title: How to work out how game players are cheating?
body: <p>Before ask my question, I have to explain you my project and how I'm working. I make a server for a game. This server need a lot of development, 800k lines of code.</p>
  
  <p>After more than one month. It appears there is a cheat some players are using to destroy player's fun. </p>
  
  <p>I have to admit it's a bit hard for me to figure out how to defend myself about this. The server owners community are just under attack too much and everyone is trying to defend himself as they can. </p>
  
  <p>I'm working in Lua, JSON, HTML and CSS for this project, 99% Lua.</p>
  
  <p><strong>What things the game client has control over :</strong> </p>
  
  <p>The client can do commands but commands are only allowed to admin. Except if the injection of his own file make a new command. And can inject code inside the client game(explain after). </p>
  
  <p><strong>What the server does :</strong> </p>
  
  <p>I guess, here is where we may can do something. All servers have tons of mods installed, so all client are downloading all my mod/client scripts to trigger my servers events.</p>
  
  <p><strong>What is the process of sending a command :</strong></p>
  
  <ul>
  <li>the client can use chat /command [attribut][attribut2]</li>
  <li>the client can run the client's console and : command [attribut][attribut2]</li>
  </ul>
  
  <p><strong>How cheaters are doing it?</strong> </p>
  
  <ul>
  <li>1) Injector hidden in the memory with windows executable. </li>
  <li>2) They are loading a client file to make clients commands to call server triggers*. 
  (because, yes, it's poor everyone is using same scripts so it's known triggers names)</li>
  <li>*) To do that they open a client console and writing inside : "exec c:/filename.lua" )</li>
  </ul>
  
  <p>50% of cheat scripts are obfuscated with AHCI &amp; variable replacement like the following.</p>
  
  <p><strong>What does a cheat look like?</strong> 
  I cannot post the full code here >Body is limited to 30000 characters; you entered 208906.&lt; >obfuscated&lt; >not indented(1 ligne)&lt;</p>
  
  <p>-A global function :  </p>
  
  <p><code>function IllIlllIllIlllIlllIlllIll(IllIlllIllIllIll) if (IllIlllIllIllIll==(((((919 + 636)-636)*3147)/3147)+919))end end)</code></p>
  
  <p>-A global variable :</p>
  
  <p><code>IllIIllIIllIII(IllIIIllIIIIllI(IlIlIlIlIlIlIlIlII,IIIIIIIIllllllllIIIIIIII))()</code></p>
  
  <p>-A global variable :</p>
  
  <p><code>Xxxxx5 = {}</code></p>
  
  <p>-A global variable : </p>
  
  <p><code>Xxxxx5.debug = true</code></p>
  
  <p>-A local variable :  </p>
  
  <p><code>local logged = true</code></p>
  
  <p><strong>Where I need you help</strong></p>
  
  <p>I would like to detect not the injection. But, I have no control at all, on this. I would like to detect one of these thing : (Remember I can inject my client lua / Json scripts to do things)</p>
  
  <ul>
  <li>when someone is typing : exec in the console ? </li>
  <li>when someone is using a global variable/function ? (since I got them "Xxxxx5.debug = true")</li>
  <li>when someone is trying to detect or scan my triggers ? </li>
  <li>something I didn't think yet ?</li>
  <li>Detect if function exists ? </li>
  </ul>
  
  <p>I have global and local function in the client script : </p>
  
  <blockquote>
  <pre><code>local function d(e)
      local f = {}
      local h = GetGameTimer() / 200
      f.r = math.floor(math.sin(h * e + 0) * 127 + 128)
      f.g = math.floor(math.sin(h * e + 2) * 127 + 128)
      f.b = math.floor(math.sin(h * e + 4) * 127 + 128)
      return f
  end
  
  
  function Dt(text, x, y)
      ..stuff
  end
  </code></pre>
  </blockquote>
  
  <p>A good information is : 
  I succeed to do a good protection but it's very basic.... 
  Most of cheats are using the same commands to be oppened. I just patched the shordcuts to acces them. Client get kick if they use them. 
  Maybe it's a solution if better coded ? But, if player is in the chat or console it's no more working so I don't figure out how it's working when player is in this state. (Key disabled)</p>
  
  <p><strong>Why I'm asking for help ?</strong></p>
  
  <p>I can assure I dev all my scripts, reworked all my downloaded scripts, find all other solutions, without any help. I prefer learn to fish than ask for a fish. But this time tried many things that are not working. </p>
  
  <p>What I've tried : no one of these conditions worked :</p>
  
  <pre><code>-- if (_G["Xxxxx.IsMenuOpened"] ~= nil) then
      -- while true do
      -- print = 'Xxxxx'
      -- end
  -- end
  
  -- if Xxxxx ~= nil then
      -- setfenv(Xxxxx , nil )
  -- end
  
  -- if rawget( _G, Xxxxx) ~= nil then  -- "var" n'est pas déclaré
      -- print 'Xxxxx DETECTER !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!'
  -- end
  
  -- if rawget( _G, Xxxx) ~= nil then  -- "var" n'est pas déclaré
      -- print 'Xxxxx DETECTER !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!'
  -- end
  
  -- if (_G["Xxxx.IsAnyMenuOpened"] ~= nil) then
      -- while true do
      -- print = 'Xxxxx'
      -- end
      -- print = 'xxxxx'
  -- end
  
  -- if source == '[Xxxx]' or source == 'Xxxxx' then 
      -- while true do
      -- print = 'Xxxxx'
      -- end
      -- print = 'xxxxx'
  -- end
  
  -- if (_G["Xxxxx"] ~= nil) then
      -- while true do
      -- print = 'Xxxxx'
      -- end
      -- print = 'xxxxx'
  -- end
  
  -- if Xxxxx ~= nil or Lynx8.debug = true or Lynx8.debug = false then
      -- reason2 = 'Xxxxx DETECTE'
      -- TriggerServerEvent("Drop_player" , reason2 )
  -- end
  
  -- if Xxxxx.Display() ~= nil then
      -- reason2 = 'Xxxxx DETECTE'
      -- TriggerServerEvent("Drop_player" , reason2 )
  -- end
  </code></pre>