How to determine if a mouse click is legal or automatic?

Question

How do I know if a mouse click is being modeled or not? When a mouse click is sent by a program or a real mouse device

... I program system detection for the game to avoid bots, auto-clicks, etc. that only accept left-clicks

Answer 1

It depends a little on the type of application you are writing, but if you can, I would look at the movement of the cursor, not the click. The movement of the human mouse has non-uniform speeds, reaction time, inaccuracies (clicks on different coordinates of your buttons, etc.).

In addition, you can protect gui from bots by arbitrarily requiring interaction, which is difficult for the script. For example: if the scripts depend on the fact that the buttons are always in the same position, I would make sure that, trying to remain intuitive, the dialog should appear in several different positions each time.

Otherwise: there is no way to determine if the mouse is real or really well modeled. The Windows HID / MacOS / Linux driver layer abstracts the difference between Mice, TrackPens, TrackBalls, draw-pad, touch screens ... and, of course, script -mice ...

Answer 2

Despite the fact that the blog post is related to another issue, I am sending you to Raymond Chen excellent Old New Thing . In this particular blog post, he talks about the validity of the parameters of the posts included in the application, but also indicates that:

It makes no sense to discuss the possibility that the sender of the message plays tricks and lies to you, because (1) your program should just combine with the trick and respond to fake menu messages, as if they were real menu messages, because (2) there is no way to say that you still lie. To detect lies, you would have to read in the minds of the programmer who sent you the message.

Essentially, the argument is that you should respond to mouse clicks like mouse clicks, regardless of how these clicks were generated.

Answer 3

Are simulated mouse keys or legal? The point of modeling mouse input is to make them look like real mouse input. If the simulation does its job, your job is impossible . Sorry, this blessing and curse software is for you. Here are some more imperfect ideas:

• Use GetKeyboardState and verify that the button states are correct. If the message faker uses PostMessage , they most likely will not set the keyboard state, and this will mean fakery.
• If you focus on well-known applications that perform input modeling, discover them and complain. This is not entirely for many reasons.
• Fuzzy logic, like many other people.

You need to be creative and find out the difference between a simulated event and a real one for you , since there is no generalized answer.

Answer 4

The question is a bit subtle in detail.

Events can be sent directly to the controls without moving the mouse, so find out where the mouse is when you receive a click event and see if it is on the control. Keyboard input requires focus control, so check this as well.

In situations where the mouse moves, you will not be able to detect, record and play back the mouse movement. If its a script, perhaps you could control the mouse behavior in the parent panel (s) of the control and use these events and movements to make sure that it is real or not. An automatic click can appear out of nowhere and cause a flurry of unlikely guidance, focus on events.

Answer 5

Only in this way would it be possible with the help of some special equipment and software on the mouse itself, which sends evidence of the actual mechanical click. Using software is not possible.

Answer 6

Although in my other answer I mention that, ideally, you should just respond to clicks as clicks, there is one possibility that may work, depending on how the “software” click is created.

I assume the Windows platform because of the "vb.net" tag:

Using WinAPI, you can send a message to any window to simulate, for example, the WM_LBUTTONDOWN event. In this message, you must indicate the location of the X and Y mouse at the moment you click the button - or where the receiving program is waiting. When you process the message, you can use the GetCursorPos call to get the actual cursor position. Make sure that the current position is close to that indicated in the message, and treat it like a click, otherwise ignore it.

Remember, however, that the nature of the message queue is such that it may take some time to process the event, and the mouse can go a long way in a short amount of time.

This solution will only work if a "click" is created by a simple Send / PostMessage. If the application that generates the click simulates mouse movement, then you should probably see other answers :)

Answer 7

This cannot be done (reliably (with software anyway))

I used WIN32API calls to read pixels / manipulate mouse clicks / send to automate large parts of video games and other repetitive tasks. You could write a lot of code to analyze input, but equally smart developers are just about to change their code to fit.

When I first try to automate a mouse click, all I will do. Send a mouse click. And most of the time it works. You may have a code that tracks mouse movement and the entire stack of mouse events that will fire along with a legitimate click and say: “It was not real, we ignore it,” but nothing prevents the developer from making mouse movements.

Mouse events are more complex than keystrokes; but this is essentially the same idea. If you write code that controls the time between keystrokes and determines that I send the "2" key to your application in EXACTLY 250 ms, you may decide that I am a bot. But all I will do is change my code to send a keystroke in 250 ms + random value between -25 and 25 ms.

This is an endless cat and mouse game. The best solution is to make tasks non-trivial, so simple forms of automation are not applicable.

Answer 8

I am not sure that there is a way to determine with full accuracy whether there will be an automatic mouse click or not. I mean, you could write your own USB driver, which is located between the mouse driver and the operating system and transmits only "real" clicks. However, even this can be defeated by connecting a USB device (for example, a smartphone) that is programmed to send USB packets to the host computer.

What are you trying to accomplish, why do you need to distinguish between real mouse clicks and fake?

Answer 9

Create a statistical training solution by registering the latest mouse events in your program. When the user clicks on the control, determine the probability based on the last X actions that he really clicked.

Train your solution with real clicks and lots of automated scripts.

This is obviously not a guaranteed solution for work and more for fun than anything else.

Answer 10

This is much more complicated than you think, because the input macro programs in your game create legal I / O and keyboard messages. I don’t think there is a way to check if the input message is really caused by physical hardware input (for example, a mouse or keyboard) if the OS does not provide you with the input driver level availability.

Since this is specifically for the game, you can see how other games handle this situation. Some of the common methods are:

• Check your mouse click rate . (people cannot click as fast as programs.)

• At random points or in case of doubt, use CAPTCHA to check. (Read this: http://www.threadmeters.com/v-1Vvd/CAPTCHA_The_Obvious_AntiBot_Solution/ )

• Use external monitoring tools to check all processes running on the machine to find programs known for the purpose of cheating. Par does it. Check out the Valve Anti-Cheat System Blizzard WoW also does the same with Warden .

My own advice would be " Use a gameplay system ." Since each game has its own rules and styles of play, it would not be too difficult to determine if a player is cheating or not. This approach will not be a general solution, and it might be silly, but if it works for your game, why not? :)