Universal - Memory Tampering - Detector

Important data such as positions or health status is usually stored in the runtime memory, which can be susceptible to manipulation by cheat tools or data sniffers. AntiCheat offers protected data types to prevent such memory manipulations and to recognize and react to them.

Detector

The 'PrimitiveCheatingDetector' (class PrimitiveCheatingDetector, namespace GUPS.AntiCheat.Detector) detects unexpected value modifications of protected primitive types, commonly caused by memory editing tools. It does not require or poll any monitor; instead the protected data types themselves report tampering directly to the detector.

Observed subject

The detector does not actively observe the protected data types, because polling them would create performance and memory overhead. It is the other way around: the protected data types (GUPS.AntiCheat.Protected.IProtected implementations) call the detector's OnNext when they observe tampering. To learn more about the protected data types, look here.

Status

The detector notifies its observers with a CheatingDetectionStatus, which implements IDetectorStatus:

public struct CheatingDetectionStatus : IDetectorStatus
{
    // Probability that the detection is a false positive, in the range [0.0, 1.0].
    public float PossibilityOfFalsePositive { get; }

    // The threat rating reported with this detection.
    public uint ThreatRating { get; }
}

Threat rating and false positives

  • PossibilityOfFalsePositive: 0.01 (fixed). Low, because a protected primitive reporting tampering is a strong signal.
  • ThreatRating: default 500 (inspector field, recommended 500). High, because false positives are very unlikely and the impact of memory manipulation is significant.

Lifecycle and timing

The detector is passive: it reacts only when a protected data type reports a modification through OnNext. There is no polling and no interval. On the first report, PossibleCheatingDetected is set to true and the status is forwarded to observers and to the inspector event.

Configuration

  • Is Active (isActive, bool, default true) - whether the detector is active and watching.
  • Threat Rating (threatRating, uint, default 500) - the threat rating reported on each detection.
  • On Cheating Detection Event (OnCheatingDetectionEvent) - a UnityEvent raised on every detection; wire up reactions in the inspector without writing an observer.

Supported platforms

The detector is available on all platforms.

Requirements

There are no requirements. No additional monitor is required.

How To Use

Attach a 'PrimitiveCheatingDetector' to a child GameObject of the 'AntiCheat-Monitor' and define a reaction to detected cheating.

Add Detector Component

Manual

Add the 'PrimitiveCheatingDetector' MonoBehavior from the 'GUPS.AntiCheat.Detector' namespace to your 'AntiCheat-Monitor' GameObject, or better, to a child GameObject.

Add the 'PrimitiveCheatingDetector' as a Component.

Prefab

There is also a prefab, including the detector, which you can directly attach as a GameObject to the 'AntiCheat-Monitor'.

Add the 'Primitive Cheating Detector' prefab to the 'AntiCheat-Monitor'.

Settings

After attaching the 'PrimitiveCheatingDetector' MonoBehavior to a GameObject, you will see the following in the inspector:

The settings of the 'PrimitiveCheatingDetector' Component.

  • General Settings: Define here whether the detector should be active.
  • Threat Rating Settings: Define here the severity of the detected cheating.
  • Observable Settings: Add here callbacks invoked when cheating is detected.

Runtime

Recognized memory manipulations are not provided by a monitor, but by the protected data types themselves. There are several protected data types that have been introduced by AntiCheat:

  • Protected Primitives: This includes default value types like int, float, string, ... and all Unity value types like Vector, Quaternion, ...

  • Collection (Pro): Important information can be stored not only within basic data types such as integer or float, but also within collections. AntiCheat provides protected alternatives for commonly used collections such as List, Queue, and Stack, allowing you to monitor changes and check their integrity.

  • DataChain (Pro): A data chain is similar to a linked list, consisting of a sequence of elements arranged in a specific order. It is used to maintain the order of these elements while preserving their integrity. A data chain can be useful in scenarios where you want to manage e.g. "Digital Assets", "Achievements", "Virtual Currencies", etc.

Once one of these protected data types recognizes manipulation or an attempt at it, it notifies the 'PrimitiveCheatingDetector', which in turn notifies its observers of the detected cheating.

Consume the detection in code

Besides the inspector event, you can subscribe your own observer. Every detector derives from ADetector and exposes Subscribe(IObserver<IDetectorStatus>), which returns an IDisposable you can dispose to unsubscribe. Get the detector via the AntiCheat-Monitor:

using System;
using GUPS.AntiCheat;
using GUPS.AntiCheat.Core.Detector;
using GUPS.AntiCheat.Detector;
using UnityEngine;

public class PrimitiveDetectionLogger : MonoBehaviour, IObserver<IDetectorStatus>
{
    private void Start()
    {
        var detector = AntiCheatMonitor.Instance.GetDetector<PrimitiveCheatingDetector>();
        detector.Subscribe(this);
    }

    public void OnNext(IDetectorStatus status)
    {
        Debug.LogWarning($"Memory tampering detected (threat={status.ThreatRating}, fp={status.PossibilityOfFalsePositive}).");
    }

    public void OnError(Exception error) { }
    public void OnCompleted() { }
}

React On Cheating

When the detector (data validator) is set up, you surely want to react to detected cheating.

Punisher

In general, any cheat detected is forwarded to the 'AntiCheat-Monitor', which calculates an overall threat level. Based on the threat level, you can apply punishments by using Punisher components added to a child GameObject of the 'AntiCheat-Monitor'. There are some built-in punishers that you can find here as prefabs:

The location of the built-in Punisher prefabs.

Inspector

You can set a callback in the Unity Inspector view of the detector. This callback is invoked as soon as the specific cheating is detected.

A list of callbacks invoked when cheating is detected by the detector.

Code

If you would like to write a custom listener for the detector, you can attach an observer:

// Get the detector.
var detector = AntiCheatMonitor.Instance
      .GetDetector<PrimitiveCheatingDetector>();

// Subscribe as observer and get notified on inconsistency.
detector.Subscribe(myObserver);

The detector also has an inherited property 'PossibleCheatingDetected' which is set to true once cheating has been detected.