For Counter Strike: Source for example the server sends the location, and way that a user is pointing to the client. With some calculations you can then draw a line from the other players to where their bullets would go if they fired. Using that knowledge you can find where your hitboxes are and simply make sure that you are never in the path of their line of sight!
That is how wallhacks work as well, the client knows where the other players are so that sound can be properly calculated (so if they are further away and they fire their gun you hear less of a shooting sound and you hear a louder sound when they are closer).
Healthpoints are generally stored server side (at least for the games I've been RE'ing for fun lately), but even then you can cheat, if you have portable med kits you can take at any time, as soon as you drop below a certain percentage you take one, now hack the client to have unlimited health kits and you are set. Keeping everything and all variables on the server is impossible, mainly due to lag the game would become unplayable, and due to having so many variables to calculate there is always something you have to trust the client with (position being the biggest one, you can't take all user input, send it to the server, and then send back where the character should now be).
The faster internet connections become the more feasible it is to have a client that just renders the result and have all of the computations done on a remote server somewhere. Kinda like RDP for games. But until the game companies then also put the servers close enough by the user and build the game experience to equalise between different ping times (something CS:S attempts to do but fails at quite well, thus allowing people with AWP's to kill people that are not even near where they were scoping due to timing delays) it is going to be a huge mess and gamers will hate it.
Why not just take the user input from the client, and send it both to the model of the world on the server, and also to a non-authoritative model of the world on the client? The client is then immediately responsive, as the client model of the world is what is rendered, but if the model of the world on the client diverges from the model of the world on the server, the server overrules it.
This would ensure the client did not violate position rules, while still keeping it responsive, at the cost of an occasional noticable update when models get too far out of synch.
As far as I know many games have done this, since Quakeworld. I might be wrong, my knowledge is a little rusty?
Other issues remain that this doesn't solve (e.g. aimbot).
EDIT - Here's a wiki article this: http://en.wikipedia.org/wiki/Client-side_prediction which links to this article describing client side prediction in Half Life (so you can presume there is something at least as sophisticated in Source): http://web.cs.wpi.edu/~claypool/courses/4513-B03/papers/game...
The problem with this is that the game needs to be fully deterministic and you'd be surprised how many games use random numbers to help determine outcomes like damage etc.
This can also cause problems when you have complex physics models, many physics engines are not deterministic and small changes between the ways that different CPUs deal with floating point numbers can cause the game to generate a completely different hash.
Your comment about the differences in how CPUs deal with floats is very interesting.
I found the following interesting comment, from a GPG employee, talking about how they take care to ensure their float math is deterministic:
"I work at Gas Powered Games and i can tell you first hand that floating point math is deterministic. You just need the same instruction set and compiler and of course the user's processor adhears to the IEEE754 standard, which includes all of our PC and 360 customers. The engine that runs DemiGod, Supreme Commander 1 and 2 rely upon the IEEE754 standard. Not to mention probably all other RTS peer to peer games in the market. As soon as you have a peer to peer network game where each client broadcasts what command they are doing on what 'tick' number and rely on the client computer to figure out the simulation/physical details your going to rely on the determinism of the floating point processor."
For anyone else reading, I'd also suggest reading some of the followup posts such as this one: http://www.box2d.org/forum/viewtopic.php?f=3&t=1800&...
This is news? Isn't this the entire point of the IEEE754 standard, to save us from the days when programs that were well-conditioned on a VAX would become numerically unstable on a Cray?
'Cray instability' sounds like a Star Trek episode but it is apparently something that could happen.
The physics engine is a bit more difficult hurdle I suppose.
I'm not convinced of this, and the general trend of every online game that cares about cheating since at least QuakeWorld (1996) is moving in the direction of not trusting the client for important things.
> Keeping everything and all variables on the server is impossible
True, but you can get quite far by only giving the client the information they're supposed to have. Wallhacks were originally possible in Quake because pre-QW, the client received the position of every player on the map.
The strongest way to prevent wallhacks is to only tell the client about other players they should be able to see. The id and valve engines do this, for the most part. Again, quakeworld in 1996 severely curtailed wallhacking by only showing the users players that were visible, or "almost visible", i.e. near corners.
Your example of infinite health packs is something that could be trivially tracked on the server side and is, even for games as big as WoW. WoW tracks the current inventory of every single player in game. You can tell because sometimes when there are server glitches, you're unable to pick up loot from dead monsters.
You can hear somebody moving on the other side of the wall to you and for the sound to be realistic it needs to be played at the correct volume level determined by distance etc.
This isn't a big issue in some games , because you can just make peoples movements silent (of course there is still weapon sounds). However other games (like CS) have a stealth element where you need to make a tradeoff between moving quickly and noisily or slowly and silently so the sound is a big part of that.
I'd go so far as to not even notify the client about sounds that are too quiet and far away for the player to be able to hear in the first place. Calculating echoes on the server and having the client treat them as separate "original" sound sources should also help somewhat.
Pushing this info to the client early also allows the program to make sure all the required assets are loaded into memory before it has to be rendered.
You could stream sound from the server, but latency might be an issue.
Also a lot of older games would mainly use a hitscan model for bullet collision detection. The projectile itself was not modelled, instead there was a ray intersection test done at the time the bullet was fired so there was no "movement" for the bullet so to speak. Do most modern games now use a physics engine to simulate every bullet instead?
> Do most modern games now use a physics engine to
> simulate every bullet instead?
Then, one could even have a limited set of extremely beefy full-game simulation machines that run in lockstep against a certain sampling of active game sessions (like 10%), banning a large enough subset of cheaters in real-time to ensure player confidence in the game's anti-cheating system.
I think some recent AAA titles work this way, although I'm not 100% positive as I have no insight into the server end of their systems (and what I observe as automated asynchronous cheating detection could be a vast number of human observers as well).
> Keeping everything and all variables on the server is impossible [...]
> Kinda like RDP for games.
CS was also one of the first popular games where weapon recoil was modelled and new players would tend to spray full auto at a target (because that's what you did in quake).
He was of course one of those often banned, since he was able to shoot at full auto without suffering recoil. I remember playing with him; his handle was kylyk, so I went with kylyks_meatshield.
I have a few friends who were often accused of cheating in Counter Strike Source and Call of Duty even though they definitely weren't.
As soon as that guy left, I would be able to play and would appear to get much better. This would lead to me being called a cheater, on the grounds of "you weren't that good just five minutes ago".
These servers quickly became havens for players connecting using modified software (free clients and so on) and those who had steam accounts which had been "vac'd".
Ironically, included in this list were a lot of servers who hosted third-party anti-cheat software, as it conflicted with VAC - creating unjustified bans.
That reminds me of how in Mass Effect 2, secret files on the character Legion (a sapient machine, for those who don't know) reveal that he has been banned from several online games for cheating; however in each case he appealed and successfully overturned the ban.
After they had got themselves banned from just about every server out there they launched their own "anything goes" server which could be actually be a fun experience to play on.
Another interesting thing I remember from the CS days was that me and my friends used to play the game a lot which meant that we were much more skilled than the average player. The result of this was that admins would often accuse us of cheating (we weren't) simply because our kill/death ratio was so much better than anybody elses (I used to have screenshots of myself with 40/2 kill/death ratio on public servers using pistols only).
Of course this made us pissed at the time since we kept getting banned from servers, but now I think about it where they so unjustified in doing this? Having a massive advantage over the average player whether it comes from skills or cheats still has the same affect of reducing the enjoyment of the game for average players & newbies. It's almost like having an olympic athletic squad turn up to the local school sports day and dominate every trophy.
Since I don't have as much time or interest in games as I used to when I was a teenager I tend to avoid online play in many games because the experience is generally just getting curb stomped over and over again by more experienced/obsessive players and sometimes in team based RTS games I get kicked from a team because "I don't team with noobs".
Another thing I don't understand about this is how invincibility cheats would work, I can understand things like aimbots / wallhacks because they are using information that has been pushed to the client but surely the game server should never allow something like the number of health points to be authoritative on the client end?