Android - Device Cheating - Detector (Pro)

Not only can a user modify or manipulate your game or app, but they can also try to gain an advantage by making changes to their device. For example, by installing cheat engine apps that try to manipulate the device's or game's memory and gain advantages.

Because these types of apps are typically installed on a user's device, their installation cannot be prevented. However, it is possible to identify which apps a user has installed and respond accordingly.

Detector

Use the 'AndroidDeviceCheatingDetector' to detect unwanted installed apps. It monitors the 'AndroidInstalledApplicationMonitor' and subscribes to the installed apps found. The detector enables you to perform a comparison with a list of unwanted apps and notifies the observers of the detection. This gives you the opportunity to react to those.

Observed Subject

The detector observes the 'IAndroidStatus' interface sent by:

Status

The detector receives the installed apps by their package name and compares them to your expected values. If unexpected or disallowed apps are detected, the detector notifies its observers with an AndroidCheatingDetectionStatus, which implements IAndroidCheatingDetectionStatus (and therefore IDetectorStatus):

public struct AndroidCheatingDetectionStatus : IAndroidCheatingDetectionStatus
{
    // Probability that the detection is a false positive, in the range [0.0, 1.0].
    public float PossibilityOfFalsePositive { get; }

    // The threat rating reported with this detection.
    public uint ThreatRating { get; }

    // The type of cheating detected on the Android device.
    public EAndroidCheatingType AndroidCheatingType { get; }

    // True if the source monitor failed to retrieve its data over the native interface.
    public bool MonitorFailedToRetrieveData { get; }
}
  • MonitorFailedToRetrieveData: True when the monitor could not retrieve its data (for example, because parts of the native implementation are unavailable on an older Android device). No real validation could be performed, so the false-positive likelihood is raised.

For this detector, AndroidCheatingType is:

public enum EAndroidCheatingType : byte
{
    UNKNOWN = 0,                // Type could not be classified.
    DEVICE_INSTALLED_APPS = 10  // The device has blacklisted apps installed.
}

Threat rating and false positives

  • PossibilityOfFalsePositive: 0.01 on a real detection, raised to 0.75 when the monitor failed to retrieve its data (the verdict is then based on missing information).
  • ThreatRating: default 500 (inspector field, recommended 500).

Lifecycle and timing

  • Subscribes in Awake to the AndroidInstalledApplicationMonitor on the same GameObject.
  • On each monitor notification it runs a validation coroutine against the configured blacklist and reports on a match.
  • In the Unity editor and Development Builds the check only runs when 'Verify development builds' (Android_Enable_Development) is enabled in the global settings.

Configuration

  • Is Active (isActive, bool, default true) - whether the detector is active and watching.
  • Threat Rating (threatRating, uint, default 500) - the threat rating reported on each detection.
  • On Cheating Detection Event (OnCheatingDetectionEvent) - a UnityEvent raised on every detection; wire up reactions in the inspector without writing an observer.

The blacklisted package names themselves are configured in the global AntiCheat project settings (see 'Define Unwanted Apps' below).

Supported Platforms

The detector is only available on Android platforms.

Requirements

Requires an Android build with at least Android 4.4 (API level 19) (December 2013).

How To Use

The usage is quite simple: attach an 'AndroidInstalledApplicationMonitor' (if not already done) and the 'AndroidDeviceCheatingDetector' to a child GameObject of the 'AntiCheat-Monitor', enter the unwanted apps in the 'AntiCheat-Project Settings', and define a reaction on detection of those.

Requirements

To detect unwanted installed apps, you need to add the 'AndroidInstalledApplicationMonitor' to the same GameObject you will attach the 'AndroidDeviceCheatingDetector' to. The detector will subscribe to the 'AndroidInstalledApplicationStatus', containing the installed app package names, sent by the monitor.

Add Detector Component

Manual

Add the 'AndroidDeviceCheatingDetector' MonoBehavior from the 'GUPS.AntiCheat.Detector.Android' namespace to your 'AntiCheat-Monitor' GameObject, or better, to a child GameObject, next to your 'AndroidInstalledApplicationMonitor' MonoBehavior.

Add the 'AndroidDeviceCheatingDetector' as a Component.

Prefab

There is also a prefab, including the detector and the monitors, which you can directly attach as a GameObject to the 'AntiCheat-Monitor'.

Add the 'Android Device Cheating Detector' prefab to the 'AntiCheat-Monitor'.

Settings

After attaching the 'AndroidDeviceCheatingDetector' MonoBehavior to a GameObject, you will see the following in the inspector:

The settings of the 'AndroidDeviceCheatingDetector' Component.

  • General Settings: Define here whether the detector should be active.

  • Threat Rating Settings: Define here the severity of the detected cheating.

  • Observable Settings: Add here callbacks invoked when cheating is detected.

Runtime

In the Awake callback, the detector observes the 'AndroidInstalledApplicationMonitor' and subscribes to the installed apps found. The detector enables you to perform a comparison with a list of unwanted apps and notifies the observers of the detection. This gives you the opportunity to react to those.

Define Unwanted Apps

To define the unwanted apps, you have to enter their package names in the global 'AntiCheat-Project Settings'. To do so, go to 'Project Settings -> GuardingPearSoftware -> AntiCheat'. Go to the section 'Android - Device App - Settings'. Activate the 'Blacklist device apps' checkbox and enter the package names of the apps you want to detect.

In the AntiCheat Project Settings, assign the package names of the unwanted (blacklisted) apps.

In the image shown, you can see two examples of package names:

  1. "com.cheating.app": A demo package name to show possible input values.
  2. "catch_.me_.if_.you_.can_": The package name of the general cheating app "GameGuardian".

So if a user runs your app, the detector will react to any installed app with the entered package names. In the image's case, this would be "com.cheating.app" and "catch_.me_.if_.you_.can_".

Consume the detection in code

Besides the inspector event, you can subscribe your own observer. Every detector derives from ADetector and exposes Subscribe(IObserver<IDetectorStatus>), which returns an IDisposable you can dispose to unsubscribe. Cast the status to AndroidCheatingDetectionStatus to read the Android-specific fields:

using System;
using GUPS.AntiCheat;
using GUPS.AntiCheat.Core.Detector;
using GUPS.AntiCheat.Detector.Android;
using UnityEngine;

public class AndroidDeviceDetectionLogger : MonoBehaviour, IObserver<IDetectorStatus>
{
    private void Start()
    {
        var detector = AntiCheatMonitor.Instance.GetDetector<AndroidDeviceCheatingDetector>();
        detector.Subscribe(this);
    }

    public void OnNext(IDetectorStatus status)
    {
        if (status is AndroidCheatingDetectionStatus androidStatus)
        {
            Debug.LogWarning($"Android device cheating detected: {androidStatus.AndroidCheatingType} " +
                             $"(threat={androidStatus.ThreatRating}, failedToRetrieve={androidStatus.MonitorFailedToRetrieveData}).");
        }
    }

    public void OnError(Exception error) { }
    public void OnCompleted() { }
}

React On Cheating

When the monitor (data provider) and detector (data validator) are set up, you surely want to react to detected cheating.

Punisher

In general, any cheat detected is forwarded to the 'AntiCheat-Monitor', which calculates an overall threat level. Based on the threat level, you can apply punishments by using Punisher components added to a child GameObject of the 'AntiCheat-Monitor'. There are some built-in punishers that you can find here as prefabs:

The location of the built-in Punisher prefabs.

Inspector

You can set a callback in the Unity Inspector view of the detector. This callback is invoked as soon as the specific cheating is detected.

A list of callbacks invoked when cheating is detected by the detector.

Code

If you would like to write a custom listener for the detector, you can attach an observer:

// Get the detector.
var detector = AntiCheatMonitor.Instance
      .GetDetector<AndroidDeviceCheatingDetector>();

// Subscribe as observer and get notified on inconsistency.
detector.Subscribe(myObserver);

The detector also has an inherited property 'PossibleCheatingDetected' which is set to true once cheating has been detected.