Let's take a look at a few things.
The "on shot" packet has the following information:
- Player ID
- Body part hit
Which means we can't work out where the shot is from, and thus we simply cannot detect nospread / norecoil hacks.
On top of that, rapidfire detection is less effective than it could be, as we only get this notification when someone actually gets hit. Finally, without a vis check, OPK (One Position Killing) is more lethal than an aimbot.
I propose that a "pallets fired" message could be used instead with the information here:
- Player position vector
- Old player orientation vector (pre-recoil)
- New player orientation vector (post-recoil)
- Spread/recoil seed
- Pallet count
Admittedly, this would require a bit more bandwidth use, but should only be necessary on the client -> server side. Then a "player shot another player" message could be broadcast to everyone (including the original player).
With this, however, the server is now ultimately responsible for hit detection. I view this as a good thing, as it completely eliminates OPK (but not aimbots). Lag compensation would be required, though (logging the last 3 seconds of each player should do the trick).
So what's this "seed" thing? It's basically a pseudorandom number to be used for spread/recoil calculation. Ultimately, it should just use that number to the power of let's say 5 as a seed for a linear congruential generator (like rand() except you define it yourself instead of relying on the libc). Then the seed is responsible for hit detection.
The server can force the player to use a seed by using a "set spread/recoil seed" packet, just in case there's a desync somewhere.
There's a couple of things to note...
- If the same seed is repeated over and over again, it's probably a crap attempt at an antispread.
- If the calculated pallet vectors appear to jerk much less than the player orientation, it's probably a good attempt at an antispread.
On top of that, the seed should be useful in the "detect if someone's doing an antirecoil" department. It won't be fully detectable with this (it could always be spoofed and reset) but if someone's orientation is barely jerking at all between each shot then it's quite likely there's no recoil.
Also, if shots are freakishy accurate (player- or pallet-orientationwise), then there's a fair chance that there's an aimbot there.
Finally, infinite ammo and rapid fire can be more easily and accurately detected, and your health / body is more likely to drop as soon as (if not before) you get hit.
Does this sound good?