Bugs | Suggestions

I'm no longer answering CSHP3 questions at my normal email address and I'm also only answer questions/bugs from server ops and admins.  The Official CSHP homepage is now up.  Go to

http://www.creativecarnage.com/CSHP