Team Fortress 2

Team Fortress 2

Not enough ratings
how to detect (and kick) a cheater
By Kingkrool94
Cheating is not a new thing; humans have been cheating for as long as there have been games to cheat in. This has carried over to video games as well, including TF2. This guide is intended to educate users on how to spot and kick cheaters out of games to keep things fair for everyone.
   
Award
Favorite
Favorited
Unfavorite
What are Cheats?
Cheats/Cheating, in the context of video games, refers to the use of third-party programs or material changes in order to gain an unfair advantage in gameplay.
Most Source/TF2 cheats take the form of:

  • Engine hooks, which "hook" parts of the Source Engine and use them for their cheat.

  • Material cheats (also known as chams, short for chameleon skins), which use custom materials to lower the opacity of walls or make players easier to see.
    These cheats are referred to as "internal cheats".

"External cheats" do not "hook" but instead read/write game memory externally. These are fairly uncommon in Team Fortress 2.

DISCLAIMER: While I will be talking about cheats and cheaters, I do not encourage nor endorse the use of cheats; this is purely intended to educate and inform.

Types of cheats (and how to spot them)
To kick a cheater, you need to first identify the cheater. This will be a comprehensive list of various working cheats and how to recognize them.

This will be a moderately long list of various cheats and how to spot them
Aimbot
One of the most common cheats, Aimbot, automatically aims at an enemy for the player. This can be customized to ignore Spy's cloak, disguise, or Medic's Vaccinator and have "legit" features (features which attempt to hide cheating behavior) such as smoothing.

  • Aimbot: Locks the crosshair onto the enemy and automatically shoots.
    This is most commonly used with weapons like Sniper Rifles, Miniguns, Shotguns, and anything that shoots bullets.

  • Projectile aimbot: Projectile aimbots lock onto the predicted location of the enemy, rather than the enemy itself, and fire.
    This is used for any weapon that fires projectiles, like Rocket Launchers, The Huntsman, Grenade launchers, and the Flare Guns.

  • Silent aimbot: Shoots at the enemy without facing the enemy; however, the flicking or locking on is visible in Spectator.
  • pSilent aimbot: Identical to silent aimbot, but does not show flicking or locking on in Spectator or demos. Patched for hitscan weapons.
  • Smooth aimbot: Identical to aimbot, but applies smoothing when locking onto enemies to prevent sudden flicks.
  • Aim assist: Helps move your crosshair to the enemy, but does not automatically fire or swing.
  • Projectile aim assist: In addition to helping your crosshair move to the predicted position, it also draws a dot on the predicted position.
  • Auto backstab: Automatically backstabs a target once it is possible to backstab. The view model also silently changes angle depending on the enemy's location.
  • Melee swing prediction: Predicts where the target will be after the swing delay.

The number one thing to look for with hitscan aimbot is odd/sudden twitching. Both in 3rd and first person. While classes like Heavy and Scout (and pretty much any class with a shotgun or shotgun-like weapon) do twitch a lot, aimbot is way more quirked up and will snap from target to target. It's noticeable.

Projectile Aimbot is slightly different; rather than sudden twitching, you have to pay attention to the projectiles the suspect is throwing. Regular projectiles should always shoot forward and line up with the crosshair. If they're cheating, the projectiles will veer off the crosshair and into a target. (pictured)
Triggerbot
Triggerbot is very similar to an aimbot, but rather than automatically snapping to targets, it triggers whenever the crosshair is manually placed on a target.
It can be used for a variety of things, including:
  • Airblast projectile triggerbot: Automatically airblasts projectiles towards targets. Silent variants also exist, which do not face the enemy when airblasting. Beware that, although rare, it is possible for a normal player to airblast a projectile that is behind them due to the large and buggy airblast hitbox size.
  • Extinguish triggerbot: Automatically airblasts teammates that are on fire when in range.
  • Detonate triggerbot: Automatically detonates Detonator flares and stickybombs when in range of an enemy.
  • ÜberCharge triggerbot: Automatically activates ÜberCharge under certain conditions, works with different Medi Guns. The stock variant triggers upon taking enough damage, the Vaccinator variant automatically changes resistance based on the type of damage that is being taken, and the Kritzkrieg variant triggers under certain conditions.
  • Sapper triggerbot: Automatically places Sappers on builds when in range.

Now spotting this one is slippery; it's far more organic than a traditional aimbot. A key identifier is a wobbly and odd aim, it's hard to describe, so I found an old video that shows what it would look like on your end
https://www.youtube.com/watch?embeds_referring_euri=https%3A%2F%2Fwww.google.com%2Fsearch%3Fq%3Dtriggerbot%2Btf2%26rlz%3D1CAEVJI_enUS977%26oq%3Dtriggerbot%2Btf2%26gs_lcrp%3DEgZjaHJvbWUqBwgAEAAYgAQyBwgAEAAYgAQ&source_ve_path=Mjg2NjQsMTY0NTAz&v=jDsMjpFNvI0&feature=youtu.be
Crit Bucket Manipulation / Crit Hack
Ever since a patch from February 2, 2009, critical hits (or just crits) require you to fill a certain threshold of damage before being able to get crits. This "bucket" can be manipulated, and crits can be "stored" and used at will, letting cheaters drastically increase the chance

In this case, you need to play the long game; just because he fired 2-3 crockets in a row does not mean he cheated. Pay attention to the kill feed throughout the game and try to engage them in melee combat to see if they crit you (though it's not guaranteed they will).
Anti-aim
Anti-aim is to constantly change the direction you are looking to prevent being headshot. This is sometimes done by modifying the view angles of the player by editing the values in pitch or yaw into an out-of-bound value, so the player can appear facing one direction, when in reality the real hitbox is facing the other direction. This is often referred to as a "fake angle".

Anti-aim is also used to create a "spinbot", which is when a cheater rapidly spins around (usually while facing the sky or facing the ground), while their client view remains as normal. A limitation of anti-aim is that the visual hitbox cannot be facing away from the direction of fire, i.e., when the cheater fires forward, the model snaps forward.

Anti-backstab is also achieved with anti-aim. It detects if a Spy is near your back hitbox and snaps the real model backwards, making the Spy miss his stab.
However, backtrack cheats can backtrack the cheater and still result in a backstab.

These are pretty obvious; you've likely seen this from bots during the bot crisis from 2016 to 2024. It very well could be a guy faking and pretending to be a bot by shaking the mouse around (I've done that before lol), but it should be pretty obvious when facing real anti-aim.
ESP
ESP (aka Extra Sensory Perception) is considered anything that gives extra information visually.

Examples include:

  • Showing player positions, health, ÜberCharge percentage, class, and weapon.
  • Chams (changes the colors of the model, making them easier to spot & visible through walls).
  • Making the players glow constantly, similar to how your teammates glow after you respawn.
  • Showing extra information about the player, such as the currently equipped weapons, or if the player is ÜberCharged, zoomed in, or invisible.

Shown is an example of what ESP looks like on the cheater's end

A big giveaway is pre-firing, or if the suspect always seems to know where you are. It could be a lucky prediction, but if it's happening over and over, it could be ESP. Staring or seeming to look through the walls is also another sign.
Smaller misc cheats to look out for
Auto Bhopping
A cheat that automatically jumps when you land, which prevents the game from slowing your velocity down.

Partially fixed in a 2007 Patch by lowering the maximum air velocity while in a 'jump' state; however, bhopping still gives a slight speed boost when combined with air strafing.

Custom Item Schema
Cheaters can load a temporary custom item schema that normally defies the rules of the item schema provided by the game.

Things a custom item schema can do:
  • Remove any equip_region restriction, which can be seen by everybody.
  • Add attributes to any item in the game, which only show up for them and disappear once the schema is unloaded.
  • Add any item into their backpack, which only shows up for them and disappears once the schema is unloaded.
  • Increase the number of backpack slots they have, which can trick websites that use Steam's API to get false backpack data.
  • This does not allow for any economy-breaking exploits, as Valve has implemented additional measures to prevent such occurrences.

Fake Latency & Fake Lag
Fake latency refers to artificially increasing or decreasing the ping to the server. Decreasing ping does not affect gameplay, and the real ping can be found by typing ping in the console. Increasing ping will also increase the amount of lag compensation done by the Source Engine, allowing cheaters to shoot people behind walls much more easily.

Fakelag abuses packets so the server doesn't update your position for a maximum of ~23 ticks. To others, it looks like they are "lagging", but their ping will be relatively low, and from their view, the game looks fine. Due to the nature of fakelag, it is mostly used to counter cheaters to make their aimbot miss.

Double tap
Exclusive to the Scout, Double Tap lets the Force of Nature and the Soda Popper fire both shells almost instantly, allowing for insane DPS. It's fairly noticeable if you pay attention.

Suspicion
This is something I hope I don't understate, but cheaters play every class in the game, not just Sniper. Some cheaters use Engineer, some use Medic, some play as Spy. Be aware of what your team is doing and look out for suspicious behaviour like:
  • absurdly high score
  • absurdly high crit rate
  • toxic behavior, names, and weapon names
  • callouts from teammates and enemies alike
Look out for cheater lingo in your games, like hvh (Hacker vs Hacker) and names like Rijin, Nullcore, Lmao box, and Nitro (various popular cheating software)

Now, let's say you're in a game, and you see something really suspicious, like an insane shot or a reflection. What should you do? DO NOT immediately call them out for it; it very well could be a fluke. Now you need to make a decision; there are several ways to approach this.

The very first thing is that there's this hidden third team that Valve hid away for years. Since launch, all the way to 2016, the Spectate team let you spectate both teams freely. Since Meet Your Match, it has been disabled. It's still on community servers, so use it when you feel like you need to.
In casual servers, you can still achieve a similar "diet" spectator by doing the following:
  1. Be in Casual (duh) and simply killbind by opening the console (the ~ key by default) and typing kill or explode into it
  2. Open the Console and type "menuopen"; it should reset your respawn timer indefinitely
  3. spectate for as long as you want, and type "menuclose" to end it
Keep in mind that this ONLY works in your team, so you need to use different tactics if you're on the opposite team.

A very important thing to keep in mind is that most cheat clients know that you're spectating them, and often automatically nerf themselves when you do to avoid suspicion. With the menuopen bug, you need to watch them for a while, like 10 minutes at minimum. It drives them INSANE when they can't cheat for an extended period of time. They may reveal themselves accidentally when you do this.

Let's say hypothetically that you have a suspect, tested/spectated them, and are 100% sure that they cheated, what now? How can you convince the server to kick them? You need to gather evidence.
Gathering evidence
Now there are two types of evidence, strong and weak. Weaker evidence is not much on its own, but it can support stronger evidence.

Weak evidence includes:
  • Private Profile
  • a comment calling them out
  • rude/toxic/nsfw name or profile picture
  • 100% achievement progress on TF2
  • new/low-level account (could be an alt that Cheaters tend to have)
  • CS2 in their play history (weird, I know)

Strong evidence includes:
  • if their name in TF2 is different from their Steam name
  • many Hackusations in the comments
  • anything that references cheating in the profile (even if it's a small mention)
  • a VAC ban and/or a game ban (VAC ban should be a kick-on-sight)
Game bans can be explained away, but a VAC ban is indefensible. It doesn't matter if it was 6 days ago or 6 years ago.

Calling them out
Now the main thing is not to immediately yell out "hacker" or "nice hacks", unless they're super obvious; say something like "I've been noticing that (suspect) has a peculiar aim" or "(suspect) seems to be staring through walls." It's non-confrontational but still puts the suspect under enough scrutiny for others to notice. It all depends on how both you and the suspect talk to the teams. If you have solid evidence (like the section above), you should do just fine.

Something to also keep in mind is that cheaters frequently play in groups, by queuing together through Casual's matchmaking. This can lead to votekicks not coming through, and the Cheater's friends defending the cheater. In some cases, it's impossible it kick them due to a 6-stack always pressing F2. You're just kinda outta luck then, best to just leave.
how cheaters thrive in Casual Mode
This is more so observations based on what I've observed while I've researched this; it's not necessary to read, and is more like bonus content.

So, for reference, it's not like cheating is a new thing. The major difference is that it was easier to kick them as Valve gave us more options, and originally had their servers operate differently.

In the old pre-Meet-Your-Match days, when you joined a server, you first had to pick a team and then play; you could not join one team if it had fewer players than the other. This means that they were gradually filled over time and stayed full with the 45-minute map timer. The number one enemy of a cheater is a full server, as it prevents invasions and means the real players always hold the majority. You could also freely spectate whenever you pleased, as mentioned before.

Casual mode is very good at breaking up full games, servers reset after one game, and cause players to leave every 5-15 mins rather than every 45 mins (at minimum). Casual mode usually creates one-sided stomps, so the losing team is constantly losing players and creates a lot of player churn, which is ideal for cheaters. They can also server hop as much as they want with little issue because of this.

The matchmaker facilitates invasions as well, because of the player churn, the matchmaker looks for replacements, and needs to keep team sizes the same, so it makes multiple players join at once. Letting cheaters and other bad actors (mainly bots) pile in at once with zero coordination needed. You could have 2, 3, 4, or even 5 come in at once on both teams. Servers can be consistently overpowered. The party system enables this even further, so 6-stacks can just pop in and be un-kickable.

And yes, this is how bots took over the game. They created the perfect conditions for them to invade TF2.

idk how to end this, but I hoped this at least informed you. thx for reading.
1 Comments
Consumer of Estrogen 29 Aug @ 10:57pm 
I am the consumer of estrogen and this guide is awesome sauce