Overview
This is a comprehensive–yet easy–guide for Counter Strike Administrators. This guide is a tool that will empower you as an Admin, and help you run a clean server by providing you with a strong set of pre-defined actions to take in reviewing demos. Ultimately, the goal of this guide is to help the Counter Strike community as a whole by providing Administrators with quality information and tools with which to keep their respective servers clean.
Introduction & Basics
If you’ve played any amount of Counter Strike, there is a great chance you’ve heard the term “demo”. It’s not super intuitive, so there is a chance you’ve heard the term in passing, and not quite grasped what it was all about. In this guide I will explain what a demo is, in general terms, and explain how you can make use of demos in your quest at conquering cheaters in your servers.
Demo
Oddly, the term “demo” can be used as a noun or verb. As if the grammar matters? Moving along…a demo is simply a recording of Counter Strike as taken through the console command “record [filename]”. If you’re not familiar with using console commands, I’ll cover that quickly: using the “~” key (under Escape on your keyboard) you can open the developer console where you can manually change values and make use of other commands not found on in-game menus. If pressing the “~” key doesn’t open the console for you, go to your Counter Strike Options menu and enable the console (this is usually found in the “keyboard” section of the menu).
Why Record a Demo
There are any number of reasons to record a demo–from making frag-videos, to entertaining YouTube clips–but the most prominent is for anticheat purposes. League play often requires players to record a first-person demo of matches that may be requested in the event of a match dispute. Communities may require Administrators to record demos as evidence of cheating when making a ban. This latter reason is what we’ll discuss today.
If a player is cheating, there are times when reviewing a demo of that player may lend a hand in catching them doing so. Having video evidence of someone cheating is considered to be second only to being caught by an anticheat client in most cases–so having a demo to post along with a ban is almost always the best possible thing to have.
So, with a demo in your hands, how do you use it to review the gameplay someone that is suspected of cheating? Let’s move on and cover that…
How to Record a Demo
Now that we are comfortable opening the console, let’s talk about how to use it to record a demo, shall we? Using the following console command would result in your game recording a demo named “UnicornsEatRainbows”:
Simple enough, right? You can name the demo anything you’d like. Just remember that demos will overwrite without asking–so if you record another demo with the name “UnicornsEatRainbows” it will take the place of the first one. Eventually, after you begin recording your fancy unicorn demo, you may want to stop the recording. To do so, simply use the command “stop” in console. Easy ******* peasy.
How to Play a Demo
Files & Locations
Demos, by default, save as .dem files into Program Files (x86)steamappscommonCounter-Strike Sourcecstrike on your local machine. You don’t necessarily need to know that, or ever mess with the demos that you record personally; unless, of course, you want to share them with others. Additionally, if someone sends you a demo to review, you’ll want to place the .dem file into the above mentioned directory so you can then watch it.
Playback commands
There are a few ways to load up and view a demo within Counter Strike. For the purposes of this guide, we’ll be using Counter Strike: Source to explain. Once you have launched Counter Strike, you can open console and simply type the following command (replace [demoname] with the name of the demo you want to watch).
That will simply load and play the demo as it was recorded. If the demo was taken via SourceTV, you may need to scroll through the players and views until you get to the first person view of the player you want.
It’s worth noting that SourceTV demos are generally not accepted for anticheat purposes due to the lower tickrate they are recorded in, and cannot be deemed reliable enough to determine if players are cheating. That doesn’t mean you should disregard them entirely, but a first person demo is always preferred.
Other Ways to Review Demos
There are two types of UI controls that may help in controlling the playback of a demo.
- demoui
- demoui2
Using either of these commands will open a UI that allows you to load demos, pause, speed up, or slow down the playback. There is also the option to skip to specific ticks (read: times) and to skip ahead–but these are unreliable. Often times trying to skip to specific times will not work.
Commands to Use When Reviewing
When reviewing a demo for anticheat purposes, you’ll most likely want to enable server-side cheats on your local machine. This is, in no way, cheating on your part. It simply allows you to use built-in commands to see & interact with the game differently. When you close Counter Strike the value will go back to zero and you are at no risk of harming your account or credibility.
- sv_cheats 1 – use this to enable server-side cheats (your PC being the “server” in this instance)
- r_drawothermodels 2 – this will draw models that are not within direct view of the player (allows you to see through materials)
- mat_wireframe 1 – there are instances where using this will allow you to see through more materials, and may be helpful in catching vision assistance.
Using the above commands–either on their own or in combination–can help Administrators see what a player may see if they are using some type of vision assistance (commonly referred to as “walling”).
Using the information you’ve gathered now, you can effectively record and play demos. You may receive requests to review a demo of a suspected cheater, and you’ll want to know just what to look for. Let’s head to the next section and discuss that…
Proof vs. Evidence
The true goal of reviewing demos (for the purposes of this guide) is to help determine if there are grounds to ban a player (read: sufficient evidence to make a case against someone). When we–as Administrators–are making a case against someone, there is potential collateral damage and other community blowback to be mindful of. If you falsely accuse a community member, donator, or friend, you may offend someone to the point where they pack up their business and go play/donate/member someplace else. Alternatively, if you make a weak case against someone who is cheating, and the ban is appealed due to lack of evidence, you’ve allowed this negative presence to remain in your community. The takeaway here is to make certain you gather quality bits of evidence that you or your fellow Administrators can use to ban real cheaters–or to help disprove “hackusations” of legitimate players.
Scenario: A player is accused of cheating. A demo recorded. His friends rally against the admin to say “He doesn’t cheat! I’ve played with him forever!”. These things can, and most likely will happen. A good strategy is to record and review demos before banning players. Doing this may seem somewhat obvious, but if you take the time to do the research ahead of time you may save yourself the effort of banning a player just to determine (or have another Admin determine) they aren’t cheating, and then be forced to unban them. These extra steps can create a more hostile environment than needed, so doing the legwork ahead of time is often times a great approach.
Is it proof, or is it evidence? I like to remind myself that there is no such thing as proof, at least in terms of demo review. You may have evidence that is nearly insurmountable. You may have evidence that is circumstantial (at best). A demo doesn’t ever prove that someone is a cheater, it is simply your evidence in a case against them. Keep in mind that the less obvious the case is, the higher the probability that there will be an appeal. You want to have a strong case to support your position to stave off phony appeals that keep scumbags from scumbagging in your server. If you have reviewed the demo while already thinking that they are cheating, you may find evidence that only you believe to be real. Remaining unbiased, and educated, are the keys to proper demo review. Remember: everything looks suspicious when looked at with suspicion.
A good player? A cheater? A good cheater? The higher up the skill ladder you climb, the harder it can be to differentiate between a good player and a cheater. This is why there are professional players who get away with cheating (for a time) and they do it with many thousands of players watching their matches. When you’re already a significantly skilled player, the boost that aim assistance or visual assistance gives you becomes smaller and therefor less detectable to the naked eye. Of course, there will always be Admin out there who claim “I can always tell when someone is cheating”. Don’t let these Admin fool you. They can (and will) cite their league experience, and how good they are at spotting cheats. For most intents and purposes, they are telling the truth, and mean what they say. It just doesn’t mean anything when it comes down to banning players from your server. No one is perfect, and only practice can make you more skilled at spotting gaps in gameplay that end up making a solid case against a player. The other side of that coin is cheaters who claim “no one can ever catch me”. Of course, these guys are also wrong. Use your head, and try to remain objective when reviewing. It’s important to try and leave your individual ideas and skills at the door. You may be watching a demo of a player who is less skilled than you, or maybe a player who is significantly more skilled than you are. If you’re being objective, and sticking to the fundamentals of demo review, the skill gap between yourself and the player shouldn’t matter. Look for the clues, look for context, and remain objective. Thinking “he wouldn’t have gone that way unless he knew someone was there” may be injecting more opinion into the case than is wise, and will ultimately cloud your judgement. An unfortunate truth, in terms of demo review, is that a high percentage of demos will be inconclusive due simply to the fact that they are not all created equal. A demo that only has the suspected player in it for one minute–but has five minutes of other players–is not effective. Inconclusive demos should be considered equal to “innocent until proven guilty”. Remembering that your job [as the Reviewing Admin] is to view the information on screen without applying what you think they would have done if they were (or weren’t) cheating. Look for indicators of the player’s skill level, and context clues to what else is going on within the match. Every round of CS is different, and due to the infinite situations and scenarios, falling into the trap of Monday morning quarterbacking can be easier than we may want to admit.
Context
So much of demo review is inherently out of context. It can be very hard to discern what someone was doing at any point in the demo because you are not that person, and you are not in the situation they were in while the demo was recorded. It’s very easy to think “he had no reason to look there”, or “why did he check that spot?” and assume the player must have had some type of assistance in their gameplay. Without context, we cannot know why the player acted the way they did, and it arbitrary bits of information like this are little more than speculation, which shouldn’t be used in your case building. What we can do, is build a list of context items to help see what kind of player we are reviewing. Once a sort of baseline has been established, it is much easier to sort of view the game through the eyes of the player you are reviewing. Some very good things to consider are:
- Crosshair placement – does the player seem to have a good handle on where they aim? If they are looking at the ground whilst running, having to adjust wildly to get on-target, or don’t seem to adjust properly to recoil, those are all things to consider. Better players will always exhibit very good crosshair control.
- Map knowledge – it’s pretty obvious when you’re watching a player who has no clue what they are doing. They will make wrong turns, seem to get lost, scan areas where enemies couldn’t ever approach from…the list goes on and on. Make an effort to see how well the player demonstrates a grasp of the map they are on. Do they hold smart angles? Do they check common spots, and less common spots? Do they throw grenades and smokes in areas that actually matter? Situational awareness plays into this as well. Players who understand the map will not only know which angles are beneficial to cover, they will be cognizant of secondary (or tertiary) areas where enemies may appear.
- Shot Context – People often complain when they are killed through a smoke grenade, and a pretty high number of hackusations are related to being shot through smoke. When spectating or reviewing a player, try to apply context to the shot. Was the suspected player already scoped into the smoke before it bloomed? Do they shoot more than once into smoke? Do they just snap to someone’s head and fire a headshot kill in smoke? Were they already holding an angle when the smoke appeared, or are they just firing for effect? Look at each action within the context of the round. Players who react to things they “can’t see” will stand out–so keep an eye out for reacting to players within smoke (or behind walls) but don’t assume that any shot through a smoke/wall/object was 100% intentional and therefor grounds for a ban. Apply context.
How to Review a Suspect (Catch a Cheater)
How to Review for Cheating
There are a magnitude of variables when it comes to cheating. In the interest of keeping this somewhat brief, we’ll focus on two very broad pieces of the cheating pie: aim assistance & vision assistance.
Aim assistance is most commonly referred to as “aimbotting”. There are a ton of names players will associate with cheating. You may see things like: aimlock, triggerbot, autotrigger, aimbot, etc. listed when “hackusations” are made. I wouldn’t want to suggest that people don’t know what they are talking about…but a lot of times these terms are used as generalizations rather than actual defining terms. It’s important to understand that there are many different types of aim assistance cheats, and doing research on how they work may make it easier for you to spot. Being that this is a guide on demo review, I won’t be going in-depth on the types of cheats. Some very basic things to look for in terms of aim assistance would be completely upside-down screens, noticeably shakey crosshairs, hitting shots on players that aren’t being aimed at, and instant headshots.
Vision assistance is not unlike aim assistance in that it’s almost universally labeled something generic when that may not be the case. Vision assistance is commonly known to be “walling” or “wallhacking” when in reality there are a plethora of ways someone could gain a visual advantage. Again, in the interest of brevity, I’ll just touch on this quickly and focus on how it pertains to demo review. Seeing players through walls, seeing information that is not normally visible (health, ammo, radar, etc.) is possible through the use of different methods. This doesn’t mean every cheater can see every player across the map–and indeed the Source Engine doesn’t draw playermodels that far away. Thinking that every suspect can see every player may lead you down a path that won’t yield great results. Instead, try looking for players reacting to information they shouldn’t otherwise have. Sure, there will be instances where an unscrupulous cheater will completely follow enemies through walls with their crosshair, or shoot at someone they couldn’t normally see. These will make your life easy, because it’s a quick review process. Catching a more experienced cheater will be tougher.
Scripting is a term that isn’t always used in the correct sense, but for the intents of this guide we will assume that a player who is scripting will be using a key, shortcut, or other means to trigger a third party means of handling their actions. Technical b.s. aside, someone who is pressing one key to perform a series of jumps and/or strafes is generally known to be “bhop scripting”. If you’re not largely familiar with bunnyhopping, how to do it, and what it looks like, it can be tough to spot a scripter. I’ve heard it said many times that “If someone is using a bhop script, they are probably using more cheats as well”. While that’s an unfair position to assume, as an Administrator, it’s just another piece of information you can tuck away for a (rainy) review day. I’m not saying I totally agree or disagree with it, but there could be arguments made for either side. So how do we spot a bhop scripter? Things to note in the bhop of the individual in question would be: consistency in jumps/strafes, speed, reactions to enemies (shooting while jumping), player’s overall control and handling of the game. Like most other forms of cheating out there, you may find that something just doesn’t look quite right. If someone who doesn’t make many shots is suddenly bhopping “FROM IVY, OUT MIDDLE, THROUGH OUR CONNECTOR, LIKE A SPEED DEMON!” and landing headshots while doing it…I guess it becomes obvious that something is up. Education as an Admin is the key, so if you’re unfamiliar with the mechanics of real bunnyhopping it may behoove you (and ultimately your community) to spend some time in a Bhop Server, or otherwise learning the ropes. Knowing what a good bhopper looks like may help you spot the fakers out there.
One of the most important things in demo review is to take copious notes. The whole process can seem a little daunting, and certainly more than a little tedious, but being a good Administrator is crucial to helping your community. When you review a demo, it’s wise to have a notepad handy (either paper or on your PC) to make notes on specific times/ticks in the demo where you see something that stands out. An easy to do keep notes as you watch may be:
The output could be as simple as:
Suspect || 0:58 || Traced a player through the wall at Long A
Suspect || 1:42 || Shot at a player crouched behind box on site
Suspect || 4:44 || Pre-aimed at the entrance to B site
Just having these notes can make the review process go much quicker. It’s common to watch a demo more than once, especially for more skilled cheaters. You may also need another Admin to view the demo, and having notes to compare with them can be a valuable asset.
Final Thoughts on Playback/Review
The cardinal rule I try to pass along to other Administrators is that “everything looks suspicious when looked at with suspicion”. That’s about as cliche as it gets, but there’s truth in it. Watching demos is best done objectively. Watch the demo without r_drawothermodels and then again with it. Did you see the same thing each time? What are you looking for specifically? Is this person innocent until proven guilty, or guilty until proven innocent? How you answer those questions may be determining factors in how great an Administrator you can be.
Helping Your Community
Hopefully by this point, you’ve gleaned some useful knowledge, and you’re ready to put it to good use. I can’t in good faith promise that having read this guide alone will make you an indominable Administrator, and that your servers will forever be free of scumbags. In reality, it may even have a somewhat opposite effect; knowing what you now know, you may find yourself picking up on more behavior that requires Adminstrative action.
So. What to do with these cheaters now? There are systems in place that can make your bans public, which shares valuable information with the Counter Strike community. Sourcebans is a very solid system that I recommend because it makes bans searchable, and makes it simple for other communities (or individuals) to see who you have banned and why. Other means of ban publishing are certainly available, and you shouldn’t limit yourself to strictly using what I’ve recommended here. I have been part of communities that share banlists with each other, which can be very helpful as well.
There can be some grey areas when sharing banlists with other communities seeing as how things such as banning for spam, harassment, or other non-cheating violations are up to each community’s Administrators, and as such can be subject to different standards. It’s important to remember, though, that we [Administrators] are bound by something other than clan tags: we’re all here to keep servers free of cheaters, exploiters, or other rule-breaking scumbags. Using this guide will help you keep your servers clean, and I ask–as a fellow Administrator–that you consider working with other communities to help make the bigger community a cleaner place.
Cheers,
Jimmy
If you enjoyed this guide, or found it’s contents useful: please rate or comment on it. Feel free to check out my other guides. As always, comments/feedback/suggestions are very welcome. Use the comments section of this guide for any of the above.
This guide was created specifically for Counter Strike: Source and to assist the remaining CS:S players/communities. Bratya po oruzhiyu.