Cheating

Not to be confused with Cheats, console commands that need sv_cheats 1 to work.

Material wallhacking on 2Fort.

Cheater using ESP on Dustbowl.

“

Nothing stokes my ire like a cheater. Deception, duplicity, murder -- these are merely tools in a toolbox one can use to ensure a job done well. But cheating? I cannot even wrap my head around the point of it. Wouldn't you know you had cheated? How on Earth could you maintain crisp certainty of your superiority to all others? And if you're unable to do that, what's the point of anything?

— The Administrator

”

Cheating is a term that describes the use of third-party programs or material changes in order to gain an unfair advantage.

Valve has a strict policy against cheating and will ban detected cheats with the Valve Anti-Cheat system, also known as VAC. Unfortunately, most current cheat providers bypass VAC. This means the users won't recieve a VAC ban unless Valve patches the method.

Players can be reported in game via the scoreboard or by pressing escape, clicking the report button on the menu, or by sending an abuse report (Default key: F7).

Most cheats take the form of:

Engine hooks, which "hook" parts of the Source Engine and use them for their cheat.

Ex: Createmove, PaintTraverse, DrawModelExecute...

Material cheats (chams, short for chameleon skins), use custom materials to lower the opacity of walls or make players easier to see.

These cheats are referred to as "internal cheats".

"External cheats" also exist. They do not "hook" but they read/write the game memory externally. These are fairly uncommon in Team Fortress 2.

Working Cheats

These are features in cheats that work in the latest version of Team Fortress 2.

Achievement Unlocker

Some community hosted servers have a plugin which is able to unlock all achievements in-game with a special command, granting all achievement items. This can also be achieved by using third-party softwares.

Aimbot

Automatically aim at an enemy for the player. This can be customized to ignore Spy's cloak, disguise, or Medic's Vaccinator and have "legit" features such as smoothing.

Some cheats have "Projectile Aimbot" which predicts where a player will be and aims ahead to hit them.

Silent Aim

Hides the aggressive "snapping" caused by aimbots quickly locking onto players from the cheater's (and subsequently people spectating the cheater) perspective.

Perfect Silent Aim allows the aimbot to shoot at players without actually looking at them. Fortunately, this has been patched for hitscan weapons, but still works for melee and projectile based weapons.

Hitscan Silent Aim can be spotted if the player is flicking for 1 tick and "returns" to the position their cursor was before.

Backtrack

Abuses the Source Engine's lag compensation to "send people back in time". Cheats can backtrack up to 200 milliseconds, or ~13 ticks on 66 tick servers. Signs of cheaters using backtrack are when a player is killed after walking behind cover, however this may be due to latency issues. If a player or bot is holding the Intelligence / Mann vs. Machine bomb and they get backtracked, the Intelligence (or bomb) gets teleported to the position they were backtracked to.

NPCs, such as tanks or ghosts can not be backtracked due to them not being lag compensated. Cheaters cannot backtrack with projectile weapons due to the same reason.

Often people accuse players who seem to facestab them of abusing the cl_interp command. In most cases, this simply is not true.

DoubleTap

this is a "new" exploit for tf2, has been possible in csgo for a while but now is possible in tf2.

to summarize it, the player chokes a couple of ticks, and releases those ticks when shooting, so the server has to compensate those ticks, and making the cheater be able to shoot 2-6shots at once.

most commenly found on insta "reload" guns like the force o nature(instant 2 shots), minigun(instant 6 at max, relies on how many ticks the cheat has choked.)

Fake Latency / Ping Increaser

Artificially inflates your ping to the server. The higher the ping is, the longer the backtrack is, meaning cheaters can hit players way after they went behind a wall. Cheats can mitigate the inflated ping by using 'cl_cmdrate 0' in console, but you can always see their real ping by typing 'ping' in console. You can recreate this without cheats through the use of the net_fakelag command however, unlike fake latency this command actually increases your real ping.

Crit Bucket Manipulation

To fix constant criticals, Valve released a new random crit system which requires players to fill a bucket by shooting before they can receive random crits.

It's possible to "store" random crits by filling up the crit bucket (range 0-1000) and sending crit requests to get crits on demand as long as you have it filled. Some weapons can take longer to receive crits as they require a bigger bucket.

Melee weapons do not follow this crit bucket system, which allows them to crit 100% of the time with cheats. For a short period it was discovered that weapons with "No Random Crits" could still crit (0.015% chance). This was abused to get nearly constant crits on these weapons until it was fixed in the Meet Your Match update.

In order for any sort of crit hack to work, the server must have 'tf_weapon_criticals' and 'tf_weapon_criticals_melee' set to 1 respectively (which is enabled on Valve Casual servers).

Custom Item Schema

Cheaters can load a temporary custom item schema that normally defies the rules of the item schema provided by the game.

Things custom item schema can do:

Remove any equip_region restriction, which can be seen by everybody.
Add attributes to any item in the game, which only shows up for them and disappears once the schema is unloaded.
Add any item into their backpack, which only shows up for them and disappears once the schema is unloaded.
Increase the amount of backpack slots they have, which can trick websites that use Steam's API to get false backpack data.

This does not allow for any economy breaking exploits as Valve has added extra measures to prevent that from happening.

Triggerbots

Triggerbots automatically perform an action and are harder to spot.

Auto-Backstab, backstabs when it is possible to.
Auto-Detonate, detonates stickies and Detonator flares when near a player.
Auto-Airblast, reflect projectiles perfectly.
Auto-Uber, ÜberCharge or Vaccinator charge when the receiver is in danger or at low health.
Original Triggerbot, shoots when a player is under the crosshair.

Thirdperson

Allows cheaters to go into thirdperson regardless if the server has 'sv_cheats' set to 1 or has any plugins installed on a community server.

Bunny Hop / Bhop

Automatically jumps when you land giving you an increased amount of speed, this has been nerfed in Team Fortress 2 in a patch soon after release to only give a very slight boost.

Autostrafer

Automatically strafes when you turn your mouse or strafes where you look. When combined with Bunny Hop it is very easy to gain distance as Scout or reduce the issue of Heavy's speed.

There is also a directional autostrafer, upon movement key presses will automatically airstrafe in the respective direction.

WASD/Directional Autostrafer

Automaticly strafes like the normal autostrafer, but you can strafe automaticly sideways.

Circle Strafer

Automaticly strafes like normal autostrafer. but automaticly strafes in circles when pressing a or d.

Taunt Slide

Originally a bug that would allow player actions when taunting if you taunted right before you fell off something. Cheaters took advantage of this so they could taunt slide whenever they taunted, without needing to fall off anything.

This was fixed in an update but is still partially possible, using moving taunts to instantly turn without any turn delay, or moving sideways while using the taunt.

Followbot / Walkbot / Multiboxing

A bot that can perform actions without user input. Commonly used to assist cheaters or cause mayhem.

Unlike regular bots, these bots are different because of how they are presented. For instance, regular bots are able to freely roam around a specific map, while walkbots must have a set path that is created by the host.

These bots will usually walk on a predefined path and aimbot at the location set. Unlike regular bots, walkbots do not detect Sentry Guns, and will usually walk straight into their line of sight, allowing for a well-hidden Engineer to easily deal with them.

Capabilities:

Following a player.
Healing and ubering players.
Defending a location.

Server Seed Prediction

If the server runs long enough, the seed value (which determines the spread for client weapons) will be a big floating point.

This introduces a big imprecision (as it gets rounded more and more). The client can predict the pattern generated by the server as you only need a value approximately close to that of the servers, and the rounding will do the rest, which will allow for no spread-like properties to work again. This doesn't work that well on Valve's Casual servers due to them not running for a long enough, however it can work well on some community servers depending if they automatically restart or not.

Name Stealer

Steals the names of players to get them kicked or help cheaters avoid kicks.

Valve introduced several fixes to mitigate the issue of namestealing, such as:

Showing avatars in callvote UI.
Adding sv_namechange_cooldown_seconds: Set amount of time before a player can change their name again.
Adding sv_vote_issue_kick_namelock_duration: Set amount of time a player can set their name again after getting a vote called on them.

Chatspam

Spams messages in chat, normally advertising something. Some cheats abuse newlines / linebreaks to "clear" chat and make only their messages visible.

During the summer of 2020, few changes were added to mitigate the effectiveness of chatspam and micspam. Changes include:

Restricting new and free accounts from using in-game text chat and voice chat.
Adding sv_chat_bucket_size_tier1 and sv_chat_bucket_size_tier2: Sets a limit on how fast messages can be sent.

Killsay

Says a message when a player is killed, normally insulting them with the victim's steam username, class, or weapon.

ESP

ESP stands for Extra Sensory Perception. ESP is considered anything that gives extra information visually.

Showing player positions.
Showing player health.
Showing player ÜberCharge and its current percentage.
Showing player class.
Chams (changes the colors of the model, making them easier to spot & visible through walls).
Making the players glow constantly, similar how your teammates glow after you respawn.
Showing information about the player, such as the currently equipped weapons, or if the player is zoomed in.

Spinbot / Anti-Aim

Commonly used to counter other cheaters to make their aimbot miss, modifies the viewangles sent to the server.

Since the viewangles are sent to the server, the cheater does not see this on their client if the cheat does not visualize it.

Cheaters can use certain pitch angles which cause the head to not be where its hitbox is.

It is also possible for a cheater to abuse packets that will fake their yaw. To you they may be looking forward, but in reality their hitbox could actually be facing to the left.

Anti-Aim can be if a cheater kills you while looking at the direction they didn't kill you in, such as looking upwards.

Anti-Backstab is achieved with Anti-Aim. It detects if a Spy is near your back hitbox and snaps the view-angles backwards (180), making the Spy miss their stab.

Roll Speedhack

When Valve patched "viewangle speedhack", they only patched it for people standing, the patch does not apply to cheaters that crouch and can be easily seen as they crouch and walk backwards.

This will allow cheaters to crouch at walking speeds.

Fakelag

Abuses packets so the server doesn't update your position for a maximum of ~23 ticks. To others it looks like they are "lagging", but their ping will be relatively low and from their view the game looks fine.

Due to the nature of fakelag, it is mostly used to counter cheaters to make their aimbot miss.

Noisemaker Spamming

Allows cheaters to use any noisemakers that have limited uses without actually using their limited use.

No Recoil

Removes any bobbing received by shooting weapons or getting hurt, mostly cosmetic but can help with aimbot accuracy.

No Projectile Inaccuracy

Under the same category as No Spread, this removes any inaccuracy projectile weapons have, such as Beggar's Bazooka deviation or Huntsman charge inaccuracy.

Tickbase Manipulation

Allows the client to "warp" on command up to ~23 ticks on Valve servers (value is dictated by sv_maxusrcmdprocessticks) by sending multiple usercmds after faking packet loss. This will cause the player to teleport ~23 ticks (roughly a third of a second). This feature exists due to the way the game compensates for packet loss, and can be broken down into airstucking and speedhacking for a short period of time.

This can also be utilised for another feature commonly referred to as doubletap, which allows firing in quick succession.

Server Lagging

Spamming commands per tick could cause the server rubberband or completely freeze players, often timing out connected players.

This was fixed in the June 7, 2018 Patch by limiting the amount of commands a player can send per tick.

Fake stand

Also known as fake fake duck in some private cheats, this allows the player to appear standing, however the real hitbox is crouched. This can be done by crouching midair without being in a "jump" or "fall" state.

VAC Bypass

Also known as VAC Disabler, this cheat has been built into many cheat injectors and causes VAC to not verify the game files. This however does not remove VAC Bans.

Patched Cheats

These are features in cheats that have been patched by Valve within content updates.

Achievement Spammer

Cheaters could rapidly unlock and relock achievements, which would spam the chat and constantly play the achievement earned sound.

This was fixed sometime in 2014 by Valve adding a limit of how many achievements can be displayed in chat at once.

Anti-Votekick

Cheaters could type 'retry' on Quickplay accepted servers in the Developer Console right before a votekick would go through, making the vote useless.

Fixed in July 7, 2016 Patch with the introduction of Casual Mode.

Again fixed in July 3, 2020 Patch to automatically vote yes for anyone who hasn't already voted if the target for the vote leaves the server.

Airstuck

Causes a cheater to float in mid-air by sending no usercmds to the server.

This was found to contain various exploits, such as:

Building velocity with Soldier's Rocket Launcher or Demoman's Stickybomb Launcher.
Pyro's Phlogistinator to have infinite ÜberCharge if one activated it and spammed taunts.
Infinite Bonk! Atomic Punch / ÜberCharge.
Infinite Medi Gun healing range.
Capture Control Points in Casual Mode during countdown timer.

Fixed in April 20, 2017 Patch by introducing a new command 'sv_player_usercommand_timeout' which will require cheaters to send a usercmd depending on the value set, setting to 0 disables the fix.

Constant Criticals

Originally cheats could get 100% crits by setting the tickcount to when they would get crits.

Fixed sometime in 2013 with the introduction of the crit bucket system.

Minigun Jumping

Normally when you're revved up with the Heavy's Minigun, you can not jump. Cheats could remove this restriction by simply telling the game that you're not revved up.

Fixed sometime in 2013.

No Spread

Predicts or changes the seed of a weapon to remove/reduce weapon spread.

Fixed in July 23, 2015 Patch by making the server control the seed instead of the client.

Anti-Backstab

Replace the backstab to normal hit that deals 40 damage.

Hitscan Silent Aim

Hitscan refers to weapons that use hitscan to hit players, like Shotguns or Pistols.

"Perfect Silent Aim" (commonly known as pSilent in cheats) used to hide silent aim snaps from spectators.

Fixed in July 23, 2015 Patch by introducing a new command 'sv_maxusrcmdprocessticks_holdaim' which allows servers to hold client ticks for multiple ticks, setting to 0 disables the fix.

Speed Hack

Caused by cheats sending a lot of usercmds at once. Fixed across the Source Engine games by limiting the number of usercmds accepted at a time.

Another form of speedhacking rose soon after the patch, known as "viewangle speedhack", it would allow for higher than normal velocities, but wouldn't have the same effects of normal speedhacking.

Original speedhacking was fixed sometime in 2013, viewangle speedhack was fixed in July 24, 2014 Patch.

Scope Hack

This hack helps you charge the scope faster/instantly.

Sequence Freezing / Remove Conditions

Abused the netchannel to skip sequences. Nearly all conditions could be removed such as fire/bleed.

Depending on how many sequences you skipped, cheaters could break player lag compensation, making it hard for people to hit the cheater with hitscan based weapons.

Other side effects included:

Prematurely ending taunts (Phlogistinator included giving extended ÜberCharge protection).
Removing stuns applied by ghosts.
Duping infinite Health Packs.
Duping infinite Ammo Packs.
Infinitely throw Sniper's Jarate or Scout's Mad Milk.
Instantly or speed up captures on control points.
Instantly decloak as Spy, skipping the decloak animation.
Instantly reload, depending on the weapon.
Instant spinup with Heavy's Minigun.
Reverse capture control points, allowing the defending team to capture points for the attacking team. This also caused sequence breaks, causing no MVP screens and long setup times.
Getting ignored by NPCs, such as an Engineer's Sentry Gun.
Using the Sniper's Huntsman to deal negative damage, giving enemies massive overheal.
Shoot twice at once with weapons that have delays before their next shot (ex. Shotguns or Rocket Launchers).
Firing Demoman's Stickybomb Launcher stickies all at once.
Abusing Healthpacks to give infinite overheal using Heavy's Gloves of Running Urgently.
Delay charges on any weapon that could be charged, such as Soldier's Cow Mangler or Demoman's Stickybomb Launcher.

The remove conditioning effect could be done by legitimate means by purposely freezing the game (such as spamming snd_restart) to desync yourself from the server.

Condition removing was fixed in November 7, 2017 Patch, but some of the effects still remained, which were patched at a later date.

Bots

Since late 2019, bots (semi/fully automated cheating programs with little to no input from humans) have been created to join Casual servers using aimbot cheats, chat spam, server lag, spinbot, walkbot, and votekicking real players.

Several updates have attempted to fix or mitigate the chat and voice spam, name stealing, votekick initiation, team name changing, server lagging, and unequipping cosmetics.