> A lot of these games with fancy anti cheat protection the cheat tools basically just tell the server "spawn me a vehicle right here" and the server just does it.
Citation needed. I'd be quite surprised if it were common for servers of professional games to trust the client in that sense (i.e. allowing it to decide game logic like what gets spawned where).
As far as I'm aware the most common types of multiplayer cheats are
* wall hacks, which you could probably prevent by not sending the client any information about objects that the player can't see, but that would require the server to calculate the line of sight for every player/object,
* and aim bots, which I don't think you could prevent at all on the server side since they don't rely on the bot having access to any information that the player isn't supposed to have. They just rely on the bot being better at aiming. I suppose if you did all rendering server side and only sent the rendered graphics to the client (i.e. streaming), that would make it harder for the bot because it'd now have to do image recognition to find the target, but that just makes it harder, not impossible. Plus, game streaming wasn't well received for a reason and anyway, I don't think that's what you had in mind when you talked about "not trusting the client".
Look up BF2. Cheat tools would just disable limits locally on ammo requests, vehicle requests, artillery strikes, and so on. Server didn't check anything. It had fancy anti-cheat tech. Which was bypassed by just writing and restoring executable memory changes faster than the anti cheat detected.
Things are certainly not always as professional as they appear to be.
Visibility test is definitely feasible against wallhacks, it's not that expensive.
Aimbot is an assist cheat, which technically does not violate the physical rules of the game, so you are right that it's more difficult to detect. One solution to detect this class of cheating is to record the player's movement, and rely on a combination of outlier scores and outlier movement behavior to detect abuse. It's not watertight, but neither are any of these client side anti-cheat detection schemes.
Citation needed. I'd be quite surprised if it were common for servers of professional games to trust the client in that sense (i.e. allowing it to decide game logic like what gets spawned where).
As far as I'm aware the most common types of multiplayer cheats are
* wall hacks, which you could probably prevent by not sending the client any information about objects that the player can't see, but that would require the server to calculate the line of sight for every player/object, * and aim bots, which I don't think you could prevent at all on the server side since they don't rely on the bot having access to any information that the player isn't supposed to have. They just rely on the bot being better at aiming. I suppose if you did all rendering server side and only sent the rendered graphics to the client (i.e. streaming), that would make it harder for the bot because it'd now have to do image recognition to find the target, but that just makes it harder, not impossible. Plus, game streaming wasn't well received for a reason and anyway, I don't think that's what you had in mind when you talked about "not trusting the client".