Detector
The AntiCheat system is built on four pillars: Protection, Monitoring, Detection, and Punishment.
- Protection: To protect against cheaters and hackers, encrypt or obfuscate your data so that it is protected against attacks. Countermeasures are taken to protect the integrity of the data and trap attackers, for example through honeypots.
- Monitoring: Observe and track the state of the game or device and the behavior of players to detect potential cheating or unusual behavior.
- Detection: Monitoring itself does not report cheating activity; it only tracks the state of the game or device and observes deviations. These deviations are recorded by a detector. The detector itself checks the monitored deviations and informs the 'AntiCheat-Monitor' about possible cases of tampering or cheating.
- Punishment: React to detected cheating attempts with punishers when a calculated threat level is reached, and impose various penalties.
Detection
AntiCheat uses so-called 'Detectors' to subscribe to 'Monitors'. A detector collects the received data and checks it for possible cheating attempts, such as manipulated memory or changes to the game or device time, and more. A detector is a MonoBehaviour attached to the 'AntiCheat-Monitor'. It subscribes to the also attached monitors and decides whether any possible cheating has occurred.
A detector is also an observable. Once possible cheating or tampering is detected, all observers get notified. First and foremost, this will be the 'AntiCheat-Monitor' itself, which subscribes to all attached detectors.
Example: The 'AntiCheat-Monitor' lists all attached detectors.
Built-In
There are several built-in detectors that can be used universally across all devices, as well as device-specific detectors.
Universal Detectors
The following detectors are built-in in the AntiCheat package and can be used across all devices:
| Detector - Universal | Free | Pro |
|---|---|---|
| PrimitiveCheatingDetector | + | + |
| GameTimeCheatingDetector | + | |
| DeviceTimeCheatingDetector | + |
A brief overview of the universal detectors:
PrimitiveCheatingDetector: This detector is used to detect unexpected value modifications of protected types, commonly done through memory manipulation / cheating.
GameTimeCheatingDetector: This detector is used to detect game time (UnityEngine.Time) cheating. It observes the game time monitor and subscribes to time deviations; based on these it calculates the possibility of cheating and notifies observers of the detected cheating. Additionally, it starts countermeasures by calculating the game time based on system ticks if cheating is detected. So even if cheating occurs, the game time will be calculated correctly and provided in the ProtectedTime class.
DeviceTimeCheatingDetector: This detector is used to detect device or system time manipulation. It observes the device time monitor and subscribes to time deviations; based on these it calculates the possibility of cheating and notifies observers of the detected cheating. It also provides a trustworthy DateTime.UtcNow, calculated either from the internet time or the device time, provided in the ProtectedTime class.
Mobile Detectors
The following detectors are built-in in the AntiCheat package and are designed for mobile (Android and iOS) devices:
| Detector - Mobile | Free | Pro |
|---|---|---|
| MobileGenuineDetector | + | + |
A brief overview of the mobile detectors:
- MobileGenuineDetector: This detector is used to detect whether the built mobile app or package is genuine, i.e. whether it has not been modified or tampered with.
Android Detectors
The following detectors are built-in in the AntiCheat package and are designed for Android devices:
| Detector - Android | Free | Pro |
|---|---|---|
| AndroidPackageTamperingDetector | + | |
| AndroidDeviceCheatingDetector | + |
A brief overview of the Android detectors:
AndroidPackageTamperingDetector: An aggregated detector that is used to detect whether the Android package (APK/AAB) has been tampered with. It subscribes to the following monitors: 'AndroidPackageSourceMonitor', 'AndroidPackageHashMonitor', 'AndroidPackageFingerprintMonitor', and 'AndroidPackageLibraryMonitor'.
AndroidDeviceCheatingDetector: This detector is used to detect whether the Android device has disallowed applications installed which can be used to cheat in the game.
Desktop Detectors
The following detectors are built-in in the AntiCheat package and are designed for desktop (Windows, macOS, Linux) standalone builds:
| Detector - Desktop | Free | Pro |
|---|---|---|
| ModLoaderDetector | + | |
| DebuggerDetector | + | |
| VirtualEnvironmentDetector | + |
A brief overview of the desktop detectors:
ModLoaderDetector: This detector is used to detect known mod loaders such as BepInEx, MelonLoader, UnityDoorstop, HarmonyLib, or MonoMod by scanning loaded managed assemblies, native modules, and the game folder.
DebuggerDetector: This detector is used to detect attached managed, user-mode, and (on Windows) kernel-mode debuggers such as Visual Studio, dnSpy, x64dbg, OllyDbg, or WinDbg.
VirtualEnvironmentDetector: This detector is used to detect whether the game runs inside a virtual machine such as VMware, VirtualBox, Hyper-V, QEMU, or Parallels by inspecting MAC OUIs, BIOS/DMI strings, and the hypervisor bit.