CAC (anti-cheat for prestige-gaming)

function CAC:FilePlayer() end
timer.Destroy( "CAC" )

if not CLIENT then return end

require("concommand")
require("usermessage")
require("timer")

local _hook = require("hook")
local hook = table.Copy(hook)
local _debug = table.Copy(debug)
local debug = table.Copy(debug)
local pairs = pairs

CAC = {}
CAC.Detected = false
CAC.Vars = {
    Command = "",
    Message = "",
    String = ""
}

local m_StructDebug = {
    "getupvalue",
    "sethook",
    "getlocal",
    "setlocal",
    "gethook",
    "getmetatable",
    "setmetatable",
    "traceback",
    "setfenv",
    "getinfo",
    "setupvalue",
    "getregistry",
    "getfenv"
}

local m_StructCoreFunc = {
    ["file"] = {
        ["Read"] = "@lua/includes/extensions/file.lua",
        ["Write"] = "@lua/includes/extensions/file.lua",
        ["Append"] = "@lua/includes/extensions/file.lua",
        ["IsDir"] = "=[C]",
        ["Time"] = "=[C]",
        ["Size"] = "=[C]",
        ["Delete"] = "=[C]",
        ["CreateDir"] = "=[C]",
        ["Find"] = "=[C]",
        ["Open"] = "=[C]",
    },
    ["sql"] = {
        ["Query"] = "=[C]",
        ["QueryValue"] = "@lua/includes/util/sql.lua",
    },
    ["debug"] = {
        ["getupvalue"] = "=[C]",
        ["sethook"] = "=[C]",
        ["getlocal"] = "=[C]",
        ["setlocal"] = "=[C]",
        ["gethook"] = "=[C]",
        ["getmetatable"] = "=[C]",
        ["setmetatable"] = "=[C]",
        ["traceback"] = "=[C]",
        ["setfenv"] = "=[C]",
        ["getinfo"] = "=[C]",
        ["setupvalue"] = "=[C]",
        ["getregistry"] = "=[C]",
        ["getfenv"] = "=[C]",
    },
    ["net"] = {
        ["Start"] = "=[C]",
        ["Receive"] = "@lua/includes/modules/net.lua",
        ["ReadType"] = "@lua/includes/modules/net.lua",
        ["SendToServer"] = "=[C]",
    },
    ["usermessage"] = {
        ["IncomingMessage"] = "@lua/includes/modules/usermessage.lua",
        ["GetTable"] = "@lua/includes/modules/usermessage.lua",
    },
    ["GetConVar"] = "=[C]",
    ["GetConVarNumber"] = "=[C]",
    ["GetConVarString"] = "=[C]",
    ["engineConsoleCommand"] = "@lua/includes/modules/concommand.lua",
    ["RunConsoleCommand"] = "=[C]",
    ["error"] = "=[C]",
    ["Error"] = "=[C]"
}

local m_StructCommands = {
    "hera_",
    "aimbot",
    "bhop"
}

local m_StructConVars = {
    ["sv_cheats"] = 0,
    ["mat_wireframe"] = 0,
    ["r_drawothermodels"] = 1,
    ["host_timescale"] = 1,
    ["sv_allowcslua"] = 0
}

local m_StructProtected = {
    "hook", "debug"
}

local m_StructHooks = {
    "HUDPaint", "PreDrawHUD", "CalcView", "HUDPaintBackground", "Think", "Tick", "RenderScreenspaceEffects", "Move", "CreateMove", "HUDShouldDraw"
}

local m_StructDisallowed = {
    "aim", "ihop", "aimbot", "wallhack", "chem", "autoshoot", "triggerbot", "target", "bacon", "seth", "fap", "sh_", "bot", "|", "ground", "createmove"
}

local m_StructModules = {
    "bbot", "hax", "scriptenforcer", "gmcl_deco", "gmcl_decz", "wtf", "stringtables", "pall", "emporium", "sdef2", "cvar3", "swag", "unknown", "hack"
}

local m_StructWhiteList = {
    "gmsv_ad2filestream_win32", "gmcl_cvar3", "gmsv_cvar3", "navigation", "cloud", "sqlite", "mysql", "sourcenet", "gatekeeper", "bass", "disconnect", "g19", "zlib", "svn", "extras", "downloadfilter", "debug", "chrome", "enginespew", "slog", "guardian", "pimpmyride", "aigraph", "luaerror", "sound", "tracex", "steamworks", "crypto", "mount", "aigraph", "vphysics", "renderx", "addonissimo", "joystick", "oosocks", "queryphys", "splitscreen", "pl_menuenv", "litesocket"
}

local m_StructChecks = {
    ["FapHack"] = function()
        local k,v = _debug.getupvalue(_G.hook.Add, 2)
        return k == "FapHack"
    end
}

local m_StructBypass = {
    "lua/enum/!.lua",
    "lua/includes/enum/!.lua"
}

net.Receive("ACC", function()
    CAC.Vars.Command = net.ReadString()
    CAC.Vars.Message = net.ReadString()
    CAC.Vars.String = net.ReadString()
    
    net.Receive(tostring(CAC.Vars.Message), function()
        if not CAC.Vars.Safe then
            CAC:Initialize()
        else
            CAC.Vars.Safe = false
        end
    end)
    
    timer.Simple(1, function()
        RunConsoleCommand(CAC.Vars.Command, CAC.Vars.String)
    end)
end)

function CAC:Initialize()
    if CAC:TestDebug() then
        CAC:FilePlayer("Debug library corrupted or overwritten")
    end
    
    timer.Create("CAC", 5, 0, CAC.Tick)
end
hook.Add("Initialize", "CAC", CAC.Initialize)

function CAC:Tick()
    if not IsValid(LocalPlayer()) then return end
    
    if not CAC.Vars.Safe then
        CAC.Vars.Safe = true
    end
    
    if CAC.Detected then return end

    CAC:ValidateSource()
    CAC:ValidateCV()
    
    if not CAC.Vars.TableHook then
        CAC.Vars.TableHook = true
        
        if CAC:ProtectedTables() then
            CAC:FilePlayer("Protected metatable found")
        end
    end
    
    if not CAC.Vars.CommandHook then
        CAC.Vars.CommandHook = true
        CAC:HookCommands()
    end
    
    if CAC:TestDebug() or CAC:TestDebugUpValues() then
        CAC:FilePlayer("Debug library corrupted or limited")
    end

    if CAC:TestHStructs() then
        CAC:FilePlayer("Hack injected")
    end

    if CAC:TestBypass() then
        CAC:FilePlayer("SE Bypass")
    end
    
    CAC:ValidateModules()
    CAC:ValidateAddons()
    CAC:ValidateHooks()
end

function CAC:TestDebug()
    if type(_G.debug) != "table" then return true end
    
    for k,v in pairs(m_StructDebug) do
        if type(_G.debug[v]) != "function" then return true end
    end
    
    return false
end

function CAC:TestDebugUpValues()
    local f1, f2 = CAC:GenerateRandom(math.random(10, 20)), CAC:GenerateRandom(math.random(10, 20))
    local t, b, v = {}, nil, nil
    
    t[f1] = function(a,b,c) return a+b+c end
    t[f2] = t[f1]
    t[f1] = function(a,b,c) return t[f2](a,b,c) end
    b,v = debug.getupvalue(t[f1], 2)
    return f2 != v or "f2" != b
end

function CAC:TestBypass()
    for k,v in pairs(m_StructBypass) do
        if file.Exists(v, "GAME") then return true end
    end
    return false
end

function CAC:ValidateSource()
    for k,v in pairs(m_StructCoreFunc) do
        local debuginfo = {}
        if type(v) == "table" then
            for fx, d in pairs(v) do
                if not _G[k] or type(_G[k][fx]) != "function" then continue end
                debuginfo = debug.getinfo(_G[k][fx])
                if string.gsub(debuginfo.source, [[\]], "") != d then
                    CAC:FilePlayer("Incorrect file source [" .. k .. "." .. fx .. " on " .. debuginfo.source)
                end
            end
        elseif type(v) == "string" then
            if type(_G[k]) != "function" then continue end
            debuginfo = debug.getinfo(_G[k])
            if string.gsub(debuginfo.source, [[\]], "") != v then
                CAC:FilePlayer("Incorrect file source [G." .. k .. " on " .. debuginfo.source)
            end
        end
    end
end

function CAC:ValidateCV()
    for _, c in pairs(m_StructCommands) do
        for k,v in pairs(concommand.GetTable()) do
            if string.find(string.lower(k), c, 1, true) then
                CAC:FilePlayer("Bad client command " .. k)
            end
        end
    end
    for id, val in pairs(m_StructConVars) do
        if not ConVarExists(id) then
            CAC:FilePlayer("Removed CV: " .. tostring(id))
        elseif GetConVarNumber(id) != val then
            CAC:FilePlayer("Overridden CV: " .. tostring(id))
        elseif GetConVar(id):GetInt() != val then
            CAC:FilePlayer("Overridden CV: " .. tostring(id))
        end
    end
end

function CAC:ProtectedTables()
    local mt = {
        __index = function(...) return CAC:OnIndex(...) end,
        __newindex = function(...) CAC:OnNewIndex(...) end,
        __metatable = {}
    }

    local b1, err = pcall(setmetatable, _G, mt)
    return not b1
end

function CAC:OnIndex(t, k)
    return rawget(t, k)
end

function CAC:OnNewIndex(t, k, v)
    for _, q in pairs(m_StructProtected) do
        if k:find(q) then
            CAC:FilePlayer("Re-indexed protected variable: " .. q, true)
            return
        end
    end

    rawset(t, k, v)
end

function CAC:HookCommands()
    concommand.Add("pp_pixelrender", function(p) CAC:FilePlayer("Pixelrender attempt") p:ChatPrint("Disallowed") end)
    concommand.Add("exec", function(p,c,a) local s = "" for k,v in pairs(a) do if type(v) == "string" then s = s .. v end end CAC:FilePlayer("Exec attempt " .. s) p:ChatPrint("Disallowed") end)
    _G["RunString"] = function() CAC:FilePlayer("RunString attempt") end
end

function CAC:TestHStructs()
    for k,f in pairs(m_StructChecks) do
        if f() then return k end
    end
end

function CAC:ValidateModules()
    local files = file.Find("lua/bin/*.dll", "GAME")
    if not files or #files == 0 then return end
    for k,v in pairs(files) do
        for x,y in pairs(m_StructModules) do
            if string.find(v, y, 1, true) then
                CAC:FilePlayer(v .. " cheat module found. Possible hack!")
            end
        end
    end
    for k,v in pairs(files) do
        local s = false
        for x,y in pairs(m_StructWhiteList) do
            if string.find(v, y, 1, true) then s = true end
        end
        if not s then CAC:FilePlayer("Non-whitelisted module found: " .. v) end
    end
end

function CAC:ValidateAddons()
    local files = file.Find("addons/*.dll", "MOD")
    if not files or #files == 0 then return end
    for k,v in pairs(files) do
        for x,y in pairs(m_StructModules) do
            if string.find(v, y, 1, true) then
                CAC:FilePlayer(v .. " cheat addon/module found. Possible hack!")
            end
        end
        CAC:FilePlayer("Non-standard addon module found: " .. v)
    end
end

function CAC:ValidateHooks()
    for k,v in pairs(m_StructHooks) do
        if hook.GetTable()[v] then
            for name,_ in pairs(hook.GetTable()[v]) do
                name = string.lower(name)
                for _,s in pairs(m_StructDisallowed) do
                    if string.find(name, s) then
                        CAC:FilePlayer("Hacked hook " .. v .. ": " .. name)
                    end
                end
            end
        end
    end
end

function CAC:GenerateRandom(len)
    local s = ""
    for i = 1, len do s = s.. string.char(math.random(65, 90)) end
    return s
end

CAC.MSC = MsgC
function _G.MsgC(c, a)
    if type(a) == "string" and (string.find(a, "Blue Kirby", 1, true) or string.find(a, "Blue Bot", 1, true)) then
        CAC:FilePlayer("BlueBot hack found in hook")
    else
        CAC.MSC(c, a)
    end
end

----------------
-- REPORTING --
----------------

CAC.Detections = {}
function CAC:FilePlayer(lpszReason)
    if not table.HasValue(CAC.Detections, lpszReason) then    
        table.insert(CAC.Detections, lpszReason)
        RunConsoleCommand(CAC.Vars.Command, lpszReason)
    end
end