About BF2 Name Hack Buster

A while back one of my clanmates (yup|Patriots) posted a pointer to information on how to check to see if a player is using a hack package that allows them to change their in game name. Basically you go to any site that links the players on a server to their stats via their PID (bf2tracker.com). Find the server, click on the player's name and see if the name is different on the stats page. If it is you just found a name hacker.

A long process when you need to check everyone on a server. So I wrote a java program that could be run from the command line to check an entire server. It had the following problems:

1. It was in Java.
2. It was command line with no GUI.
3. You needed to have Java, setup paths and classpaths, and the command was a long string.
4. It was in Java.

So I rewrote it as this PHP program. PHP made it simple and accessible. And did I mention it's not Java.

Why does this work?

Hackers are cowards! Often they just don't have the guts to use their real BF2 name. So they change it by using their hack package to transmit a forged name to the game server when they join. They can't change their PID though because that is how their stats get recorded.

The tool first connects to the game server to ask for a list of who is playing and their associated PIDs. Then the central gamespy server is queried for the official name of each player using the PID. Each name on the game server is compared to the gamespy name and differences are flagged as hackers or a false positive.

False positives?

The game server will chop off some of a long name or the name will be in all lower case. Why the game servers do this, you'd need to ask Dice. There is a check in place to flag these cases as possible false positives. First all of the hackers are listed and then all of the false positives. Use your best judgement on the false positives and don't worry they're easy to tell if they are innocent or a hacker (I've never seen one that wasn't a false hit).

No hits, so nobody is hacking?

Either that or the hacker is brave enough to use their real name. If they use their real name my tool won't flag them.

What to do when you find a hacker?

Simplest answer is: Don't play on the server. If an admin is on talk to them and point out the name hacker and show them how they can verify this information. They should ban them. If they don't, leave the server as it just isn't worth the grief.

In conclusion

There are hackers and then there are cases where predictive lag makes you think someone is hacking. Do they have a wall hack going on or did your ping combined with their ping give them a sneak peek you didn't get (Yes, I'm a networking geek)? Simple answer is that the name hackers are simple to catch now. If they're not name hacking you need to hope you can get a pb screenshot or do some after the fact reviewing of demo files.

Me I like the ones I can easily catch.

[UTAC] Raycaster 2007/12/30