Recognizing a hack

[Diomedes]

I'm not sure how to tell if the target is hacking.  He knows where everyone is; i.e. wall hack or enemy radar, but there is no graphic on screen to record.  Also there is no one in spectate mode so I've ruled out a second ip address.  The only clue I have is a very pronounced pause prior to this divine knowledge he seems to have.  Please help.....    sincerely,   Diomedes   P.S.  Call of Duty UO    The Sand Lot . or TSL     His name always changes.  But it's TheSilverFox.  ty.

[JerseyDevil]

Re: Recognizing a hack

have any  pb screenshots or demos?

[Diomedes]

Re: Recognizing a hack

How is a pb screenshot different from a regular one?

[scarlet]

Re: Recognizing a hack

PunkBuster allows Server Admins to request and retrieve actual screenshot images being displayed on the gaming monitor of players currently connected to the game server.  It is very easy to request a screenshot from one or more players and also to set up automatic screenshot capturing.  Several advanced features are available for Admins who want to tweak their systems.  The defaults are fine for most Admins and are a good place to start when getting a feel for how the Screen Capture Facility works.

There are two ways to capture screen shots: Manually and Automatically.  Some Admins will do both types.  To Manually request a screenshot from all connected players, simply type "PB_SV_GETSS" into the Game Server console and after a few seconds, you will start seeing messages about where newly retrieved screenshots were written to your hard drive and what their filenames are.  PB names screenshot image files using incrementing sequential serial numbers and they always have the PNG extension.  PNG graphic files are similar to GIF and JPG files - they combine the best of both worlds with respect to the type of images found in most computer games.  Along with each screenshot image (PNG) file, PunkBuster also writes a "helper" HTM file with the same filename so that you can use any web browser, such as Netscape or IE, to easily view your captured screenshots.  Furthermore, all screenshot requests are logged to one specific HTM file called pbsvss.htm so that the list is made available on one scrolling screen as an index for quick and easy viewing.

If you wish to take a manual screenshot of only one or a few connected players, you can specify either the player's slot number directly or you can specify a text substring and PB will request screenshots from all players whose names contain the specified search text.  To find the slot # of a specific player, type PB_SV_PLIST into the console.  Column one contains the slot # for each connected player in the list.  To request screenshots from all players with the text "ABC" in their name, type PB_SV_GETSS "ABC" (note the quotes are necessary when specifying name substrings).

To set up Automatic Screenshot Capturing, set the PB_SV_AUTOSS setting to 1 (the default is 0).  Then you may want to change the values of the PB_SV_AUTOSSFROM and PB_SV_AUTOSSTO settings to specify how often PunkBuster will request screenshots from each connected player.  Both of these settings are measured in seconds and the defaults are 60 and 1200 respectively which means that the PunkBuster Server will request a new screenshot randomly anywhere from 1 to 20 minutes after each previous request for each connected player.

Note that regardless of the combination of manual and automatic screenshot requests submitted during gameplay, the PunkBuster system limits screen shots in two ways.  First, each individual screenshot is limited to 82,000 pixels in an effort to keep image file sizes and transfer bandwidth requirements down.  If you set your parameters (described below) to request images that contain more than 82,000 pixels, then PunkBuster will automatically reduce the image size until the actual capture fits within the limitation.  Also, PunkBuster will not allow more than 3 screenshots to be requested from each player within any 10 minute period, nor allow a screenshot to be requested within 30 seconds of the previous request.  The PB_SV_PLIST command used to display information about connected players has a column called "RecentSS" which shows the number of requests for each player within the last 10 minutes.

Also, Admins should keep in mind that PunkBuster will not take a screenshot from a player who has minimized his local game or who has an application active other than the game itself.  In those cases, an empty black screenshot image is sent with text at the bottom explaining why the Capture failed.  Also, there are a few video display setups that cannot be correctly captured at this time.  These setups also do not allow the game itself to take screenshots using the built-in non-PunkBuster method.

The following settings can be used to customize the Screen Capture Facility:

PB_SV_SSWIDTH and PB_SV_SSHEIGHT are used to request a specific size image in pixels.  The default is 320 x 240.  If a size is requested that is larger than the actual resolution on a player's system, then PB will automatically reduce the appropriate parameter to match the size of the resolution.  For example, if a screenshot of 800x600 resolution is requested from a player running the game in 640x480 resolution, then PB will take the image at 640x480 resolution automatically.

PB_SV_XPCT and PB_SV_YPCT are used to specify where on the full playing screen that the capture is to be centered.  The default is 50 and 50 so that the capture comes from the center of the playing screen.  Using lower numbers moves the captured area toward the left (in the case of XPCT) and upper (in the case of YPCT) portions of the screen and using higher numbers moves the area towards the right and lower portions of the screen respectively.  If XPCT and/or YPCT are set to -1, then a random percentage between 0 and 100 will be used for each individual capture request - this has the effect of capturing different (randomized) portions of the playing screen each time a capture is taken.

PB_SV_SSSRATE sets the sample rate for the capture.  The Sample Rate can be set to take less pixels from a larger area of the screen to, in effect, compact a larger picture into a smaller size by simply skipping pixels.  Sample Rates of 1, 2 and 4 are available.  Using a Sample Rate of 2 will reduce image file sizes to about one fourth of normal (Sample Rate 1) and using 4 will reduce to about one sixteenth.  The reduction in file size does affect the clarity of the image.  It is always best to use Sample Rate of 1 unless you desire to capture large portions of the playing screen and don't mind losing some clarity in the resulting image.  Even with the 82,000 pixel limit, it is possible to capture images at 1280x1024 using a sample rate of 4 for the relatively few players who play in very high resolutions.

PB_SV_SSDELAY causes the PB Client to wait a random number of seconds (up to 60) after receiving the capture request before actually capturing the image.

PB_SV_SSPATH can be configured to hold an alternate location where captured screenshots are to be written.  This can be a network share if desired.  The default is "" (empty) which means the pb/svss subfolder holds captured screen shots and related support files.

PB_SV_SSFLOOR, PB_SV_SSCEILING, and PB_SV_SSNEXT deal with the way captured screenshot images are named as they are saved to files at the PB server.  The PB_SV_SSNEXT setting holds the serial number that PB will use for the next captured filename - for example if PB_SV_SSNEXT is 250, then the next captured image will have a filename of pb000250.png (and it's "helper" file will be named pb000250.htm).  The PB_SV_SSNEXT setting is incremented and maintained automatically by the PB system but can be set manually if desired.  The FLOOR and CEILING settings specify the from and to range for the screenshot filenames captured by this server.  Using the PB_SV_SSPATH command mentioned above, Admins who run multiple servers may want to have all PB Servers send captured screenshots to a central location.  The FLOOR and CEILING settings allow the admin to give each PB Server its own unique range of filenames to use so that there is never any overlap in the central archive.

PB_SV_SSCMD holds the name of a local script (batch) file that PB will execute automatically after each screen shot is retrieved successfully.  The default value of this setting is "" (empty) which means that PB will not run a local script at all after image captures.  PunkBuster passes the full image filename with path as a parameter to the script.  This is for advanced Admins who wish to automate the processing, archiving, and/or publishing of screenshots (such as to a web server).

[AR-BlackHawk]

Re: Recognizing a hack

Also i would like to quote that 80% of all hacks used bypass the PunkBuster SS Function without a problem,
Even a smaller amount 67% gets detected by the pb engine itself and gets a kick from your server.

Best way to protect a server, is to know your enemy! Watch some youtube hack videos, players ingame and you will find out that there is a standard patron.

[Diomedes]

Re: Recognizing a hack

This is a lot of great information.  Thank you all very much for your time and consideration.

[scarlet]

Re: Recognizing a hack

Anytime you need any information just ask, we at the CP are always happy to help and with our current members also offering there support i believe we can resolve most gaming issues