HvH Essentials

Server side anti exploit and match integrity plugin for Counter-Strike: Global Offensive HvH servers. It blocks a set of common client exploits, shows detections to admins through an in game alert feed, and exposes a settings menu and a small developer API.

How it works

Essentials runs in two layers:

1. A pure SourcePawn layer inside OnPlayerRunCmd that validates and sanitizes player commands (angles, fake duck, air stuck) and applies movement punishment.
2. A DHooks layer that detours three engine functions (ClampBonesInBBox, StartLagCompensation, RecordDataIntoTrack) to fix exploits that cannot be reached from OnPlayerRunCmd. These need the gamedata signatures shipped in essentials.games.txt.

Every confirmed detection is recorded with full context and sent to admins. The plugin is built for HvH, so it never touches the usercmd tickcount and never interferes with doubletap or fakelag.

Requirements

• SourceMod 1.11 or newer.
• The DHooks extension (ships with SourceMod 1.11+).
• A Linux game server. The detour signatures in essentials.games.txt are Linux only. On Windows you must regenerate them.
• Counter-Strike: Global Offensive.

Installation

1. Copy plugins/essentials.smx to addons/sourcemod/plugins/.
2. Copy gamedata/essentials.games.txt to addons/sourcemod/gamedata/.
3. Make sure the DHooks extension is installed and loaded.
4. Change the map or run sm plugins load essentials.

To build from source, compile scripting/essentials.sp. The compiler pulls in the module files under scripting/essentials/ through relative includes and produces a single essentials.smx. The developer include lives at scripting/include/essentials.inc.

Features

Each feature is controlled by one or more console variables. Defaults are shown in parentheses. All variables are FCVAR_PROTECTED.

Force lag compensation

Detours StartLagCompensation and forces the shooter's m_bLagCompensation to true for the duration of the lag compensation window, then restores the original value. This stops players who set cl_lagcompensation 0 from being hard to hit, without moving them or punishing them.

• sm_essentials_force_lagcomp (1): enable transparent forcing.

Anti-exploit (AX)

Detects players who join or spawn with cl_lagcompensation 0 and moves them to spectators. This is the stricter version of force lag compensation and is checked on spawn and on team join.

• sm_essentials_ax (1): move players to spectators.
• sm_essentials_warn_ax (1): print a chat warning to the player.

Roll anti-aim fix

Detours ClampBonesInBBox and zeroes the roll component of the view angle only for the duration of the bone build, then restores it. This stops the lean and extended roll desync exploit at the exact point the server uses it. A simple usercmd roll zeroing also runs in OnPlayerRunCmd as a second layer.

• sm_essentials_roll (1): enable the roll fix.
• sm_essentials_roll_warn (0): print a chat warning when roll is detected and punishment is off.

Roll freeze

After a player sends five consecutive command ticks with a roll greater than ten degrees, they are flagged as confirmed and frozen in place while they keep rolling. The freeze releases shortly after they stop. Alerts climb step by step from 1 of 5 up to 5 of 5, where the fifth alert is the confirmed detection.

• sm_essentials_roll_punish (1): freeze confirmed roll users.

Lag peek and defensive anti-aim

Detours RecordDataIntoTrack and corrects the entity simulation time for confirmed tick manipulators, so a defensive peeker cannot sit in the past and dodge bullets. A player is only corrected when their command tick runs far ahead of the server tick (deliberate manipulation), they are moving, and they are not currently firing. This keeps doubletap and normal fakelag working, since both are excluded by the not recently fired check and the tick offset gate.

The correction is server side. The cheater sees no change on their own screen. To check it works, have a second player shoot a defensive peeker, or watch the correction counter in sm_ess_status.

Be honest with your expectations here. This is not a perfect fix. It tries to drag the manipulated simulation time back to the present, but defensive anti-aim has many variants and some will slip through or only be partly corrected. Visually nothing will look different, and on some setups it may not appear to do anything at all. Treat it as a best effort mitigation that you should test on your own server with your own cheats, not a guaranteed block. Detection through the alert feed is the reliable part. The correction is experimental, which is why it ships disabled by default.

• sm_essentials_lag_peek (0): enable the simulation time correction.

Untrusted angles

Clamps view angles to engine valid ranges and rejects non finite values. Pitch is clamped to plus or minus 89, yaw to plus or minus 180, roll to plus or minus 90. NaN and infinity are caught before any arithmetic, so a malformed angle cannot pass through or hang the server.

• sm_essentials_unstrusted_angles (1): enable clamping.
• sm_essentials_unstrusted_angles_warn (1): warn players who repeatedly send untrusted angles.

Normalize angles

Wraps the yaw angle back into the range minus 180 to 180 using a closed form normalization that handles all magnitudes.

• sm_essentials_normalize_angles (0): enable yaw normalization.

Fake duck

Detects rapid duck toggling (the fake duck or duck peek exploit) by counting fast transitions of the duck button and forces a consistent duck state once the threshold is reached.

• sm_essentials_fd (0): enable fake duck blocking.
• sm_essentials_fd_warn (0): warn the player in chat.

Air stuck

Detects players frozen in mid air. A player is flagged when they have no ground entity, are not on a ladder or in noclip, and hold zero velocity for a sustained number of ticks. This is state based and never rewrites the command tickcount, so it cannot affect doubletap. The slay action is opt in.

• sm_essentials_airstuck (1): enable detection.
• sm_essentials_airstuck_slay (0): slay confirmed air stuck players.
• sm_essentials_airstuck_warn (0): warn the player before the slay.

Latency management

Checks every player once per second and warns players whose outgoing latency exceeds the limit. After enough warnings, the player is moved to spectators. Latency is read from the outgoing flow only, which matches the in game ping rather than doubling it.

• sm_essentials_max_latency (200): maximum allowed latency in milliseconds. Range 100 to 1000.
• sm_essentials_max_latency_warnings (10): warnings before a move to spectators. Range 1 to 100.

Admin commands

All commands require the generic admin flag (ADMFLAG_GENERIC). The sm_ prefix also responds to the ! and / chat triggers.

sm_alerts

Toggles the alert feed for the calling admin. Muted state is remembered for three minutes after disconnect, so a quick reconnect keeps it.

Usage: sm_alerts

sm_alert

Shows the full recorded log of a single alert: player name and SteamID, what it was detected for, the trigger count against the threshold, confidence, view angles, ping, team, and time.

Usage: sm_alert <id>

Arguments:

• <id>: the alert number shown at the end of an alert line, for example #312.

sm_ess_status

Prints the on or off state of every feature, the alert count for the current map, and the number of defensive corrections applied.

Usage: sm_ess_status

sm_ess_alerts

Lists the most recent alerts for the current map with their id, player, category, and confidence. Use sm_alert <id> to expand one.

Usage: sm_ess_alerts

sm_ess_settings

Opens the settings menu. Each row toggles a feature on or off and the menu reopens on the same page after a change.

Usage: sm_ess_settings

Alerts

When a detection is confirmed the plugin records it and sends a line to every admin who has not muted alerts. A line looks like this:

ALERTS - Player dragos detected using roll angles (45 deg) (5/5, 100%) #312

• The wording is "suspected of" while confidence is below 100 percent and "detected using" at 100 percent.
• The trailing number is the alert id. Pass it to sm_alert for the full log.
• Alerts and ids reset at the end of every map.

Configuration reference

sm_essentials_ax                       1     Move cl_lagcompensation 0 users to spectators
sm_essentials_warn_ax                  1     Warn anti-exploit players
sm_essentials_force_lagcomp            1     Transparently force lag compensation
sm_essentials_roll                     1     Roll anti-aim fix
sm_essentials_roll_warn                0     Warn on roll detection
sm_essentials_roll_punish              1     Freeze confirmed roll users
sm_essentials_lag_peek                 0     Correct defensive anti-aim simulation time
sm_essentials_unstrusted_angles        1     Block untrusted angles
sm_essentials_unstrusted_angles_warn   1     Warn on untrusted angles
sm_essentials_normalize_angles         0     Normalize yaw
sm_essentials_fd                       0     Block fake duck
sm_essentials_fd_warn                  0     Warn on fake duck
sm_essentials_airstuck                 1     Air stuck detection
sm_essentials_airstuck_slay            0     Slay confirmed air stuck
sm_essentials_airstuck_warn            0     Warn before air stuck slay
sm_essentials_max_latency              200   Max latency in milliseconds
sm_essentials_max_latency_warnings     10    Warnings before move to spectators

Developer API

Other plugins can read detections and reconfigure every feature at runtime through include/essentials.inc, with no console variable access.

Every detection and feature is identified by an enum:

enum EssentialsFeature
{
    EssFeature_ForceLagComp = 0,
    EssFeature_AntiExploit,
    EssFeature_RollFix,
    EssFeature_RollFreeze,
    EssFeature_LagPeek,
    EssFeature_UntrustedAngles,
    EssFeature_NormalizeAngles,
    EssFeature_FakeDuck,
    EssFeature_AirStuck,
    EssFeature_AirStuckSlay,
    EssFeature_Latency,
    EssFeature_Count
};

Forward

forward void Essentials_OnAlert(int client, EssentialsFeature feature, const char[] category, int trigger, int maxAction, float confidence);

Fires once for every alert, including each step of a climbing detection (for example roll at 1 of 5, then 2 of 5, and so on up to 5 of 5). feature is the typed detection, category is the human readable string shown in chat, trigger and maxAction are the current count and its threshold, and confidence runs from 0.0 to 100.0. A confidence of 100.0 means a confirmed detection rather than a suspicion.

Every native below is documented inside essentials.inc, so a SourcePawn aware editor shows the description, parameters and return value as you type.

Per client state

Read what a player is doing right now, by client index.

• Essentials_IsManipulating(client) is true while the client sends a command tick far ahead of the server, which is the signal behind defensive anti-aim and doubletap charging.
• Essentials_IsRolling(client) is true once the client is a confirmed roll user and stays true until the roll session re-arms.
• Essentials_IsFrozen(client) is true while the client is movement frozen by the roll punishment.

Feature configuration

Read and change any feature at runtime, with no console variable access. The EssentialsFeature value selects the feature.

• Essentials_IsFeatureEnabled(feature) returns the on or off state. Features without a toggle, such as latency, always report true.
• Essentials_SetFeatureEnabled(feature, enabled) turns a feature on or off.
• Essentials_GetTrigger(feature) returns the current threshold, or -1 if the feature has no adjustable trigger.
• Essentials_SetTrigger(feature, value) sets the threshold. The value is clamped to the feature range, and the native returns false if the feature has no trigger.
• Essentials_GetFeatureName(feature, buffer, maxlen) copies the display name.

Alert inspection

Every alert is stored for the current map with a 1 based id, the same number shown at the end of an alert line and passed to sm_alert. Ids reset on map change. Any getter that takes an id returns a safe value (false, -1, or 0) for an unknown id, so you do not need to range check first.

• Essentials_GetAlertCount() returns how many alerts exist this map.
• Essentials_GetAlertClient(id) returns the current client index, 0 if the player has left, or -1 for an invalid id.
• Essentials_GetAlertFeature(id) returns the feature that produced the alert.
• Essentials_GetAlertCategory(id, buffer, maxlen) copies the category string.
• Essentials_GetAlertSteamId(id, buffer, maxlen) copies the Steam2 id recorded at detection time, useful after the player has left.
• Essentials_GetAlertTrigger(id) and Essentials_GetAlertMaxAction(id) return the count and the threshold.
• Essentials_GetAlertConfidence(id) returns the confidence percent from 0 to 100.
• Essentials_GetAlertAngles(id, angles) fills a three float vector with the recorded eye angles in pitch, yaw, roll order.
• Essentials_GetAlertPing(id) returns the recorded ping in milliseconds.
• Essentials_GetAlertTime(id) returns the unix timestamp of the alert.

Examples

React to detections and reconfigure features:

#include <essentials>

public void OnPluginStart()
{
    // Make roll confirmation stricter and turn fake duck blocking on.
    Essentials_SetTrigger(EssFeature_RollFreeze, 3);
    Essentials_SetFeatureEnabled(EssFeature_FakeDuck, true);
}

public void Essentials_OnAlert(int client, EssentialsFeature feature, const char[] category, int trigger, int maxAction, float confidence)
{
    if (confidence >= 100.0)
        LogMessage("essentials confirmed %N for %s", client, category);
}

Read a stored alert back by id:

void PrintAlert(int id)
{
    char category[64], steamid[32];
    float angles[3];

    Essentials_GetAlertCategory(id, category, sizeof(category));
    Essentials_GetAlertSteamId(id, steamid, sizeof(steamid));
    Essentials_GetAlertAngles(id, angles);

    PrintToServer("alert #%d: %s (%s) at %d%% angles %.1f %.1f %.1f",
        id, category, steamid, Essentials_GetAlertConfidence(id),
        angles[0], angles[1], angles[2]);
}