Y3 云脚本反作弊实战指南

function use_platform_item(role_id, store_id, cnt)
    if math.type(cnt) ~= "integer" or cnt < 1 or cnt > 10 then return false end
    return MsTryConsumeItem(role_id, store_id, cnt) == MlLuaErrorCode.OK
end
 
RegisterEvent("_consume_item_notify", function(_, role_id, _, store_id, before_cnt, after_cnt)
    local consumed = before_cnt - after_cnt
    if consumed <= 0 then return end
    PlayerMgr.add_stamina(role_id, consumed * 50)
    PlayerMgr.save(role_id)
end)

local SCHEMA_VER = 1
local Players = {} -- [role_id] = { aid, name, data, quarantined, suspicion, stage_ts, clock_anchor }
local Buckets = {}
local now_ms = 0
 
Timer.new_timer(200, function() now_ms = now_ms + 200; return true end)
 
-- 令牌桶限流（cap: 最大突发次数, window_ms: 回满毫秒数）
local function allow_rate(role_id, key, cap, window_ms)
    Buckets[role_id] = Buckets[role_id] or {}
    local b = Buckets[role_id][key]
    if not b then
        Buckets[role_id][key] = { tokens = cap - 1, last = now_ms }
        return true
    end
    local elapsed = now_ms - b.last
    if elapsed > 0 then
        b.tokens = math.min(cap, b.tokens + elapsed * (cap / window_ms))
        b.last = now_ms
    end
    if b.tokens >= 1 then b.tokens = b.tokens - 1; return true end
    return false
end
 
-- 整数范围校验（Lua 5.4 一行排除 nil、字符串、小数、NaN、Inf）
local function is_safe_int(v, min_v, max_v)
    return math.type(v) == "integer" and v >= (min_v or 1) and v <= (max_v or 2147483647)
end
 
local function add_suspicion(p, role_id, score, reason)
    p.suspicion = p.suspicion + score
    Log.warn("[AntiCheat] role=%d aid=%s score=%d reason=%s", role_id, tostring(p.aid), p.suspicion, reason)
    if p.suspicion >= 80 then p.quarantined = true end -- 触发 L3 本局静默隔离（停止存档落盘）
end
 
-- 双时钟对表：校验客户端自报逻辑时间流速 vs 云脚本真实时间流速（抓变速齿轮）
local function check_client_clock(p, role_id, client_sec)
    if type(client_sec) ~= "number" or client_sec ~= client_sec then return end
    local srv_sec = MsGetRoomGameTime() or 0
    if not p.clock_anchor then
        p.clock_anchor = { srv = srv_sec, cli = client_sec }
        return
    end
    local srv_delta = srv_sec - p.clock_anchor.srv
    if srv_delta < 30 then return end -- 至少间隔 30 秒采样一次，避免网络抖动误判
    local cli_delta = client_sec - p.clock_anchor.cli
    p.clock_anchor = { srv = srv_sec, cli = client_sec }
    if cli_delta / srv_delta > 1.5 then
        add_suspicion(p, role_id, 60, string.format("speedhack_rate:%.2f", cli_delta / srv_delta))
    end
end
 
local function init_player(role_id, plat_aid)
    local p = Players[role_id]
    if p then
        if plat_aid then p.aid = plat_aid end
        return
    end
    local raw = MsGetScriptArchive(role_id)
    local ok, data = false, nil
    if type(raw) == "string" and #raw > 0 then ok, data = pcall(cjson.decode, raw) end
    if not ok or type(data) ~= "table" or data.ver ~= SCHEMA_VER then
        data = { ver = SCHEMA_VER, seq = 1, gold = 500, stage = 0, equip_lv = { [1] = 1, [2] = 1 } }
    end
    Players[role_id] = {
        aid = plat_aid, name = MsGetPlayerName(role_id) or "",
        data = data, quarantined = false, suspicion = 0,
        stage_ts = MsGetRoomGameTime() or 0,
    }
    MsSendMlEvent(role_id, "SyncState", cjson.encode({
        gold = data.gold, stage = data.stage, equip_lv = data.equip_lv,
        vip = MsGetPlayerMapVipLevel(role_id) or 0,
    }))
end
 
local function save_player(role_id)
    local p = Players[role_id]
    if not p or p.quarantined then return false end
    p.data.seq = p.data.seq + 1
    local raw = cjson.encode(p.data)
    if #raw > 900 * 1024 then return false end -- 预留余量，防超 1MB
    return MsSaveScriptArchive(role_id, raw)
end
 
-- 房间生命周期（兼容线上 _roomloaded 与本地模拟 _localmodeloaded / _playerjoin）
RegisterEvent("_roomloaded", function(_, _, _, role_ids)
    for _, rid in ipairs(role_ids or {}) do init_player(rid, nil) end
end)
RegisterEvent("_localmodeloaded", function()
    Log.info("local mode loaded")
end)
RegisterEvent("_playerjoin", function(_, role_id, _, payload)
    local ok, info = pcall(cjson.decode, payload or "")
    local aid = (ok and type(info) == "table") and (tonumber(info.plat_aid) or info.plat_aid) or nil
    init_player(role_id, aid)
end)
RegisterEvent("_playerexit", function(_, rid)
    -- 每次资产变更已当场调用 save_player 更新服务端缓冲，退房时由系统自动落库，此处仅清理内存
    Players[rid] = nil
    Buckets[rid] = nil
end)
RegisterEvent("_roomover", function()
    Log.info("room over")
end)
 
-- 示例 1：权威抽卡（当场扣资源 + 随机 + 调 MsSaveScriptArchive，成功后再下发结果，杜绝强退 SL）
RegisterEvent("DrawCard", function(_, role_id)
    if not allow_rate(role_id, "draw", 5, 5000) then return end
    local p = Players[role_id]
    if not p or p.quarantined or p.data.gold < 100 then return end
 
    p.data.gold = p.data.gold - 100
    local slot = math.random(1, 2)
    p.data.equip_lv[slot] = (p.data.equip_lv[slot] or 1) + 1
    if not save_player(role_id) then
        p.data.gold = p.data.gold + 100
        p.data.equip_lv[slot] = p.data.equip_lv[slot] - 1
        return
    end
    MsSendMlEvent(role_id, "DrawRes", cjson.encode({
        gold = p.data.gold, slot = slot, lv = p.data.equip_lv[slot]
    }))
end)
 
-- 示例 2：关卡结算（顺序检查点 + 最短耗时门禁 + 双时钟流速对表）
RegisterEvent("StageClear", function(_, role_id, _, msg_json)
    if not allow_rate(role_id, "stage", 2, 5000) or type(msg_json) ~= "string" or #msg_json > 128 then return end
    local p = Players[role_id]
    if not p or p.quarantined then return end
 
    local ok, req = pcall(cjson.decode, msg_json)
    if not ok or type(req) ~= "table" or not is_safe_int(req.stage_id, 1, 50) then return end
 
    check_client_clock(p, role_id, req.client_time)
    local now_sec = MsGetRoomGameTime() or 0
    if req.stage_id ~= p.data.stage + 1 or (now_sec - p.stage_ts) < 30 then
        add_suspicion(p, role_id, 50, string.format("stage:%d_elapsed:%d", req.stage_id, now_sec - p.stage_ts))
        return
    end
 
    p.stage_ts = now_sec
    p.data.stage = req.stage_id
    p.data.gold = p.data.gold + 300
    save_player(role_id)
    MsSendMlEvent(role_id, "StageAck", cjson.encode({ stage = p.data.stage, gold = p.data.gold }))
end)
 
-- 示例 3：装备等级回源对账（客户端周期上报局内快照，与云存档权威真本比对，抓 CE 改内存）
RegisterEvent("VerifySnapshot", function(_, role_id, _, msg_json)
    if not allow_rate(role_id, "verify", 2, 10000) or type(msg_json) ~= "string" or #msg_json > 256 then return end
    local p = Players[role_id]
    if not p or p.quarantined then return end
 
    local ok, req = pcall(cjson.decode, msg_json)
    if not ok or type(req) ~= "table" or type(req.equip_lv) ~= "table" then return end
    check_client_clock(p, role_id, req.client_time)
 
    for slot, client_lv in pairs(req.equip_lv) do
        local auth_lv = p.data.equip_lv[tonumber(slot)] or 1
        if type(client_lv) == "number" and client_lv > auth_lv then
            add_suspicion(p, role_id, 80, string.format("mem_tamper_slot_%s:%s>%d", tostring(slot), tostring(client_lv), auth_lv))
            return
        end
    end
end)

local CloudBridge = {}
local equip_lv_by_pid = {}
 
-- 获取客户端当前逻辑时间（秒），随请求上报供云脚本对表防倍速齿轮
local function get_logic_sec()
    return y3.ltimer.clock() / 1000
end
 
function CloudBridge.req_draw()
    y3.game.send_mlscript_msg("DrawCard", {})
end
 
function CloudBridge.req_stage_clear(stage_id)
    y3.game.send_mlscript_msg("StageClear", {
        stage_id = stage_id,
        client_time = get_logic_sec(),
    })
end
 
-- 每 60 秒主动将本地局内生效等级快照上报云脚本对账（防 CE 直接修改本地内存）
y3.ltimer.loop(60, function()
    local local_pid = y3.player.get_local():get_id()
    y3.game.send_mlscript_msg("VerifySnapshot", {
        equip_lv = equip_lv_by_pid[local_pid] or { [1] = 1, [2] = 1 },
        client_time = get_logic_sec(),
    })
end)
 
-- 监听云脚本下行事件（全房间客户端在同一逻辑帧收到并同步执行）
y3.game:event("玩家-收到云脚本消息", function(_, data)
    if not data or not data.player then return end
    local player = data.player
    local pid = player:get_id()
    local ev_name = data.mlscript_event_name
    local payload = data.mlscript_event_data
    if type(payload) ~= "table" then return end
 
    if ev_name == "SyncState" then
        player:set("gold", payload.gold)
        if type(payload.equip_lv) == "table" then equip_lv_by_pid[pid] = payload.equip_lv end
    elseif ev_name == "StageAck" then
        player:set("gold", payload.gold)
    elseif ev_name == "DrawRes" then
        player:set("gold", payload.gold)
        equip_lv_by_pid[pid] = equip_lv_by_pid[pid] or { [1] = 1, [2] = 1 }
        equip_lv_by_pid[pid][payload.slot] = payload.lv
    end
end)
 
return CloudBridge