Add server-side anti-cheat framework (movement/physics/spell/item det… by Krilliac · Pull Request #387 · mangoszero/server

Krilliac · 2026-06-21T03:24:08Z

…ection + enforcement)

Introduces a config-gated, server-side anti-cheat / movement-validation framework. OFF by default (AntiCheat.Enable = 0) — fully inert until enabled.

Core pieces:

AntiCheatMgr: central scoring manager. Detectors only observe and score via a single RecordViolation() ingress; the manager owns ALL enforcement. Score decays over time and escalates through capped actions (log -> GM alert -> rubberband to last validated position -> kick), with an optional account-level autoban accumulator (escalating ban durations, slow hourly decay).
MovementAnticheat: per-player validator running cheap, event-driven detectors on each movement packet — fly/flag-spoof (water-walk/hover/slow-fall/transport/ swim, aura- or grant-aware), teleport/blink, speed, acceleration gate, vertical climb, root/stun-break, opcode-legality, no-clip (VMap LoS), jump (infinite/ mid-air), fall-damage suppression, packet burst, client-timestamp regression, bot-movement heuristic, and spell-cast timing (GCD bypass + cast spam).
PhysicsValidator: side-effect-free terrain-plausibility stage (float-above / below-surface), invoked only on suspicion to stay off the hot path.

Integration: movement validation in the movement opcode handler; spell-injection, item-in-trade, GO-use and NPC interaction-distance hooks; cast-timing hook; server-granted movement flags recorded in the Player Set* setters so the flag-spoof detectors don't fire on legit grants; a rolling latency EWMA fed from CMSG_PING for latency-aware tolerances. GM commands: .anticheat status / report / reload / warn / jail / unjail / delete. Violations persist to character_anticheat_violation; account autoban state to account_anticheat.

Time-sync, the spoof/test GM tooling, and the violation-marker visualizer are follow-ups that build additively on this core.

This change is

codacy-production · 2026-06-21T03:26:12Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 275 complexity · 2 duplication

Metric Results

Complexity 275

Duplication 2

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

…ection + enforcement) Introduces a config-gated, server-side anti-cheat / movement-validation framework. OFF by default (AntiCheat.Enable = 0) — fully inert until enabled. Core pieces: - AntiCheatMgr: central scoring manager. Detectors only observe and score via a single RecordViolation() ingress; the manager owns ALL enforcement. Score decays over time and escalates through capped actions (log -> GM alert -> rubberband to last validated position -> kick), with an optional account-level autoban accumulator (escalating ban durations, slow hourly decay). - MovementAnticheat: per-player validator running cheap, event-driven detectors on each movement packet — fly/flag-spoof (water-walk/hover/slow-fall/transport/ swim, aura- or grant-aware), teleport/blink, speed, acceleration gate, vertical climb, root/stun-break, opcode-legality, no-clip (VMap LoS), jump (infinite/ mid-air), fall-damage suppression, packet burst, client-timestamp regression, bot-movement heuristic, and spell-cast timing (GCD bypass + cast spam). - PhysicsValidator: side-effect-free terrain-plausibility stage (float-above / below-surface), invoked only on suspicion to stay off the hot path. Integration: movement validation in the movement opcode handler; spell-injection, item-in-trade, GO-use and NPC interaction-distance hooks; cast-timing hook; server-granted movement flags recorded in the Player Set* setters so the flag-spoof detectors don't fire on legit grants; a rolling latency EWMA fed from CMSG_PING for latency-aware tolerances. GM commands: .anticheat status / report / reload / warn / jail / unjail / delete. Violations persist to character_anticheat_violation; account autoban state to account_anticheat. Time-sync, the spoof/test GM tooling, and the violation-marker visualizer are follow-ups that build additively on this core. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

AppVeyorBot · 2026-06-21T04:55:39Z

✅ Build Mangos ZERO Server 22.04.361-jdhjbpne completed (commit 6cf0847a1d by @Krilliac)

billy1arm

@Krilliac all sql files should be added to the database repo as a matching pr.

Per project policy (CLAUDE.md) and review feedback, DB schema belongs in the separate mangoszero/database repo as a matching migration PR, not in the server tree. Remove account_anticheat.sql and character_anticheat_violation.sql. No code or build references them (the tables are provisioned via the database repo). This also clears the Codacy 'Compatibility' findings raised against the SQL files. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GD6LV6acKwGd426dDQGPDF

# Conflicts: # cmake/MangosParams.cmake # src/game/WorldHandlers/Chat.cpp # src/game/WorldHandlers/Chat.h # src/game/WorldHandlers/World.cpp # src/game/WorldHandlers/World.h

AppVeyorBot · 2026-07-02T03:37:28Z

✅ Build Mangos ZERO Server 22.04.395-nrknckyx completed (commit b03ce39e98 by @Krilliac)

billy1arm · 2026-07-02T05:50:16Z

+bool AntiCheatMgr::IsExempt(Player* player) const
+{
+    if (!player)
+        return true;


@Krilliac Coding standard violation: missing opening / closing braces

billy1arm · 2026-07-02T05:50:23Z

+    // ExemptGMLevel == 0 means "exempt nobody by level" (every account is >= 0,
+    // so without this guard a value of 0 would exempt everyone).
+    if (m_exemptGmLevel > 0 && player->GetSession() &&
+        player->GetSession()->GetSecurity() >= (AccountTypes)m_exemptGmLevel)


@Krilliac Coding standard violation: missing opening / closing braces

billy1arm · 2026-07-02T05:50:30Z

+
+    // A GM with .gm on is also exempt regardless of level.
+    if (player->isGameMaster())
+        return true;


@Krilliac Coding standard violation: missing opening / closing braces

billy1arm · 2026-07-02T05:50:39Z

+                                   float weight, AntiCheatContext const& ctx)
+{
+    if (!player)
+        return;


@Krilliac Coding standard violation: missing opening / closing braces

billy1arm · 2026-07-02T05:50:51Z

+        AlertGMs(player, type, score, ctx);
+        // Anti-gaming autoban: count this kick against the account first.
+        if (m_autobanEnable)
+            AccumulateKick(player);


@Krilliac Coding standard violation: missing opening / closing braces

billy1arm

@Krilliac Multiple Coding standard violations: missing opening/closing braces

Addresses review feedback on PR mangoszero#387 (billy1arm): the project coding standard (doc/CodingStandard.md) requires brackets around single statements. Brace every brace-less if/else/loop body in AntiCheatMgr.cpp (IsExempt, RecordViolation guards + weight clamp, Apply kick path, Update prune/ban loop, AccumulateKick, LoadAccounts). No behavioural change. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GD6LV6acKwGd426dDQGPDF

billy1arm

@Krilliac There are quite a few Coding standard violations, mostly missing opening / closing braces

billy1arm · 2026-07-02T05:53:30Z

+                                    MovementInfo const& mi, const char** reason)
+    {
+        if (!player || !player->IsInWorld())
+            return AC_PHYS_OK;


@Krilliac Coding standard violation: missing opening / closing braces

billy1arm · 2026-07-02T05:53:50Z

+        // Falling/flying/swimming/transport legitimately deviate from the
+        // heightmap, so we do not judge them here.
+        if (state != AC_MOVE_GROUND)
+            return AC_PHYS_OK;


@Krilliac Coding standard violation: missing opening / closing braces, more in file

billy1arm · 2026-07-02T05:54:26Z

+{
+    Player* target = getSelectedPlayer();
+    if (!target)
+        target = m_session ? m_session->GetPlayer() : NULL;


@Krilliac Coding standard violation: missing opening / closing braces

billy1arm · 2026-07-02T05:54:51Z

+        name = args;
+        ObjectGuid og = sObjectMgr.GetPlayerGuidByName(name);
+        if (og)
+            guid = og.GetCounter();


@Krilliac Coding standard violation: missing opening / closing braces, possibly more in file

billy1arm · 2026-07-02T05:55:05Z

+MovementAnticheat* Player::GetMovementAnticheat()
+{
+    if (!m_movementAnticheat)
+        m_movementAnticheat = new MovementAnticheat(this);


@Krilliac Coding standard violation: missing opening / closing braces

billy1arm · 2026-07-02T05:55:48Z

+    m_latSamples[m_latIdx] = sampleMS;
+    m_latIdx = (m_latIdx + 1) % LATENCY_WINDOW;
+    if (m_latCount < LATENCY_WINDOW)
+        ++m_latCount;


@Krilliac Coding standard violation: missing opening / closing braces. More in file

billy1arm · 2026-07-02T05:56:30Z

+    // Anti-Cheat: per-player movement validation (observe + score; never rejects
+    // packets). Inert unless the framework is enabled in config.
+    if (plMover && sAntiCheatMgr->MovementEnabled() && !sAntiCheatMgr->IsExempt(plMover))
+        plMover->GetMovementAnticheat()->HandlePositionUpdate(opcode, movementInfo);


@Krilliac Coding standard violation: missing opening / closing braces

Krilliac · 2026-07-02T06:03:07Z

@billy1arm good now?

AppVeyorBot · 2026-07-02T07:38:48Z

✅ Build Mangos ZERO Server 22.04.395-qscaplpe completed (commit 7b9f3053f6 by @Krilliac)

# Conflicts: # src/game/Object/Player.cpp # src/game/WorldHandlers/World.cpp

AppVeyorBot · 2026-07-03T00:54:14Z

✅ Build Mangos ZERO Server 22.04.404-ldixcmfl completed (commit 19b128e911 by @Krilliac)

Krilliac force-pushed the feature/anticheat-core branch from 5ef604d to 1c76031 Compare June 21, 2026 03:51

Krilliac mentioned this pull request Jun 21, 2026

Add client/server time synchronization (movement desync correction + time-skip/desync anti-cheat) #388

Open

billy1arm requested changes Jun 22, 2026

View reviewed changes

Krilliac and others added 2 commits July 2, 2026 01:30

Merge commit '09b4d1f' into feature/anticheat-core

839d784

# Conflicts: # cmake/MangosParams.cmake # src/game/WorldHandlers/Chat.cpp # src/game/WorldHandlers/Chat.h # src/game/WorldHandlers/World.cpp # src/game/WorldHandlers/World.h

billy1arm reviewed Jul 2, 2026

View reviewed changes

billy1arm requested changes Jul 2, 2026

View reviewed changes

Merge tag 'upstream-master' into feature/anticheat-core

d5615b8

# Conflicts: # src/game/Object/Player.cpp # src/game/WorldHandlers/World.cpp

Uh oh!

Conversation

Krilliac commented Jun 21, 2026 • edited by billy1arm Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codacy-production Bot commented Jun 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Up to standards ✅

Uh oh!

AppVeyorBot commented Jun 21, 2026

Uh oh!

billy1arm left a comment

Choose a reason for hiding this comment

Uh oh!

AppVeyorBot commented Jul 2, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

billy1arm left a comment

Choose a reason for hiding this comment

Uh oh!

billy1arm left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Krilliac commented Jul 2, 2026

Uh oh!

AppVeyorBot commented Jul 2, 2026

Uh oh!

AppVeyorBot commented Jul 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Krilliac commented Jun 21, 2026 •

edited by billy1arm

Loading

codacy-production Bot commented Jun 21, 2026 •

edited

Loading