Universal - Memory Tampering - Detector

Score, health, and position live in memory. A cheat tool can change those numbers. Protected types notice the change and tell this detector.

Walkthrough: Memory protection.

Detector

PrimitiveCheatingDetector (namespace GUPS.AntiCheat.Detector) notices unexpected changes to protected values. Memory editors are the usual cause. It does not need a monitor. The protected types report the change themselves.

Observed subject

The detector does not poll the values. Polling would cost speed and memory. The protected types (GUPS.AntiCheat.Protected.IProtected) call OnNext when they see tampering. The protected types are listed on the Protected page.

Status

The detector sends a CheatingDetectionStatus:

public struct CheatingDetectionStatus : IDetectorStatus
{
    // Probability that the detection is a false positive, in the range [0.0, 1.0].
    public float PossibilityOfFalsePositive { get; }

    // The threat rating reported with this detection.
    public uint ThreatRating { get; }
}

Threat rating and false positives

• PossibilityOfFalsePositive: 0.01 (fixed). A protected value that reports tampering is a strong sign.
• ThreatRating: default 500 (recommended 500). False alarms are rare, and a changed value matters a lot.

Lifecycle and timing

The detector waits. It only reacts when a protected type calls OnNext. There is no timer. On the first report, PossibleCheatingDetected becomes true. Listeners and the Inspector event are told.

Configuration

• Is Active (isActive, bool, default true): Turns the detector on or off.
• Threat Rating (threatRating, uint, default 500): How much one find adds to the threat score.
• On Cheating Detection Event (OnCheatingDetectionEvent): Functions to call when tampering is found. You can wire these in the Inspector.

Supported platforms

Every platform.

Requirements

None. No monitor is needed.

How to use

Add PrimitiveCheatingDetector as a child of the AntiCheat-Monitor. Then choose how you want to react.

Add the component

Manual

Add PrimitiveCheatingDetector from GUPS.AntiCheat.Detector. A child of the monitor is the best place.

Add the PrimitiveCheatingDetector component.

Prefab

You can also drop in the prefab.

Add the Primitive Cheating Detector prefab to the AntiCheat-Monitor.

Settings

The PrimitiveCheatingDetector settings.

• General Settings: Turn the detector on or off.
• Threat Rating Settings: How serious one find is.
• Observable Settings: Functions to call when cheating is found.

Runtime

The report does not come from a monitor. It comes from the protected types:

• Protected primitives: int, float, string, and Unity types such as Vector and Quaternion.
• Collection (Pro): A protected List, Queue, or Stack. You check integrity yourself.
• DataChain (Pro): An ordered chain that keeps its order and notices a rewrite. Useful for assets, achievements, or a currency log.

When one of these types sees a change, it tells PrimitiveCheatingDetector. The detector then tells its listeners.

Read the detection in code

You can also listen yourself. Subscribe returns an IDisposable. Dispose it when you want to stop. Get the detector from the AntiCheat-Monitor.

using System;
using GUPS.AntiCheat;
using GUPS.AntiCheat.Core.Detector;
using GUPS.AntiCheat.Detector;
using UnityEngine;

public class PrimitiveDetectionLogger : MonoBehaviour, IObserver<IDetectorStatus>
{
    private void Start()
    {
        var detector = AntiCheatMonitor.Instance.GetDetector<PrimitiveCheatingDetector>();
        detector.Subscribe(this);
    }

    public void OnNext(IDetectorStatus status)
    {
        Debug.LogWarning($"Memory tampering detected (threat={status.ThreatRating}, fp={status.PossibilityOfFalsePositive}).");
    }

    public void OnError(Exception error) { }
    public void OnCompleted() { }
}

React when a cheat is found

The detector tells the AntiCheat-Monitor. The monitor adds the report to the threat score.

Punisher. Add a punisher prefab as a child of the monitor. It runs when the score reaches its limit.

Built-in punisher prefabs.

Inspector. Add a function to On Cheating Detection Event. It runs when this detector finds a cheat.

Inspector callbacks on a detector.

Code.

var detector = AntiCheatMonitor.Instance
      .GetDetector<PrimitiveCheatingDetector>();

detector.Subscribe(myObserver);

PossibleCheatingDetected stays true after the first find.