Why cheaters in Dota 2 are not getting banned: a detailed explanation of why cheats are safe
Good afternoon, everyone. Today we’re talking about something that affects all Dota 2 players in one way or another: whether Valve bans cheaters and what methods they use to do it.
My opinion is based on official statistics and tons of experience playing with cheats, as well as reverse engineering VAC. For ease of reading, I will divide the article into the following main sections: a brief explanation of how cheats work (how they became game assistants), official statistics on bans, what methods Valve uses to detect cheats and how modern cheats circumvent them, and a brief summary of why cheaters in Dota are not banned and why it is worth trying them.
What features do modern cheats have?
There have always been very few cheats for Dota, and now there is essentially only one that I have been playing with for 6 years — Melonity (link is clickable).
This is due to the complexity of their creation. While a simple aimbot is sufficient for FPS games, Dota, the most prominent representative of MOBA games, requires an individual approach.
I won’t go into details, but I’ll give a general overview of the current features. My profile already has an article entirely dedicated to the functionality of cheats, which I highly recommend reading.
Scripts
The basis of any cheat is scripts. They automate your actions, pressing buttons on heroes, sending illusions to farm, stopping, and automatically adding creeps.
Today, they are mainly written in TypeScript and automate almost every mechanic in the game. For convenience, I will include maphack here — a script that displays the enemy’s position in the fog of war (currently, it gives approximate positions, but even so, it is one of the most powerful tools), as well as the very same abuse armlet on Huskar, which makes you immortal. They should not be underestimated, as they take into account the maximum possible number of game scenarios and diverse information, including the skills of your teammates and opponents, in order to work as accurately as possible and eliminate any possibility of ruin.
This alone requires a large team of very talented developers who will translate all of this into code. However, in order for all these scripts to work, you need an interface that meets all modern ui/ux standards, a launcher, and a way to SAFELY implement all these scripts into the game, but more on that later.
Due to the huge number of mechanics in Dota, cheats & hacks have now become more like tools that help players by displaying a lot of useful information on the screen (Roshan timer, runes that have appeared, smoke used, as well as the amount of HP, MP, and skill cooldowns for players; the list goes on and on).
All this together does not guarantee your victory, but it raises the level of the game by several levels and lowers its entry threshold. Of course, this does not mean that you will not be able to destroy all opponents on your own, but to do this, you will need to learn how to use the Melonity cheat tool correctly.
Visual information
This includes everything that is displayed by cheats in visual ways, such as vbe (visible by enemy indicator), which highlights a character if they are in the enemy’s field of vision, as well as the radii of ability application.
You can read more about other cheat functions in my article at this link.
However, I would like to highlight one feature that made Dota so appealing to me — Camera Hack. It may seem like a simple camera zoom, but it helps and simplifies gameplay so much that after using it, you start to believe in humanity again. Especially since Melonity.gg has implemented it in the most convenient and secure way possible.
How Valve fights cheaters?
First, it is worth dispelling the common misconception that developers have failed to adequately protect the game and are not taking any measures — this is fundamentally incorrect. Trust me, Valve has one of the most advanced anti-cheat systems of its kind and a system for removing cheaters to separate lobbies. This is partly why there is essentially only one cheat available right now, where highly competent specialists have been working for over 10 years to protect their users from all possible bans.
Valve Anti Cheat
VAC is a server-side anti-cheat program that operates at the user software level, so it cannot track programs that masquerade as drivers or run in the BIOS. This is its most significant limitation, which is simply due to the level at which it operates. Most anti-cheats operate at this level, with the exception of those that run in the BIOS and are located at the system kernel level, such as Vanguard.
Anti-cheats that operate at the system level are questionable because they have access to the entire computer and all the files on it, and nothing prevents them from analyzing your photos, for example. In addition to obvious privacy issues, this creates problems with its versatility. Very often, such anti-cheats cause conflicts within the system, because even other anti-cheats find them highly suspicious. You are probably familiar with this problem, Many games do not allow you to enter them while Vanguard is running, which has forced me to restart my computer more than once.
Obviously, Valve could create such an anti-cheat program, but for the sake of versatility, they chose a different path: in-depth server checks and a neural network.
It is standard practice for VAC to protect against cheats until they are implemented in the game. Active programs on the computer, the integrity of the game’s source code, etc. are checked. It is clear that all of this can be bypassed.
Server checks
Server checks are VAC modules that are loaded onto Valve’s official servers and check the data returned by players in real time to detect suspicious activity on the part of players.
It’s not hard to imagine what data Valve checks: speed, net worth, damage, mouse and keyboard commands.
The entire VACnet is based on these server checks, which are trained on data from millions of users and have a rough idea of what a person is capable of in terms of reaction time, button press speed, etc. Obviously, there are some conditional constants, for example, a person cannot fire an entire magazine in CS2 in one second, so when VAC sees such data from a player on the server, it instantly bans them.
Overall, such a system is a brilliant, technically complex solution that can compensate for the shortcomings of user-mode anti-cheats. It is worth noting that, as with any neural network, hallucinations can occur or false positives can happen, so they approach this with caution.
However, there are also brilliant engineers working on cheats like Melonity who have been able to get around this.
By the way, if you’d like to try cheats for CS2, Deadlock, or other games available on Steam without worrying about your account, I recommend this cheat store for CS2, Deadlock, and other games. I personally vouch for it.
How modern cheats & hacks in Dota bypass neural networks
As has already become clear, cheaters learned how to bypass such checks almost immediately, but this requires fairly deep technical knowledge on par with Valve engineers themselves.
The stumbling block in this matter is the humanizer, a system that is deeply integrated into the cheat itself and each of its functions, which creates the appearance for the server that a player with a cheat is actually playing without it.
How does it work?
Himanizer is an extremely complex system of mathematical algorithms that were created after a thorough analysis of all Valve checks (the developers’ capabilities in terms of the data collected were also analyzed, so all potential detection vectors are implemented in them), but if I try to simplify it for the average person to understand, I would try to describe it using the simplest examples of how it works.
Let’s take mouse orders as a basis. Scripts, such as those that control illusions, constantly click and control each illusion separately. For the server, this may seem strange, because a person clicks on the map and switches between illusions in a fraction of a second, and also manages to control the hero. To do this, the humanizer creates micro-delays in keystrokes, clicks on random places, and performs the actions that ordinary people perform (very similar to how vac live works, right?). In this way, the server is fooled, and what can we say, sometimes even to the human eye, such gameplay looks normal.
However, there is also a camera in Dota that displays an image with a fixed field of view on the screen. Its position is fixed to the player and always follows them, but in Dota, the entire map is always rendered at once, and the camera position can be changed using the aforementioned Camera Hack.
The camera position is also sent to the server, so it is quite a difficult task to make it think that the value is within the normal range when you can see the entire map in front of you at once, but the humanizer does it perfectly.
This video clearly shows how himanizer interacts with the camera and mouse commands, hiding them from the server.
How to check if a user has been flagged by vac-live?
It’s very simple — you can check this using the patrol interface. If one user has more flags set than there are players in the lobby, then it means that everyone else has been flagged by the anti-cheat system itself. Using this, even without analyzing the VAC source code (you can look at it yourself), it is possible to understand what exactly it pays attention to.
Overview
In conclusion, I want to say that cheats for Dota are not like cheats in any other game. Valve has worked very hard and I would call them successful in their field, because apart from Melonity, there are simply no safe and time-tested cheats for Dota, which is quite a good indicator.
Read my other articles on my profile and subscribe. There is a lot of useful information there, not only about Dota 2, but also about CS2. It is possible that in the future I will turn my attention to other games.
For those who are interested in discovering Dota 2 in a new way and starting to enjoy the game, follow my link above and get a free 10-day trial period, or enter melonity.gg in the search bar. Thank you all, see you soon!
