Android - Device Cheating - Detector (Pro)

A player can install a memory tool next to your game. You cannot stop the install. You can notice the app and react.

Walkthrough: Cheat apps on Android.

Detector

AndroidDeviceCheatingDetector listens to AndroidInstalledApplicationMonitor. It compares the found package names with a list you write. A match is reported.

Observed subject

It listens to IAndroidStatus from:

• AndroidInstalledApplicationMonitor: apps installed on the device.

Status

If a blocked app is installed, the detector sends an AndroidCheatingDetectionStatus:

public struct AndroidCheatingDetectionStatus : IAndroidCheatingDetectionStatus
{
    // Probability that the detection is a false positive, in the range [0.0, 1.0].
    public float PossibilityOfFalsePositive { get; }

    // The threat rating reported with this detection.
    public uint ThreatRating { get; }

    // The type of cheating detected on the Android device.
    public EAndroidCheatingType AndroidCheatingType { get; }

    // True if the source monitor failed to retrieve its data over the native interface.
    public bool MonitorFailedToRetrieveData { get; }
}

• MonitorFailedToRetrieveData: The monitor could not read its data. That can happen on an older device. No real check ran, so the false-alarm chance is higher.

AndroidCheatingType for this detector is:

public enum EAndroidCheatingType : byte
{
    UNKNOWN = 0,                // Type could not be classified.
    DEVICE_INSTALLED_APPS = 10  // The device has blacklisted apps installed.
}

Threat rating and false positives

• PossibilityOfFalsePositive: 0.01 on a real find. It rises to 0.75 when the monitor could not read its data.
• ThreatRating: default 500 (recommended 500).

Lifecycle and timing

• In Awake it subscribes to AndroidInstalledApplicationMonitor on the same object.
• Each report is checked against your block list. A match is reported.
• In the Editor and in development builds, the check runs only when Verify development builds (Android_Enable_Development) is on.

Configuration

• Is Active (isActive, bool, default true): Turns the detector on or off.
• Threat Rating (threatRating, uint, default 500): How much one find adds to the threat score.
• On Cheating Detection Event (OnCheatingDetectionEvent): Functions to call when a cheat is found.

The package names are set in Project Settings. See Blocked apps below.

Supported platforms

Android only.

Requirements

Android 4.4 (API level 19) or newer.

How to use

Add AndroidInstalledApplicationMonitor if it is not there yet, and add AndroidDeviceCheatingDetector as a child of the AntiCheat-Monitor. Enter the package names. Then choose how you want to react.

Add the monitor

Put AndroidInstalledApplicationMonitor on the same object. The detector subscribes to AndroidInstalledApplicationStatus.

Add the detector

Manual

Add AndroidDeviceCheatingDetector from GUPS.AntiCheat.Detector.Android, next to the monitor.

Add the AndroidDeviceCheatingDetector component.

Prefab

The prefab includes the detector and the monitor.

Add the Android Device Cheating Detector prefab to the AntiCheat-Monitor.

Settings

The AndroidDeviceCheatingDetector settings.

• General Settings: Turn the detector on or off.
• Threat Rating Settings: How serious one find is.
• Observable Settings: Functions to call when cheating is found.

Runtime

In Awake the detector subscribes to the installed-apps monitor. It compares those names with your list and reports a match.

Blocked apps

Open Edit > Project Settings > GuardingPearSoftware > AntiCheat. Go to Android - Device App - Settings. Turn on Blacklist device apps and enter package names.

Blocked device apps.

The shipped examples are:

1. com.cheating.app, a sample name.
2. catch_.me_.if_.you_.can_, the package name of GameGuardian.

If one of those apps is installed, the detector reports it.

Read the detection in code

You can also listen yourself. Cast the status to AndroidCheatingDetectionStatus to read the Android fields.

using System;
using GUPS.AntiCheat;
using GUPS.AntiCheat.Core.Detector;
using GUPS.AntiCheat.Detector.Android;
using UnityEngine;

public class AndroidDeviceDetectionLogger : MonoBehaviour, IObserver<IDetectorStatus>
{
    private void Start()
    {
        var detector = AntiCheatMonitor.Instance.GetDetector<AndroidDeviceCheatingDetector>();
        detector.Subscribe(this);
    }

    public void OnNext(IDetectorStatus status)
    {
        if (status is AndroidCheatingDetectionStatus androidStatus)
        {
            Debug.LogWarning($"Android device cheating detected: {androidStatus.AndroidCheatingType} " +
                             $"(threat={androidStatus.ThreatRating}, failedToRetrieve={androidStatus.MonitorFailedToRetrieveData}).");
        }
    }

    public void OnError(Exception error) { }
    public void OnCompleted() { }
}

React when a cheat is found

The detector tells the AntiCheat-Monitor. The monitor adds the report to the threat score.

Punisher. Add a punisher prefab as a child of the monitor. It runs when the score reaches its limit.

Built-in punisher prefabs.

Inspector. Add a function to On Cheating Detection Event. It runs when this detector finds a cheat.

Inspector callbacks on a detector.

Code.

var detector = AntiCheatMonitor.Instance
      .GetDetector<AndroidDeviceCheatingDetector>();

detector.Subscribe(myObserver);

PossibleCheatingDetected stays true after the first find.