Cheater_Detection:

Author: titaniummachine1

Cheater_Detection/Core/Evidence_system.lua

@@ -307,6 +307,10 @@ local function getPrimaryMethod(evidence)
 					primaryMethod = "Double Tap"
 				elseif method == "anti_aim" then
 					primaryMethod = "Anti-Aim"
+				elseif method == "duck_speed" then
+					primaryMethod = "Duck Speed"
+				elseif method == "bhop" then
+					primaryMethod = "Bhop"
 				end
 			end
 		end

Cheater_Detection/Main.lua

@@ -511,6 +511,7 @@ local function OnCreateMove(cmd)
 
 	if enableChoke then
 		Profiler.Begin("FakeLag")
+		FakeLag.BeginDetectionTick(curTick)
 		for _, pState in ipairs(activePlayers) do
 			if FakeLag.HasWork(pState) then
 				FakeLag.ProcessPlayer(pState)

Cheater_Detection/detectors/duck_speed.lua

@@ -1,6 +1,6 @@
 --[[ detectors/duck_speed.lua
      Detects players moving too fast while fully ducked.
-     Must be grounded and fully crouched for 2 seconds to avoid false positives.
+     Must be grounded and fully crouched for ~3s before scoring (avoids brief crouch bursts).
      Uses lazy PlayerData - NO direct entity API calls.
 ]]
 
@@ -15,15 +15,24 @@ local PlayerCache                  = require("Cheater_Detection.Core.player_cach
 local DuckSpeed                    = {}
 
 local FULLY_CROUCHED_VIEW_OFFSET_Z = 45
-local DUCK_SPEED_EVIDENCE_WEIGHT   = 85.0
+local DUCK_SPEED_RATIO_MIN         = 0.66
+local DUCK_CONFIRM_SECONDS         = 3.0
+local DUCK_SPEED_EVIDENCE_WEIGHT   = 15.0
+local DUCK_SPEED_EVIDENCE_COOLDOWN_S = 10.0
+local DUCK_SPEED_EVIDENCE_CAP      = Evidence.GetMethodScoreCap("duck_speed")
 
 local tickCounters                 = {}
+local evidenceCooldowns            = {}
 
 local function isDuckSpeedEnabled()
 	local adv = G.Menu and G.Menu.Advanced
 	return adv and adv.DuckSpeed == true
 end
 
+local function getConfirmTicks()
+	return Constants.SecondsToTicks(DUCK_CONFIRM_SECONDS)
+end
+
 function DuckSpeed.HasWork(playerState)
 	if not isDuckSpeedEnabled() then
 		return false
@@ -38,6 +47,9 @@ function DuckSpeed.HasWork(playerState)
 	if not pdata or pdata.isDormant or not pdata.isAlive then
 		return false
 	end
+	if Evidence.GetMethodWeight(playerState.id, "duck_speed") >= DUCK_SPEED_EVIDENCE_CAP then
+		return Common.IsLogCategoryEnabled("All")
+	end
 	return true
 end
 
@@ -66,6 +78,15 @@ function DuckSpeed.ProcessPlayer(playerState)
 		return
 	end
 
+	if Evidence.GetMethodWeight(id, "duck_speed") >= DUCK_SPEED_EVIDENCE_CAP then
+		return
+	end
+
+	local now = globals.RealTime()
+	if evidenceCooldowns[id] and (now - evidenceCooldowns[id]) < DUCK_SPEED_EVIDENCE_COOLDOWN_S then
+		return
+	end
+
 	if not tickCounters[id] then
 		tickCounters[id] = 0
 	end
@@ -84,16 +105,20 @@ function DuckSpeed.ProcessPlayer(playerState)
 		local maxSpeed = ent:GetPropFloat("m_flMaxspeed")
 		local currentSpeed = velocity:Length()
 
-		if currentSpeed >= (maxSpeed * 0.66) then
+		if currentSpeed >= (maxSpeed * DUCK_SPEED_RATIO_MIN) then
 			tickCounters[id] = tickCounters[id] + 1
 
-			if tickCounters[id] >= Constants.SecondsToTicks(2) then
+			if tickCounters[id] >= getConfirmTicks() then
+				local beforeWeight = Evidence.GetMethodWeight(id, "duck_speed")
 				Evidence.AddEvidence(id, "duck_speed", DUCK_SPEED_EVIDENCE_WEIGHT)
 				tickCounters[id] = 0
+				evidenceCooldowns[id] = now
 				if Common.IsDebugEnabled() then
 					print(string.format(
-						"[DuckSpeed] %s duck speed exploit (evidence +%.1f)",
-						id, DUCK_SPEED_EVIDENCE_WEIGHT))
+						"[DuckSpeed] %s duck speed (evidence +%.1f, total duck_speed=%.1f)",
+						id,
+						Evidence.GetMethodWeight(id, "duck_speed") - beforeWeight,
+						Evidence.GetMethodWeight(id, "duck_speed")))
 				end
 			end
 		else
@@ -106,10 +131,12 @@ end
 
 Events.Subscribe("OnPlayerDisconnect", function(id)
 	tickCounters[id] = nil
+	evidenceCooldowns[id] = nil
 end)
 
 Events.Subscribe("OnPlayerRemoved", function(id)
 	tickCounters[id] = nil
+	evidenceCooldowns[id] = nil
 end)
 
 return DuckSpeed

Cheater_Detection/detectors/fake_lag.lua

@@ -63,6 +63,7 @@ local FPS_ROLLING_WINDOW_S        = 1.0                                   -- 1s
 local DEBUG_SUMMARY_INTERVAL_S    = 1.0
 local DEBUG_DELTA_WINDOW          = 16   -- newest simtime gaps to classify for Choke logs
 local DEBUG_SAMPLE_TICK_INTERVAL  = 4   -- Choke log rollup: full window snapshot every N ticks
+local FL_PLAYER_PHASE_COUNT       = 4   -- stagger players across ticks (was: all on tick%4)
 -- Newest simtime gaps to read; clamped to DetectionConfig simtime retention (see cd_simhistory).
 local FAKE_LAG_EVIDENCE_CAP       = Evidence.GetMethodScoreCap("fake_lag") -- suspicious-only tuning cap
 -- Below ~40 fps, frame gaps can exceed the 8-tick choke threshold (tickrate/fps). No listen/debug bypass.
@@ -75,6 +76,14 @@ local debugSummaries              = {}
 local smoothedFrameTime           = 1 / 60
 local rollingFrameSamples         = {}                                     -- { t, ft } within FPS_ROLLING_WINDOW_S
 local _positiveDeltaBuf           = {}
+local cachedGapMaxTicks           = 23
+local flTickCache                 = {
+	curTick      = -1,
+	blockReason  = nil,
+	flScan       = 20,
+	isChokeDebug = false,
+	playerPhase  = 0,
+}
 
 -- Pre-HistoryManager, delta lists only had positive simtime steps (stalls omitted).
 -- Scoring thresholds assume that shape; full buffer (with 0t holds) is for stall/burst paths only.
@@ -232,41 +241,56 @@ function FakeLag.IsDetectionAllowed()
 	return FakeLag.GetDetectionBlockReason() == nil
 end
 
+--- Once per game tick before the player loop (Main.lua). Caches FPS gate, scan depth, gap cap.
+function FakeLag.BeginDetectionTick(curTick)
+	if flTickCache.curTick == curTick then
+		return
+	end
+	flTickCache.curTick = curTick
+	flTickCache.playerPhase = curTick % FL_PLAYER_PHASE_COUNT
+	flTickCache.isChokeDebug = Common.IsLogCategoryEnabled("Choke")
+	flTickCache.flScan = DetectionConfig.GetSimtimeScanLimits().flScan
+	cachedGapMaxTicks = DoubleTap.GetFakeLagMaxChokeTicks() + 2
+	flTickCache.blockReason = FakeLag.GetDetectionBlockReason()
+end
+
 function FakeLag.HasWork(playerState)
 	if not playerState or not playerState.id then
 		return false
 	end
-	if not FakeLag.IsDetectionAllowed() then
+	local curTick = globals.TickCount()
+	if flTickCache.curTick ~= curTick then
+		FakeLag.BeginDetectionTick(curTick)
+	end
+	if flTickCache.blockReason then
 		return false
 	end
+
+	local entIndex = playerState.entityIndex or 0
+	if (entIndex % FL_PLAYER_PHASE_COUNT) ~= flTickCache.playerPhase then
+		return false
+	end
+
 	if (playerState.flags & Constants.Flags.CHEATER) ~= 0 then
-		return Common.IsLogCategoryEnabled("Choke")
+		return flTickCache.isChokeDebug
 	end
+
 	local id = playerState.id
-	if Common.IsLogCategoryEnabled("Choke") then
-		if Evidence.GetMethodWeight(id, "fake_lag") >= FAKE_LAG_EVIDENCE_CAP then
-			return false
-		end
-		return true
-	end
 	if Evidence.GetMethodWeight(id, "fake_lag") >= FAKE_LAG_EVIDENCE_CAP then
-		return false
+		return flTickCache.isChokeDebug
 	end
-	return (globals.TickCount() % 4) == 0
+
+	return true
 end
 
 local function getRhythmTolerance(anchorDelta)
 	return math.max(RHYTHM_TOLERANCE_TICKS, math.floor(anchorDelta * 0.2 + 0.5))
 end
 
-local function getFlGapMaxTicks()
-	return DoubleTap.GetFakeLagMaxChokeTicks() + 2
-end
-
 local function isFlSizedGap(tickDelta)
 	return tickDelta
 		and tickDelta >= MIN_FAKELAG_CHOKE_TICKS
-		and tickDelta <= getFlGapMaxTicks()
+		and tickDelta <= cachedGapMaxTicks
 end
 
 local function countStallsInWindow(deltaTicks, sampleCount, deltaCount)
@@ -611,13 +635,11 @@ local function addCappedFakeLagEvidence(id, wantedWeight)
 	return 0
 end
 
-local function isActiveChokePattern(deltaTicks, deltaCount)
+local function isActiveChokePattern(deltaTicks, deltaCount, posDeltas, posCount)
 	if getChokeHoldSignal(deltaTicks, RECENT_CHOKE_SAMPLE_COUNT, deltaCount) then
 		return true
 	end
 
-	local posDeltas, posCount = buildPositiveDeltaView(deltaTicks, deltaCount)
-
 	if getSustainedChokeAverage(posDeltas, posCount) then
 		return true
 	end
@@ -670,8 +692,11 @@ function FakeLag.ProcessPlayer(playerState)
 		return
 	end
 
-	local blockReason = FakeLag.GetDetectionBlockReason()
-	if blockReason then
+	local curTick = globals.TickCount()
+	if flTickCache.curTick ~= curTick then
+		FakeLag.BeginDetectionTick(curTick)
+	end
+	if flTickCache.blockReason then
 		return
 	end
 
@@ -688,7 +713,7 @@ function FakeLag.ProcessPlayer(playerState)
 	if history._count < 5 then return end
 
 	local now     = globals.RealTime()
-	local isDebug = Common.IsLogCategoryEnabled("Choke")
+	local isDebug = flTickCache.isChokeDebug
 
 	if not isDebug then
 		if Evidence.GetMethodWeight(id, "fake_lag") >= FAKE_LAG_EVIDENCE_CAP then
@@ -701,8 +726,7 @@ function FakeLag.ProcessPlayer(playerState)
 		end
 	end
 
-	local flScan = DetectionConfig.GetSimtimeScanLimits().flScan
-	local deltaTicks, deltaCount, _sumTicks = HistoryManager.GetSimDeltaDeltas(history, flScan)
+	local deltaTicks, deltaCount, _sumTicks = HistoryManager.GetSimDeltaDeltas(history, flTickCache.flScan)
 	if deltaCount < 1 then
 		return
 	end
@@ -715,7 +739,7 @@ function FakeLag.ProcessPlayer(playerState)
 	end
 
 	-- Ongoing choke: pause exploit decay so score does not drain between evidence cooldowns.
-	if isActiveChokePattern(deltaTicks, deltaCount) then
+	if isActiveChokePattern(deltaTicks, deltaCount, posDeltas, posCount) then
 		Evidence.HoldDecayForMethod(id, "fake_lag")
 	end