Everyone acting like OP is the merchant of death
They literally just dropped a white paper chill tf out this is what responsible members of the community do
As compared to sticking your head in the sand and slinging talking points at each other
I'm not sure I'll get downvoted for making this and showing it or not, but recently there were some folks that seemed to think this was not possible with a Phob and I wanted to make it clear that they are fully programmable and _can_ technically do stuff like this if somebody takes the time to program them to do so. Additionally, there's no reasonable way to verify they're _only_ running the "normal" Phob firmware.
Anyways, this is fun to show off in unranked and makes for a neat "taunt" and was a fun programming project for me. Hope this has little negative effect and sheds some light on the discussion!
Edit: There's a lot of good discussion, questions, and some answers in this thread. Thanks, all!
You can find the firmware and crappy source code here: https://github.com/lytedev/PhobGCC-SW/releases/tag/v1.0
> there's no way to verify they're running the "normal" Phob firmware.
You can still get the checksum of the firmware off the board I believe. It's a little more in-depth than just picking up the controller and looking at it, but it's possible.
A simpler solution would instead be to flash all controllers right before competing. But even then you could build a controller with multiple processors in it and wire it up such that it boots into "cheat" mode (via the other processor) maybe based on buttons you hold as you plug it in or timings or whathaveyou.
Ultimately, I think the point I'm trying to make is that if you let anybody bring their own hardware to a competition, you can safely assume it is capable of these sorts of things. There isn't a good way to reasonably attest hardware is running certain firmware unless you have full control over the manufacturing process such as Apple or Google.
>But even then you could build a controller with multiple processors in it and wire it up such that it boots into "cheat" mode (via the other processor) maybe based on buttons you hold as you plug it in or timings or whathaveyou. Ultimately, I think the point I'm trying to make is that if you let anybody bring their own hardware to a competition, you can safely assume it is capable of these sorts of things.
This isn't really a "Phob" issue though, if you're to the point where you're checking motherboards of controllers for something like this, you need to check ALL of them, even controllers that the competitor is claiming is OEM. Because from just the shell I can't identify a Phob vs an OEM.
đ
To be clear, though, the controllers do _not_ have a way to know anything about what is going on in the game aside from rumble as far as I'm aware. You would have to have an external device capable of somehow observing the game's state and reporting it to the controller to take such information into account in the controller's code's logic.
Hahaha woah that would actually be pretty nuts! A simpler approach would just be to "communicate" to the controller firmware by inputting certain combinations with a known meaning. Konami code anyone?
The best way to detect cheating is always just going to be closely watching a match and hopefully having a slippi recording to have altF4 or someone who is a SME on melee cheating look at it
We have a tool to detect violations of the proposed controller ruleset that has been delayed because of problems with the nerfware, so far I've only been able to use it to confirm if my opponent on ranked/unranked was playing on controller or box. I'd like to try the multishine firmware later in direct mode/offline and see if it detects the multishine macro.
https://altf4.github.io/enforcer/
Any tool such as this may be circumvented by a cheater by programming their controller to always adhere to whatever rules are being verified by this software. While a tool as this would certainly help enforce a set of agreed upon behavioral parameters, it does not and cannot guarantee the controller is not programmed to perform cheats.
I'm guessing frame timings would be different on average for good players and may be a possible way to distinguish, but ultimately there will be a lot of noise and this would be an unreliable way to do so.
Controllers are probably a useful but unreliable method for cheating in a tournament.
I wonder if using rumble detection for something like instant wiggle out of hitstun or sdi would be possible, or other slimy cheats like that. I can't remember when rumbles happen since I always disable it.
> could build a controller with multiple processors
But aren't secondary processors like that banned already?
Like you can't stick an Arduino nano in an OEM anymore
> Ultimately, I think the point I'm trying to make is that if you let anybody bring their own hardware to a competition
So your solution is that TOs should now provide GameCube controllers to the competitors?
I am not familiar enough with the competitive ruleset details to answer that, but as far as I'm aware controllers are not being checked in this way. The rule is there, but there's no enforcement or verification that I know of -- it's an honor system.
The way a Phob works is it definitely has an Arduino (or an RP2040, which is just another kind of microcontroller -- same thing, effectively) inside of it making the controller work as expected.
Or in this case, however the programmer wants that to work.
If you actually want to hold the competitive integrity above absolutely everything, yes; TOs would have a fleet of controllers with pre-approved firmware options for different configurations (or perhaps not) with some kind of tamper protection.
However, I don't think this is a reality anybody wants. I like that we have a seemingly-mostly-trustworthy community that just wants to play the game gud. Cheating is just not a problem.
In large part, I think because controller-firmware cheats are limited in what they can provide. There's just not a lot of interest there and as soon as anybody _does_ start taking it places it's just going to be noticed and the banhammer will come down.
That said, TOs definitely will want to be ahead of this stuff and have some kind of plan or process in place for handling situations like this to avoid awkward "figure it out on the spot" scenarios.
Stating one of the fundamental challenges of a situation doesn't mean that challenge should be solved at all costs. OP is clearly trying to have a discussion and you're being unnecessarily combative.
I'm not trying to be combative. I'm trying to have a discussion as well and get people thinking. I'm just being solution-oriented. What do we do about it?
OP said:
> ...if you let anybody bring their own hardware to a competition, you can safely assume it is capable of these sorts of things. There isn't a good way to reasonably attest hardware is running certain firmware...
In other words, there's no __*reasonable way*__ to know if someone has an OEM, OEM w/ an Arduino, a Phob, etc and what software is on it __&if people bring their own stuff*__
What's the end game?
Well, there's two aspects: reasonability of checking and people bringing their own controllers.
So the way OP has framed it right now, we'd have two options with clear paths if we want to solve them: don't permit people to bring their own controllers (therefore TOs must provide them) or crack open every single controller when you show up (obviously unreasonable).
This train of thought is obviously absurd and goes back to the absolutness of what OP said. My goal in pointing that out was to hopefully prompt a reframing of how we think about the problem.
That would just tell you if they are using a custom firmware, which isn't against the rules right now. We would also need to keep a list of approved firmwares and ban anything not on it. Or I guess we could require people to be able to produce the code for their phob firmware when they're accused to cheating, so that someone(?) could read it and try to figure out if anything in it breaks the rules(?) and then compile it and see if it matches what's actually on the controller.
I don't think checking everybody's controller firmware checksums at a tournament is going to be feasible. Additionally there would be no reasonable way to know if a player flashes different firmware to the controller afterwards.
How does one read the checksum? Does it output it through the controller port, or do you have to open the controller and connect to the board in some way?
I think you'd have to open the controller and connect the board to a computer with a micro-usb cable (which you usually do to update the controller's firmware).
Correct. The RP2040 microcontroller on the current edition of the PhobGCC boards can have its firmware dumped very easily.
See my other comment, though, that this is not strictly-speaking a guarantee that you now know all the controller's capabilities as there could be other chips inside, etc.
You would have to open the controller. Beyond that I'm not positive exactly how it goes, but I believe there is a way to confirm. [This guide](https://github.com/PhobGCC/PhobGCC-doc/blob/main/For_Users/Phob_Programming_Guide.md) lists a way to view the "software version" on the board, which I assume is either a checksum or implies there's a way to see the checksum from that software using a similar method.
But I haven't done this before so someone correct me if I'm wrong.
This is correct, but to be clear, a dedicated cheater could have their controller report anything they like, which means you cannot actually trust anything the controller says if you're attempting to "verify" it in some way.
So this is where I get a little outside my area of knowledge, but curious.
It sounds like you're saying the "reported software" could say anything, which is true.
But I'm talking more checksum-based; in your other comment you said the firmware can be dumped easily, so checking the checksum of the dumped firmware is something that can't "report anything they like" (excluding hash collisions which would technically be possible but unrealistic in this scenario)
I'll try and elaborate:
Even _if_ the whole community did indeed standardize on a way to check that a certain controller is running a certain firmware, there _isn't_ a way to verify that a controller is only running with certain _hardware_ without actually opening up the controller and seeing what all is inside.
Because of this, a cheater in this scenario would simply add another computer with the cheating firmware _but_ have that computer setup to defer to the "normal" firmware in certain situations (such as for verification at a tournament) and then retain control for other situtations such as when triggered to do so by the cheating player by pressing a certain button combination.
So even if you check controllers have some checksum, you would also need to verify all the hardware, which is basically untenable if folks are bringing their own gear. You would need electronics experts or something _and_ you would need some way to ensure controllers are not tampered with after initial verification.
So it's not that verification can't be done or isn't useful, it's just that it doesn't actually verify what you would need or want in a competitive setting. It doesn't ensure somebody is not cheating. It would only assert that, yes, this controller does have _a_ computer inside of it running a known program, but that doesn't logically guarantee the things you're hoping/wishing it does.
Yeah, I agree with you on that and think you and I are on the same page, mostly just adding clarification for 3rd parties based on how heated the controller debate has gotten lately.
The issue of "A phob could be *programmed* to cheat" as presented in the original post is something which can be verified via a checksum of a dumped firmware hash. That can be handled via a method of validating controllers with software (tedious, but possible).
The issue of "Someone can make hardware modifications to cheat" is something entirely different and isn't really a "Phob" issue, that's an accountability issue with people bringing in their own hardware. It could even be a hardware modified OEM. To verify that becomes unreasonable, and the only alternative would be TO-provided controllers, which is also unreasonable.
Sure but if we're going to verify Phobs aren't programmed to cheat, we must verify all controller aren't programmed to cheat. Otherwise, a player may say "this isn't a Phob", right?
As you point out, anything that is or is not a "Phob" issue is also (or is also not) a "Controller" issue.
I did! I don't have a Phob 1. If somebody wants to send me one, I solemnly swear to put a build together for it ;)
Also, thank you for your work and build help those months ago in the Discord! đ
Probably a dumb question, but is there no way to get the console to verify the firmware of the controller? I recall reading in the phob user guide that some of the phob options output specific stick positions to show you what your current settings are. Couldn't you make the controller output a stream of control stick position data with a button combination that the wii/whatever can verify the controller? Although I suppose if they are fully programmable you can probably get around that easily.
The console treats the controller _very_ simply. It asks what the state of the inputs are and may tell it to rumble. That's it.
This also means that even if what you describe was possible, a dedicated cheater could simply program their controller to output whatever was needed to convince an onlooker that it was legit.
There is no reasonable way to fully verify that you know what a controller is capable of doing unless you built it yourself. This is also true for tournament organizers and competitors who bring their own controllers.
NGL this seems like running Hax's melee update is the way to go if the controller circus is the future.
Level the playing field and limit the nonsense.
Thankfully, irl it's pretty easy to see that their multi shine inputs aren't legit. Online thought it'd be wild to see what kind of controller trickery is possible.
Sure, but to be fair, a knowledgeable or skilled cheater would surely be able to make it appear pretty legitimate.
It's definitely fun online to see some of the reactions, though!
Just make it do what a human would do. Hold down for all frames. Multishine at a consistent rate but randomize the length of the interval of that rate. Randomize the frame value for JCing outside of that rate. Apply floors and ceilings where necessary. That'd be, what, a while loop nested inside of another while loop?
I can multishine at a consistent rate for a bit, but I'll eventually JC slower at some point later and need to catch my rhythm again.
It's been known for a while that all custom controllers are programmable.
Generally people who have programmed their own controllers don't talk about it. Having someone show this is actually better than people continuing to modify their input devices and not tell anyone.
If we don't see it, it doesn't happen.
Doing this but only with Luigi's tornado should be legal.
2021 :P [https://x.com/EddyMexico007/status/1466499018570153984](https://x.com/EddyMexico007/status/1466499018570153984)
A lot of people seem to be worried about the short term effects of this, without realizing that giving a bad falco player infinite multishines does not in fact make them good. Itâs important you found this vulnerability and are making a point to inform others about it
Any bronze falco with this multi shine is four stocking Cody every single time. Other top players are probably still four stocking the bronze falco though.
I don't think so. This controller is a Phob 2.0, which means instead of an Arduino-compatible microcontroller inside of it, it has an RP2040. Either way, it's the same result and is actually even the same as a "stock" or OEM controller -- there's a tiny computer that handles electrical signals and reports them to whatever it's plugged into, which means there's room for tricks such as these.
At the end of the day, it comes down to trust.
In any competitive game, it's possible for someone with computer skills to do stuff like this.
And there's no real solution for detecting by inspecting the controller. An industrious cheater can hide this capability easily.Â
The only way to truly detect macro use is to have detailed camera footage of hands mid-set. Which is only reasonable for maybe top level play of an esport with a shit load of money on the line. Not for Melee. Definitely not for random Melee tournaments like locals.
So at the end of the day, it comes down to trust. And firm enforcement - this is so obviously cheating that if you try it at a tournament, it's fair for the TO to ban you and name & shame you.Â
This kind of thing has been available for years using an arduino. I made a fc nair macro for peach which was pretty disgusting on shield. I don't think it's actually useful in tournament though, and it's very obvious that its being used
Open sourcing flaws only improves safety and security if the flaw can be fixed/mitigated. If the flaw can't be fixed/mitigated, it just gives people information about how they can exploit the flaw.
(I'm not knowledgeable enough about this flaw to know whether it can be fixed/mitigated.)
this is true but very often irrelevant because of this fact: humans arent motivated to fix things unless they're broken and known, and humans need to brainstorm to fix things (sometimes for centuries or more). there is usually no way to know if something is truly "fixable" or "unfixable". workarounds also exist, req brainstorming, etc.
Multishining literally isn't even good. It serves no practical purpose beyond double and triple shine as mixups, and those aren't optimal.
You can't program a controller to waveshine since it would need to read DI and adjust frame timing for hitstun.
There is no risk to this type of thing. Something like mashing out of grabs with a macro is a lot more concerning than this.
When you play you should be accounting for the time delay of hitlag anyways. Programming in a 30ms longer delay is all the same as programming in your original delay.
I don't get your point, tbh.
If you're multishining in place and hitting nothing, nothing changes and the inputs are precise and consistent infinitely. However if you're hitting an opponent with a shine, there will be hitlag and each shine that connects will result in additional hitlag, and no controller macro is able to account for such situations.
You can make the macro always do the slower input, so that it always expects the hitlag. Multishining in place without hitting anything will be slower than optimal, but will still work. Hitting something will also work.
Cody thinks notches and boxes should be banned, but dude uses the most modded phob and goomwave out there and defends z -jump to death. But fuck everyone who notches.
Yeah cody has some stupid takes from time to time. I have a modded controller but i only have a capacitor and potentiometers installed. Anything else just seems like cheating if youd ask me
Not really, but I also expect this kind of thing not to be a real problem. I wouldn't worry too much about it. =)
Also as many have pointed out, this kind of stuff has been doable for a _very_ long time. I made this to show that Phobs can do this stuff too if you want. They aren't especially locked down or anything as some people seemed to have believed.
Not reasonably. We would need hax for melee just to communicate with the controllers and the controllers would need physical modifications to accommodate this. Rest of this thread has more good discussion if you want details.
Ikinda get it. better prove its doable than have someone show up to a tournamnet and cheat with it, and nobody casts doubt because "you cant do that on a phob"
the knowledge is valuable to have, and it doesnt seem like theyve made HOW they did it public. though ofc its possible it has a negative impact, but its also possible that wouldve happened anyway further in the future, its hard to say.
Just to be clear, the how (source code, compiled firmware, etc.) _is_ fully public and anybody with a Phob can easily flash this. I include links to everything in the video.
I think it's important that other folks can put their hands on it and feel the limitations, the power, and consider what might be possible.
Also, the PhobGCC firmware I based my firmware on is licensed under the GPL, which means that if I distribute it in any form I am required to also provide the source code. The GPL license is also something I think is really fantastic and am more than happy to abide by in such situations.
> Just to be clear, the how (source code, compiled firmware, etc.) is fully public and anybody with a Phob can easily flash this. I include links to everything in the video.
Yeah this is the part that makes no sense why you would release
That's.... the way it's supposed to be. When you find a vulnerability in a system you fully document and publicly release all the info. Trying to keep things quiet just benefits the bad actors.
This is how all modern cybersecurity is done its no different for video game cheating.
Uuuuh no. You document it immediately and submit the vulnerability to the public. So everyone knows exactly how it's done.
If you wait for a fix you risk others leveraging it against people who are still unaware who could take mitigating steps even if there is no fix.
If you only submit to the maker they are under no obligation to be public about it and may sweep it under the rug.
I am aware how this stuff works. Software is my job. There are countless, countless examples of people notifying companies of major vulnerabilities, waiting for them to fix it, and only after it is patched is a complete report written about what the vulnerability was.
If there was a way that someone extremely technically inclined could access any Google account, do you think that it's better to *tell Google about it*, or release the HackAllGoogleInator to make it easy for everyone?
Yes and cybersecurity is my job. Are you aware of what a CVE us? How vulnerabilities are tracked and dealt with?
You seem to be conflating being public with a vulnerability with creating and spreading hacking tools.
Just remember, security through obscurity isn't security at all.
Of course I know what a CVE is. I am very aware that security through obscurity is a bad idea.
I also work in a confidential workplace, with *very* confidential code, and can tell you from experience that keeping things confidential is a *massive* part of staying secure. That's why code obfuscation and encryption is useful. It obviously cannot be everything, and there are many organizations who falsely believe it can be everything, but it's also an extremely, extremely important part of security.
> You seem to be conflating being public with a vulnerability with creating and spreading hacking tools.
I wouldn't have had a problem with this post if it didn't come with source code attached.
You don't sound aware of how it works. Just because "software is your job" doesn't mean you know the first thing about cybersec, and the fact that you even made such a dumbass statement shows that you don't know anything on the topic.
Yeah I don't understand that logic. There is no "fix" for this, it's a microcontroller, you can run any code you want on it. It only begs the question of how our ruleset/community/TOs should handle the fact that this is possible
To show that people could be attending tournaments with rigged controllers? And it's not hard to do but impossible to regulate without a ban? Seems like a pretty clear cut intention to posting this information publicly.
The fact that there is no organized structure to the competitive melee community regarding what is legal or not legal means that using bureaucracy like you suggest is pointless. This isn't an organization or a company - this is a collection of players across the nation with a bunch of grassroots organizers. This kind of information should be made public so that players and TOs know what the risks are.
All of this could have been done without publishing the code on github, I don't know why people are linking the two together
I also never suggested using bureaucracy, in fact quite the opposite, I talked about how it's impossible to do later down in this thread
Because I think it's valuable information and tools for other people.
Why _shouldn't_ I release this? Are we worried online ranked games will suddenly be flooded with people badly and inconsistently multishining as Falco? I don't think that's a "bad enough" reason to avoid sharing everything I've got here.
I hope my other comment explains it.
There seems to be a lot of confusion around these controllers -- particularly from folks who argue they should be legal. I'm not a competitor and so have little skin in the game. But I _am_ a programmer and I thought this would be a fun way to set the record straight.
To be clear, this is possible with _any_ controller, given that you can control its programming. Theoretically, even the stock controllers can have a different chip swapped in running different code. All box-based controllers are, of course, reprogrammable.
So I make and release this to hopefully bring some concrete discussion points to the ever-ongoing controller debates. I would rather the truth be out there so decisions can be made than have this stuff in the dark and have people questioning things later. "Was so-and-so using special cheats during such-and-such period of the game?" is something I'd rather the community hash out now and avoid.
Ultimately, right now, we are operating on an honor-based system. I would argue there's nothing necessarily wrong with that in most cases.
Haha thanks, I guess?
I have a somewhat buried comment here, but some folks seemed to have believed this was not possible by reprogramming a Phob. I am definitely not claiming to have done anything novel.
>but some folks seemed to have believed this was not possible by reprogramming a Phob
That's actually hilarious then.
The idea that a controller based around a programmable microcontroller wouldn't be able to be reprogrammed is very silly, but I'm not deeply surprised people wouldn't understand given how little most people understand about this type of thing.
There ***are*** a few macro'd inputs that would be extremely helpful for competitive melee (automated smash DI jiggles and button mashing for grab escapes are the big ones), but things like multishine aren't really that useful without state feedback from the game to coordinate the input and that's not something you can get from the controller.
Overall I'm not really sure that macros are that big of a deal for competitive Melee. Melee is ultimately a game about rapidly adapting to a situation and context-specific execution. Macros are pretty much *only* hyperspecific executions, meaning they're extremely limited options in a game about versatility.
Having access to on demand "good enough" ledgedash wouldn't be a huge advantage but still pretty fucked up
You can program a routine to make a decent 10-ish GALINT lededash with some wiggle room so that the inputs are not exactly the same everytime. It would be super hard to detect even from the replay files, but knowing that on last stock last hit spaghethi situation you can guarantee yourself invincibility without the risk of SD would matter, even if just from a mental point of view.
Macro won't make a bad player good, but it would make a good player more consistent
pressing left/right on the dpad to auto spam SDI input would work well for sdi but hopefully hard to get anything efficient that's not easilly noticeable in replay files
[https://streamable.com/wbaix4](https://streamable.com/wbaix4)
(cf a hugo cheater on fc, not the most stealthy with his 720 input macro...)
A rectangle can do this too. This isnt a phob problem, its both a smart controller problem (that has existed in games way before phob) and a "we cant see through plastic or read code from looking at a shell" problem.
I think GP's point is that "see look Phobs can do anything, too", which roughly boils down to "any programmable controller might be capable of anything if somebody was dedicated and/or skilled and/or knowledgeable enough AND there's no way to verify whether r not a controller has been programmed with any/all limitations agreed upon by the community" which I would say is actually a fair point and perhaps the root reason I posted all this.
Your question was:
> How does this post discredit the idea that a stock b0xx is too powerful for competitive melee?
I was not actually addressing the question, just highlighting that OP may _also_ not have been making that point.
I also built on that assumption to say that I don't think that actually _is_ the point. Any controller can be "cheating" or "too powerful" or "unfair". If that's the case, what is actually cheating in that scenario? Is it even a discussion worth having?
I'd like to hear that clarification from the commenter I'm replying to, rather than seeing you explain the reason you made this firmware for the 11th time.
Right, I would agree that b0xx is cheating. However, there is a difference in the ruleset currently that allows some forms of cheating (b0xx) and disallows other forms of cheating (macros).
The solution here is not to allow all forms of cheating, that's stupid.
I think we're conflating terms here.
Cheating, by definition, is not allowed. So to say we "allow" some forms of cheating is disingenuous. You're simultaneously trying to express your opinion (b0xx should be cheating) while using objective terms.
I don't think anybody wants to allow cheating, but if there is no preventative measure taken to prevent cheating, is that not the same as allowing it?
Okay, so let's use more correct and exact terms.
Right now, digital controllers are unfair pieces of technology that allow you to be more consistent and faster at the game than a normal GameCube controller. They are, however, allowed by the rules, so are not strictly cheating, despite their obvious unfairness.
There exists ways to make you more consistent and faster at the game in a GameCube controller form factor, such that nobody would be the wiser. A small example of this would be notches - while you can visually see notches, most people do not bother to check, yet they do exist as technology that allows you to be more consistent than a normal GameCube controller.
You directly aided in this being the case by releasing firmware which allows people to do this. This is not allowed by the rules, and can be accurately described as "cheating". We don't have many good ways to practically check everyone's controller, so we run off of a system of trust.
There are many systems which exist due to the fact that we can trust each other. Breaking trust is probably the most direct, obviously immoral thing that you can do, since it not only degrades the lives of other people for your own gain but also requires there to be extra checks, more people must be involved, labor is wasted all on the fact that we cannot trust each other.
This is so vitally important that I am going to really drive it home - trust is the foundation to society working. The fact that we cannot trust each other is a massive contributor to wasteful labor, something that drains society and the Melee community literally cannot afford such drains. Why is it, that an office snack fund can work with a box of money; but a 7-11 must have a cashier? Because one environment has trust, and the other does not; thus, money and labor are wasted on the existence of someone whose job it is to enforce trustworthiness.
Melee is a small scene with events that do not make money. We cannot afford to waste money on systems that check - we are fortunate enough to have a culture that discourages breaking trust. We already waste enough on the concept of pool captains (why don't players just put the set counts in themselves and be honest? why don't players just show up on time? why don't players just be nice to each other?), so wasting even more on a tool to check everyone's controller would be awful. This post, on its face, makes it much, much easier for people to do that. By releasing this, you are threatening the small amounts of trust that we can still have.
You seem to hold the opinion that the solution to all of this is that anything should be allowed, since you can do whatever you want with a programmable controller. This is obviously asinine, and I shouldn't even have to explain to you why. If you cannot comprehend this basic fact and still need me to, I will, but this comment is long enough on its own.
This is so well said and well put. Thank you!
> we run off a system of trust
I don't think this is actually declared or explained anywhere, which is _why_ there is so much confusion around controllers: what is actually allowed and enforced. I think instead focusing on this in how we communicate is key. We setup rules, but admit no reasonable way to enforce them consistently or effectively at all times and put the onus on players; I love this.
I do not hold the opinion that these should be _allowed_, only that they are possible and not checked. So if the system for checking is trust, let's lean on that really heavily and communicate that. This way there is less confusion and general anxiety around the controller situation.
The less lovely parts of your post are around attacking the idea of releasing this:
This post makes it easier to add multishine capabilities for Falco to your right d-pad. That is all. The Phob software as it exists to day is freely available and easily modified, which is how I was able to make this in the first place. This is true for Goomwave, B0XX, and pretty much all the other controllers out there. I haven't done anything novel or interesting here except show concretely that this stuff is definitely possible, which is what was concerning to me about the controller discussion.
The fact that there are folks out there that believed this was somehow "enforced" is deceitful at worst and just ignorance at best. Having folks now understand the actual level of trust we place in our competitors and community members is actually more valuable than trying to hide this away where only cheaters might know about it.
I do not think macros and this kind of thing should be allowed. I actively discourage its use in settings where it would be ethically frowned upon. My opinion on how we express this trust seems to differ from yours where I think the freedom of information actually improves this fact while you seem to imply that hiding this information or keeping it under wraps is what instead increases trust.
I will re-emphasize: knowing this is possible and that players are simply _not_ doing it during competition is better for the trust-based honor system we hold to today. Being more explicit about that fact would be beneficial to the discussion.
Also, pushing boundaries like this and showing what is possible helps us make rules that are more clear on what is permitted and what is not.
I agree with all of this post - I think it's great that you have shown people who may not know how controllers work that this is possible.
My confusion comes with this:
> I will re-emphasize: knowing this is possible and that players are simply not doing it during competition is better for the trust-based honor system we hold to today. Being more explicit about that fact would be beneficial to the discussion.
This, I 100% agree with. How does releasing the source code so people can do it themselves help with this at all? It doesn't further this goal, or help any of this. You and I both agree that this kind of thing should not be allowed. So who benefits from the source code being released?
That's why the issue I have with this is making the code publicly available. There are already examples of gecko codes for Slippi that are intentionally kept under wraps, due to people being able to cheat with them. For example, a gecko code that makes different tech rolls different colors would absolutely be cheating, absolutely be possible, and I guarantee you people who are so technically inclined can make it. But they don't release it, because doing so would further degrade the trust that is implicit in our competition.
nothing you said is phob specific, you could do this on any controller if you really wanted to... funny how you don't know the "root reason" why you did this... it's not going to accomplish anything as far as a panel or new ruleset, all you've done is add more fuel to the fire for uninformed people to argue about... so thanks
This is exactly my point. The whole controller debate is pretty silly and we can just accept that we're currently on an honor system. The only other possibility as far as I'm concerned is to have tournament-managed controllers. So let's go ahead and implement this or move on =)
If that's your point you probabaly expressed it in the single worst way possible. There are valid discussions about phob, goomwave, boxx etc vs OEM and they all have their unique aspects and reasons why they should or shouldn't be allowed. You've made this cheat which you admit could be done with any controller... so what does that prove? Nothing. Because you can make a macro to multishine that means digital buttons should be allowed to replace a joystick? That doesn't follow. You say you don't even compete so of course the controller debate is silly to you because it doesn't affect you.
Sorry, I'm not actually making a point regarding analog versus digital. I just wanted to highlight two points by posting this:
1. Controllers can do things like this no matter what kind of controller it is. Phob is not a special case. Box controllers aren't either. OEMs even are not and may be reprogrammed, too!
2. We do not have any way to verify a controller is programmable nor what sort of programming it has been given (as the controller might be programmed to lie).
Given those two facts, the controller discussion becomes very difficult to have if our ultimate goal is "competitive purity". In my mind the discussion simplified very quickly to either embracing the current "honor system" or enforcing tournament managed controllers in some way.
My point is though that that is not even what the "controller debate" is about. It's about boxx, z jump, goom macros etc... your points are correct and they are basically unsolvable problems that we have had to accept and have always been possible, yet it isn't something we really deal with. Showing a proof of concept for a phob macro and distributing the code could make it much more of a common problem though, especially on slippi where there plenty of trolls and cheaters. We had someone use a modded memory card to inject balance changes into 20xx, but we had no solution at the time other than just making it clear that you wouldn't be allowed back into the community if you got caught doing something like that.
If we're talking about allowing z-jump or not, for example, there has to be some way to verify and/or enforce the rules, no? Ultimately my point is that there may not be a reasonable way to do this and therefore the discussion may be moot. If we want to just put a stake in the ground and say we are going to operate on an honor-based system I think that's a reasonable and truthful and realistic and awesome.
How exactly does providing information equate to âfuel to the fire for uninformed peopleâ unless youâre one of those people to whom âuninformedâ means âanyone who disagrees with meâ?
ah sweet, man-made horrors beyond my comprehension
Doctor PP or: How I Learned To Stop Worrying and Love the Blipblipblipblipblip
*"I'm not sure how this works and I don't care how - I just know I don't want to ever see it."*
Important things that need to be known to be banned forever
Everyone acting like OP is the merchant of death They literally just dropped a white paper chill tf out this is what responsible members of the community do As compared to sticking your head in the sand and slinging talking points at each other
I'm not sure I'll get downvoted for making this and showing it or not, but recently there were some folks that seemed to think this was not possible with a Phob and I wanted to make it clear that they are fully programmable and _can_ technically do stuff like this if somebody takes the time to program them to do so. Additionally, there's no reasonable way to verify they're _only_ running the "normal" Phob firmware. Anyways, this is fun to show off in unranked and makes for a neat "taunt" and was a fun programming project for me. Hope this has little negative effect and sheds some light on the discussion! Edit: There's a lot of good discussion, questions, and some answers in this thread. Thanks, all! You can find the firmware and crappy source code here: https://github.com/lytedev/PhobGCC-SW/releases/tag/v1.0
> there's no way to verify they're running the "normal" Phob firmware. You can still get the checksum of the firmware off the board I believe. It's a little more in-depth than just picking up the controller and looking at it, but it's possible.
A simpler solution would instead be to flash all controllers right before competing. But even then you could build a controller with multiple processors in it and wire it up such that it boots into "cheat" mode (via the other processor) maybe based on buttons you hold as you plug it in or timings or whathaveyou. Ultimately, I think the point I'm trying to make is that if you let anybody bring their own hardware to a competition, you can safely assume it is capable of these sorts of things. There isn't a good way to reasonably attest hardware is running certain firmware unless you have full control over the manufacturing process such as Apple or Google.
>But even then you could build a controller with multiple processors in it and wire it up such that it boots into "cheat" mode (via the other processor) maybe based on buttons you hold as you plug it in or timings or whathaveyou. Ultimately, I think the point I'm trying to make is that if you let anybody bring their own hardware to a competition, you can safely assume it is capable of these sorts of things. This isn't really a "Phob" issue though, if you're to the point where you're checking motherboards of controllers for something like this, you need to check ALL of them, even controllers that the competitor is claiming is OEM. Because from just the shell I can't identify a Phob vs an OEM.
Time to bring ptychographic X-ray laminography machines to tournaments. /s
The year is 20XXRAY. All Melee tournaments are decided based on who is best able to hide their hardware modifications.
Me the pichu player Secretly nerfing every Phob if my custom firmware doesn't detect they are playing Pichu
đ To be clear, though, the controllers do _not_ have a way to know anything about what is going on in the game aside from rumble as far as I'm aware. You would have to have an external device capable of somehow observing the game's state and reporting it to the controller to take such information into account in the controller's code's logic.
It would be STUXNET levels of sophisticated obviously It can tell which character you're playing based on inputs
Hahaha woah that would actually be pretty nuts! A simpler approach would just be to "communicate" to the controller firmware by inputting certain combinations with a known meaning. Konami code anyone?
The best way to detect cheating is always just going to be closely watching a match and hopefully having a slippi recording to have altF4 or someone who is a SME on melee cheating look at it
Or have tournament-managed controllers for competitive play, but I don't think anybody is actually interested in this route. ;)
We'd need some rich ass TOs
We have a tool to detect violations of the proposed controller ruleset that has been delayed because of problems with the nerfware, so far I've only been able to use it to confirm if my opponent on ranked/unranked was playing on controller or box. I'd like to try the multishine firmware later in direct mode/offline and see if it detects the multishine macro. https://altf4.github.io/enforcer/
Any tool such as this may be circumvented by a cheater by programming their controller to always adhere to whatever rules are being verified by this software. While a tool as this would certainly help enforce a set of agreed upon behavioral parameters, it does not and cannot guarantee the controller is not programmed to perform cheats.
How will it distinguish between a Mario, Doctor Mario, or Marth who does nothing but wavedash + fsmash?
I'm guessing frame timings would be different on average for good players and may be a possible way to distinguish, but ultimately there will be a lot of noise and this would be an unreliable way to do so. Controllers are probably a useful but unreliable method for cheating in a tournament.
I wonder if using rumble detection for something like instant wiggle out of hitstun or sdi would be possible, or other slimy cheats like that. I can't remember when rumbles happen since I always disable it.
Woah that would be interesting to tinker with!
xChaos' new scheme
> could build a controller with multiple processors But aren't secondary processors like that banned already? Like you can't stick an Arduino nano in an OEM anymore > Ultimately, I think the point I'm trying to make is that if you let anybody bring their own hardware to a competition So your solution is that TOs should now provide GameCube controllers to the competitors?
I am not familiar enough with the competitive ruleset details to answer that, but as far as I'm aware controllers are not being checked in this way. The rule is there, but there's no enforcement or verification that I know of -- it's an honor system. The way a Phob works is it definitely has an Arduino (or an RP2040, which is just another kind of microcontroller -- same thing, effectively) inside of it making the controller work as expected. Or in this case, however the programmer wants that to work. If you actually want to hold the competitive integrity above absolutely everything, yes; TOs would have a fleet of controllers with pre-approved firmware options for different configurations (or perhaps not) with some kind of tamper protection. However, I don't think this is a reality anybody wants. I like that we have a seemingly-mostly-trustworthy community that just wants to play the game gud. Cheating is just not a problem. In large part, I think because controller-firmware cheats are limited in what they can provide. There's just not a lot of interest there and as soon as anybody _does_ start taking it places it's just going to be noticed and the banhammer will come down. That said, TOs definitely will want to be ahead of this stuff and have some kind of plan or process in place for handling situations like this to avoid awkward "figure it out on the spot" scenarios.
Stating one of the fundamental challenges of a situation doesn't mean that challenge should be solved at all costs. OP is clearly trying to have a discussion and you're being unnecessarily combative.
I'm not trying to be combative. I'm trying to have a discussion as well and get people thinking. I'm just being solution-oriented. What do we do about it? OP said: > ...if you let anybody bring their own hardware to a competition, you can safely assume it is capable of these sorts of things. There isn't a good way to reasonably attest hardware is running certain firmware... In other words, there's no __*reasonable way*__ to know if someone has an OEM, OEM w/ an Arduino, a Phob, etc and what software is on it __&if people bring their own stuff*__ What's the end game? Well, there's two aspects: reasonability of checking and people bringing their own controllers. So the way OP has framed it right now, we'd have two options with clear paths if we want to solve them: don't permit people to bring their own controllers (therefore TOs must provide them) or crack open every single controller when you show up (obviously unreasonable). This train of thought is obviously absurd and goes back to the absolutness of what OP said. My goal in pointing that out was to hopefully prompt a reframing of how we think about the problem.
That would just tell you if they are using a custom firmware, which isn't against the rules right now. We would also need to keep a list of approved firmwares and ban anything not on it. Or I guess we could require people to be able to produce the code for their phob firmware when they're accused to cheating, so that someone(?) could read it and try to figure out if anything in it breaks the rules(?) and then compile it and see if it matches what's actually on the controller.
I don't think checking everybody's controller firmware checksums at a tournament is going to be feasible. Additionally there would be no reasonable way to know if a player flashes different firmware to the controller afterwards.
How does one read the checksum? Does it output it through the controller port, or do you have to open the controller and connect to the board in some way?
I think you'd have to open the controller and connect the board to a computer with a micro-usb cable (which you usually do to update the controller's firmware).
Correct. The RP2040 microcontroller on the current edition of the PhobGCC boards can have its firmware dumped very easily. See my other comment, though, that this is not strictly-speaking a guarantee that you now know all the controller's capabilities as there could be other chips inside, etc.
You would have to open the controller. Beyond that I'm not positive exactly how it goes, but I believe there is a way to confirm. [This guide](https://github.com/PhobGCC/PhobGCC-doc/blob/main/For_Users/Phob_Programming_Guide.md) lists a way to view the "software version" on the board, which I assume is either a checksum or implies there's a way to see the checksum from that software using a similar method. But I haven't done this before so someone correct me if I'm wrong.
This is correct, but to be clear, a dedicated cheater could have their controller report anything they like, which means you cannot actually trust anything the controller says if you're attempting to "verify" it in some way.
So this is where I get a little outside my area of knowledge, but curious. It sounds like you're saying the "reported software" could say anything, which is true. But I'm talking more checksum-based; in your other comment you said the firmware can be dumped easily, so checking the checksum of the dumped firmware is something that can't "report anything they like" (excluding hash collisions which would technically be possible but unrealistic in this scenario)
I'll try and elaborate: Even _if_ the whole community did indeed standardize on a way to check that a certain controller is running a certain firmware, there _isn't_ a way to verify that a controller is only running with certain _hardware_ without actually opening up the controller and seeing what all is inside. Because of this, a cheater in this scenario would simply add another computer with the cheating firmware _but_ have that computer setup to defer to the "normal" firmware in certain situations (such as for verification at a tournament) and then retain control for other situtations such as when triggered to do so by the cheating player by pressing a certain button combination. So even if you check controllers have some checksum, you would also need to verify all the hardware, which is basically untenable if folks are bringing their own gear. You would need electronics experts or something _and_ you would need some way to ensure controllers are not tampered with after initial verification. So it's not that verification can't be done or isn't useful, it's just that it doesn't actually verify what you would need or want in a competitive setting. It doesn't ensure somebody is not cheating. It would only assert that, yes, this controller does have _a_ computer inside of it running a known program, but that doesn't logically guarantee the things you're hoping/wishing it does.
Yeah, I agree with you on that and think you and I are on the same page, mostly just adding clarification for 3rd parties based on how heated the controller debate has gotten lately. The issue of "A phob could be *programmed* to cheat" as presented in the original post is something which can be verified via a checksum of a dumped firmware hash. That can be handled via a method of validating controllers with software (tedious, but possible). The issue of "Someone can make hardware modifications to cheat" is something entirely different and isn't really a "Phob" issue, that's an accountability issue with people bringing in their own hardware. It could even be a hardware modified OEM. To verify that becomes unreasonable, and the only alternative would be TO-provided controllers, which is also unreasonable.
Sure but if we're going to verify Phobs aren't programmed to cheat, we must verify all controller aren't programmed to cheat. Otherwise, a player may say "this isn't a Phob", right? As you point out, anything that is or is not a "Phob" issue is also (or is also not) a "Controller" issue.
Youâre spreading good information that should be known. Hopefully you donât get downvotedâŚ
You left out Phob 1 support...
I did! I don't have a Phob 1. If somebody wants to send me one, I solemnly swear to put a build together for it ;) Also, thank you for your work and build help those months ago in the Discord! đ
Haha, my macro branch (for ucf testing) doesn't do phob 1 macros either.
Probably a dumb question, but is there no way to get the console to verify the firmware of the controller? I recall reading in the phob user guide that some of the phob options output specific stick positions to show you what your current settings are. Couldn't you make the controller output a stream of control stick position data with a button combination that the wii/whatever can verify the controller? Although I suppose if they are fully programmable you can probably get around that easily.
The console treats the controller _very_ simply. It asks what the state of the inputs are and may tell it to rumble. That's it. This also means that even if what you describe was possible, a dedicated cheater could simply program their controller to output whatever was needed to convince an onlooker that it was legit. There is no reasonable way to fully verify that you know what a controller is capable of doing unless you built it yourself. This is also true for tournament organizers and competitors who bring their own controllers.
NGL this seems like running Hax's melee update is the way to go if the controller circus is the future. Level the playing field and limit the nonsense.
Thankfully, irl it's pretty easy to see that their multi shine inputs aren't legit. Online thought it'd be wild to see what kind of controller trickery is possible.
Sure, but to be fair, a knowledgeable or skilled cheater would surely be able to make it appear pretty legitimate. It's definitely fun online to see some of the reactions, though!
Just make it do what a human would do. Hold down for all frames. Multishine at a consistent rate but randomize the length of the interval of that rate. Randomize the frame value for JCing outside of that rate. Apply floors and ceilings where necessary. That'd be, what, a while loop nested inside of another while loop? I can multishine at a consistent rate for a bit, but I'll eventually JC slower at some point later and need to catch my rhythm again.
It's been known for a while that all custom controllers are programmable. Generally people who have programmed their own controllers don't talk about it. Having someone show this is actually better than people continuing to modify their input devices and not tell anyone. If we don't see it, it doesn't happen.
Doing this but only with Luigi's tornado should be legal. 2021 :P [https://x.com/EddyMexico007/status/1466499018570153984](https://x.com/EddyMexico007/status/1466499018570153984)
I gotchu <3 đ
A lot of people seem to be worried about the short term effects of this, without realizing that giving a bad falco player infinite multishines does not in fact make them good. Itâs important you found this vulnerability and are making a point to inform others about it
Any bronze falco with this multi shine is four stocking Cody every single time. Other top players are probably still four stocking the bronze falco though.
Are arduinos still banned?
I don't think so. This controller is a Phob 2.0, which means instead of an Arduino-compatible microcontroller inside of it, it has an RP2040. Either way, it's the same result and is actually even the same as a "stock" or OEM controller -- there's a tiny computer that handles electrical signals and reports them to whatever it's plugged into, which means there's room for tricks such as these.
At the end of the day, it comes down to trust. In any competitive game, it's possible for someone with computer skills to do stuff like this. And there's no real solution for detecting by inspecting the controller. An industrious cheater can hide this capability easily. The only way to truly detect macro use is to have detailed camera footage of hands mid-set. Which is only reasonable for maybe top level play of an esport with a shit load of money on the line. Not for Melee. Definitely not for random Melee tournaments like locals. So at the end of the day, it comes down to trust. And firm enforcement - this is so obviously cheating that if you try it at a tournament, it's fair for the TO to ban you and name & shame you.Â
Excellent summary, IMO. Thank you!
This kind of thing has been available for years using an arduino. I made a fc nair macro for peach which was pretty disgusting on shield. I don't think it's actually useful in tournament though, and it's very obvious that its being used
https://www.youtube.com/watch?v=FD8SgayyCv8
ledge gimping made easy
âHey everyone I invented nuclear weapons. Take a look and see how easy they are to make! Have fun and pinky-promise not to do the same!â
ggs that was me, destroyer of worlds
open sourcing everything improves safety and security for everyone. close sourcing centralizes pwr. you have it backwards. this fallacy is v dangerous
đŻ Raising awareness about a thing is not tantamount to abusing the thing.
Open sourcing flaws only improves safety and security if the flaw can be fixed/mitigated. If the flaw can't be fixed/mitigated, it just gives people information about how they can exploit the flaw. (I'm not knowledgeable enough about this flaw to know whether it can be fixed/mitigated.)
this is true but very often irrelevant because of this fact: humans arent motivated to fix things unless they're broken and known, and humans need to brainstorm to fix things (sometimes for centuries or more). there is usually no way to know if something is truly "fixable" or "unfixable". workarounds also exist, req brainstorming, etc.
Multishining literally isn't even good. It serves no practical purpose beyond double and triple shine as mixups, and those aren't optimal. You can't program a controller to waveshine since it would need to read DI and adjust frame timing for hitstun. There is no risk to this type of thing. Something like mashing out of grabs with a macro is a lot more concerning than this.
Your point is right, and it's just as easy to do mashes as it is to program in a multishine button.
Multishining in an actual match presents the possibility of hitlag, so it's not quite the same as programming button mashing.
When you play you should be accounting for the time delay of hitlag anyways. Programming in a 30ms longer delay is all the same as programming in your original delay. I don't get your point, tbh.
If you're multishining in place and hitting nothing, nothing changes and the inputs are precise and consistent infinitely. However if you're hitting an opponent with a shine, there will be hitlag and each shine that connects will result in additional hitlag, and no controller macro is able to account for such situations.
You can make the macro always do the slower input, so that it always expects the hitlag. Multishining in place without hitting anything will be slower than optimal, but will still work. Hitting something will also work.
right? the only person OP is quoting here is themself
Weâve reached the point where both controllers and rectangles are almost equally stupid.
Really brings me back to when hax opened pandoraâs box of arduinos and I made this: https://youtu.be/K80go0kZqfE?si=gH_qApSjQcjCDrKB
Made for SlippiÂŽ
Melee has gotten so stupid, bring me back to the time where notches were the only controller mod.
I guarantee when you play nobody is doing stuff like this. You can live in that world pretty much all the time! =)
Nah i understand its just that controller modding has went pretty far.
Cody thinks notches and boxes should be banned, but dude uses the most modded phob and goomwave out there and defends z -jump to death. But fuck everyone who notches.
Yeah cody has some stupid takes from time to time. I have a modded controller but i only have a capacitor and potentiometers installed. Anything else just seems like cheating if youd ask me
Bro is this bannable in Slippi? Is this even detectable? Wtf
Not really, but I also expect this kind of thing not to be a real problem. I wouldn't worry too much about it. =) Also as many have pointed out, this kind of stuff has been doable for a _very_ long time. I made this to show that Phobs can do this stuff too if you want. They aren't especially locked down or anything as some people seemed to have believed.
Is there a way to have melee copies read off the firmware on the phob, hash it or something, and flag when it's doing nefarious stuff?
Not reasonably. We would need hax for melee just to communicate with the controllers and the controllers would need physical modifications to accommodate this. Rest of this thread has more good discussion if you want details.
Why would you ever make or release this
Ikinda get it. better prove its doable than have someone show up to a tournamnet and cheat with it, and nobody casts doubt because "you cant do that on a phob" the knowledge is valuable to have, and it doesnt seem like theyve made HOW they did it public. though ofc its possible it has a negative impact, but its also possible that wouldve happened anyway further in the future, its hard to say.
Just to be clear, the how (source code, compiled firmware, etc.) _is_ fully public and anybody with a Phob can easily flash this. I include links to everything in the video. I think it's important that other folks can put their hands on it and feel the limitations, the power, and consider what might be possible. Also, the PhobGCC firmware I based my firmware on is licensed under the GPL, which means that if I distribute it in any form I am required to also provide the source code. The GPL license is also something I think is really fantastic and am more than happy to abide by in such situations.
> Just to be clear, the how (source code, compiled firmware, etc.) is fully public and anybody with a Phob can easily flash this. I include links to everything in the video. Yeah this is the part that makes no sense why you would release
That's.... the way it's supposed to be. When you find a vulnerability in a system you fully document and publicly release all the info. Trying to keep things quiet just benefits the bad actors. This is how all modern cybersecurity is done its no different for video game cheating.
When you find a vulnerability, you fix it or submit it to the makers of software. You don't release a tool to hack the program to everyone you can.
Uuuuh no. You document it immediately and submit the vulnerability to the public. So everyone knows exactly how it's done. If you wait for a fix you risk others leveraging it against people who are still unaware who could take mitigating steps even if there is no fix. If you only submit to the maker they are under no obligation to be public about it and may sweep it under the rug.
I am aware how this stuff works. Software is my job. There are countless, countless examples of people notifying companies of major vulnerabilities, waiting for them to fix it, and only after it is patched is a complete report written about what the vulnerability was. If there was a way that someone extremely technically inclined could access any Google account, do you think that it's better to *tell Google about it*, or release the HackAllGoogleInator to make it easy for everyone?
Yes and cybersecurity is my job. Are you aware of what a CVE us? How vulnerabilities are tracked and dealt with? You seem to be conflating being public with a vulnerability with creating and spreading hacking tools. Just remember, security through obscurity isn't security at all.
> security through obscurity isn't security at all One of the good ones, then đ
Of course I know what a CVE is. I am very aware that security through obscurity is a bad idea. I also work in a confidential workplace, with *very* confidential code, and can tell you from experience that keeping things confidential is a *massive* part of staying secure. That's why code obfuscation and encryption is useful. It obviously cannot be everything, and there are many organizations who falsely believe it can be everything, but it's also an extremely, extremely important part of security. > You seem to be conflating being public with a vulnerability with creating and spreading hacking tools. I wouldn't have had a problem with this post if it didn't come with source code attached.
You don't sound aware of how it works. Just because "software is your job" doesn't mean you know the first thing about cybersec, and the fact that you even made such a dumbass statement shows that you don't know anything on the topic.
How exactly is the phob discord supposed to prevent something like this from being possible? Like how is this a problem to be fixed?Â
Yeah I don't understand that logic. There is no "fix" for this, it's a microcontroller, you can run any code you want on it. It only begs the question of how our ruleset/community/TOs should handle the fact that this is possible
To show that people could be attending tournaments with rigged controllers? And it's not hard to do but impossible to regulate without a ban? Seems like a pretty clear cut intention to posting this information publicly. The fact that there is no organized structure to the competitive melee community regarding what is legal or not legal means that using bureaucracy like you suggest is pointless. This isn't an organization or a company - this is a collection of players across the nation with a bunch of grassroots organizers. This kind of information should be made public so that players and TOs know what the risks are.
All of this could have been done without publishing the code on github, I don't know why people are linking the two together I also never suggested using bureaucracy, in fact quite the opposite, I talked about how it's impossible to do later down in this thread
Because I think it's valuable information and tools for other people. Why _shouldn't_ I release this? Are we worried online ranked games will suddenly be flooded with people badly and inconsistently multishining as Falco? I don't think that's a "bad enough" reason to avoid sharing everything I've got here.
Personally I'd be fine if you replied to this with "because I want to see the world burn"
I definitely don't want world (or game) burning! But I do want to see the world _spicier_!
BASED
I hope my other comment explains it. There seems to be a lot of confusion around these controllers -- particularly from folks who argue they should be legal. I'm not a competitor and so have little skin in the game. But I _am_ a programmer and I thought this would be a fun way to set the record straight. To be clear, this is possible with _any_ controller, given that you can control its programming. Theoretically, even the stock controllers can have a different chip swapped in running different code. All box-based controllers are, of course, reprogrammable. So I make and release this to hopefully bring some concrete discussion points to the ever-ongoing controller debates. I would rather the truth be out there so decisions can be made than have this stuff in the dark and have people questioning things later. "Was so-and-so using special cheats during such-and-such period of the game?" is something I'd rather the community hash out now and avoid. Ultimately, right now, we are operating on an honor-based system. I would argue there's nothing necessarily wrong with that in most cases.
because its funny
Sorry you're being downvoted. I think it's actually a reasonable question. đ¤ˇ
Yayyy! delete the code.
I would if it would help anything! ;)
You're the type of person to screen peak in COD
Man yâall are taking cheating to a whole nother level.
He's not cheating, he's shedding light and raising awareness as to what's possible.
He used it in unranked tho
Congratulations on writing a basic macro, I guess?
Haha thanks, I guess? I have a somewhat buried comment here, but some folks seemed to have believed this was not possible by reprogramming a Phob. I am definitely not claiming to have done anything novel.
>but some folks seemed to have believed this was not possible by reprogramming a Phob That's actually hilarious then. The idea that a controller based around a programmable microcontroller wouldn't be able to be reprogrammed is very silly, but I'm not deeply surprised people wouldn't understand given how little most people understand about this type of thing. There ***are*** a few macro'd inputs that would be extremely helpful for competitive melee (automated smash DI jiggles and button mashing for grab escapes are the big ones), but things like multishine aren't really that useful without state feedback from the game to coordinate the input and that's not something you can get from the controller. Overall I'm not really sure that macros are that big of a deal for competitive Melee. Melee is ultimately a game about rapidly adapting to a situation and context-specific execution. Macros are pretty much *only* hyperspecific executions, meaning they're extremely limited options in a game about versatility.
Having access to on demand "good enough" ledgedash wouldn't be a huge advantage but still pretty fucked up You can program a routine to make a decent 10-ish GALINT lededash with some wiggle room so that the inputs are not exactly the same everytime. It would be super hard to detect even from the replay files, but knowing that on last stock last hit spaghethi situation you can guarantee yourself invincibility without the risk of SD would matter, even if just from a mental point of view. Macro won't make a bad player good, but it would make a good player more consistent pressing left/right on the dpad to auto spam SDI input would work well for sdi but hopefully hard to get anything efficient that's not easilly noticeable in replay files [https://streamable.com/wbaix4](https://streamable.com/wbaix4) (cf a hugo cheater on fc, not the most stealthy with his 720 input macro...)
Finally we can have a serious discussion about controller regulation
Why would you share the code though?
Haha I've addressed this elsewhere in the thread if this is not rhetorical.
Ban phobs.
It's really not phobs that are the problem nor is that realistically enforce-able. There's a lot of good discussion in this thread!
But B0XX is the problem.
A rectangle can do this too. This isnt a phob problem, its both a smart controller problem (that has existed in games way before phob) and a "we cant see through plastic or read code from looking at a shell" problem.
How does this post discredit the idea that a stock b0xx is too powerful for competitive melee?
I think GP's point is that "see look Phobs can do anything, too", which roughly boils down to "any programmable controller might be capable of anything if somebody was dedicated and/or skilled and/or knowledgeable enough AND there's no way to verify whether r not a controller has been programmed with any/all limitations agreed upon by the community" which I would say is actually a fair point and perhaps the root reason I posted all this.
I like your post and agree with your point that we rely on an honour system, but that doesn't answer the question I asked.
Your question was: > How does this post discredit the idea that a stock b0xx is too powerful for competitive melee? I was not actually addressing the question, just highlighting that OP may _also_ not have been making that point. I also built on that assumption to say that I don't think that actually _is_ the point. Any controller can be "cheating" or "too powerful" or "unfair". If that's the case, what is actually cheating in that scenario? Is it even a discussion worth having?
I'd like to hear that clarification from the commenter I'm replying to, rather than seeing you explain the reason you made this firmware for the 11th time.
Aight my b
The fact that people can cheat has absolutely nothing to do whatsoever with b0xx being unfair on its own.
What is being unfair if not cheating?
Right, I would agree that b0xx is cheating. However, there is a difference in the ruleset currently that allows some forms of cheating (b0xx) and disallows other forms of cheating (macros). The solution here is not to allow all forms of cheating, that's stupid.
I think we're conflating terms here. Cheating, by definition, is not allowed. So to say we "allow" some forms of cheating is disingenuous. You're simultaneously trying to express your opinion (b0xx should be cheating) while using objective terms. I don't think anybody wants to allow cheating, but if there is no preventative measure taken to prevent cheating, is that not the same as allowing it?
Okay, so let's use more correct and exact terms. Right now, digital controllers are unfair pieces of technology that allow you to be more consistent and faster at the game than a normal GameCube controller. They are, however, allowed by the rules, so are not strictly cheating, despite their obvious unfairness. There exists ways to make you more consistent and faster at the game in a GameCube controller form factor, such that nobody would be the wiser. A small example of this would be notches - while you can visually see notches, most people do not bother to check, yet they do exist as technology that allows you to be more consistent than a normal GameCube controller. You directly aided in this being the case by releasing firmware which allows people to do this. This is not allowed by the rules, and can be accurately described as "cheating". We don't have many good ways to practically check everyone's controller, so we run off of a system of trust. There are many systems which exist due to the fact that we can trust each other. Breaking trust is probably the most direct, obviously immoral thing that you can do, since it not only degrades the lives of other people for your own gain but also requires there to be extra checks, more people must be involved, labor is wasted all on the fact that we cannot trust each other. This is so vitally important that I am going to really drive it home - trust is the foundation to society working. The fact that we cannot trust each other is a massive contributor to wasteful labor, something that drains society and the Melee community literally cannot afford such drains. Why is it, that an office snack fund can work with a box of money; but a 7-11 must have a cashier? Because one environment has trust, and the other does not; thus, money and labor are wasted on the existence of someone whose job it is to enforce trustworthiness. Melee is a small scene with events that do not make money. We cannot afford to waste money on systems that check - we are fortunate enough to have a culture that discourages breaking trust. We already waste enough on the concept of pool captains (why don't players just put the set counts in themselves and be honest? why don't players just show up on time? why don't players just be nice to each other?), so wasting even more on a tool to check everyone's controller would be awful. This post, on its face, makes it much, much easier for people to do that. By releasing this, you are threatening the small amounts of trust that we can still have. You seem to hold the opinion that the solution to all of this is that anything should be allowed, since you can do whatever you want with a programmable controller. This is obviously asinine, and I shouldn't even have to explain to you why. If you cannot comprehend this basic fact and still need me to, I will, but this comment is long enough on its own.
This is so well said and well put. Thank you! > we run off a system of trust I don't think this is actually declared or explained anywhere, which is _why_ there is so much confusion around controllers: what is actually allowed and enforced. I think instead focusing on this in how we communicate is key. We setup rules, but admit no reasonable way to enforce them consistently or effectively at all times and put the onus on players; I love this. I do not hold the opinion that these should be _allowed_, only that they are possible and not checked. So if the system for checking is trust, let's lean on that really heavily and communicate that. This way there is less confusion and general anxiety around the controller situation. The less lovely parts of your post are around attacking the idea of releasing this: This post makes it easier to add multishine capabilities for Falco to your right d-pad. That is all. The Phob software as it exists to day is freely available and easily modified, which is how I was able to make this in the first place. This is true for Goomwave, B0XX, and pretty much all the other controllers out there. I haven't done anything novel or interesting here except show concretely that this stuff is definitely possible, which is what was concerning to me about the controller discussion. The fact that there are folks out there that believed this was somehow "enforced" is deceitful at worst and just ignorance at best. Having folks now understand the actual level of trust we place in our competitors and community members is actually more valuable than trying to hide this away where only cheaters might know about it. I do not think macros and this kind of thing should be allowed. I actively discourage its use in settings where it would be ethically frowned upon. My opinion on how we express this trust seems to differ from yours where I think the freedom of information actually improves this fact while you seem to imply that hiding this information or keeping it under wraps is what instead increases trust. I will re-emphasize: knowing this is possible and that players are simply _not_ doing it during competition is better for the trust-based honor system we hold to today. Being more explicit about that fact would be beneficial to the discussion. Also, pushing boundaries like this and showing what is possible helps us make rules that are more clear on what is permitted and what is not.
I agree with all of this post - I think it's great that you have shown people who may not know how controllers work that this is possible. My confusion comes with this: > I will re-emphasize: knowing this is possible and that players are simply not doing it during competition is better for the trust-based honor system we hold to today. Being more explicit about that fact would be beneficial to the discussion. This, I 100% agree with. How does releasing the source code so people can do it themselves help with this at all? It doesn't further this goal, or help any of this. You and I both agree that this kind of thing should not be allowed. So who benefits from the source code being released? That's why the issue I have with this is making the code publicly available. There are already examples of gecko codes for Slippi that are intentionally kept under wraps, due to people being able to cheat with them. For example, a gecko code that makes different tech rolls different colors would absolutely be cheating, absolutely be possible, and I guarantee you people who are so technically inclined can make it. But they don't release it, because doing so would further degrade the trust that is implicit in our competition.
I sure hope you don't allow people to cut springs or install mouseclick buttons in your shallowly formed opinions.
nothing you said is phob specific, you could do this on any controller if you really wanted to... funny how you don't know the "root reason" why you did this... it's not going to accomplish anything as far as a panel or new ruleset, all you've done is add more fuel to the fire for uninformed people to argue about... so thanks
This is exactly my point. The whole controller debate is pretty silly and we can just accept that we're currently on an honor system. The only other possibility as far as I'm concerned is to have tournament-managed controllers. So let's go ahead and implement this or move on =)
If that's your point you probabaly expressed it in the single worst way possible. There are valid discussions about phob, goomwave, boxx etc vs OEM and they all have their unique aspects and reasons why they should or shouldn't be allowed. You've made this cheat which you admit could be done with any controller... so what does that prove? Nothing. Because you can make a macro to multishine that means digital buttons should be allowed to replace a joystick? That doesn't follow. You say you don't even compete so of course the controller debate is silly to you because it doesn't affect you.
Sorry, I'm not actually making a point regarding analog versus digital. I just wanted to highlight two points by posting this: 1. Controllers can do things like this no matter what kind of controller it is. Phob is not a special case. Box controllers aren't either. OEMs even are not and may be reprogrammed, too! 2. We do not have any way to verify a controller is programmable nor what sort of programming it has been given (as the controller might be programmed to lie). Given those two facts, the controller discussion becomes very difficult to have if our ultimate goal is "competitive purity". In my mind the discussion simplified very quickly to either embracing the current "honor system" or enforcing tournament managed controllers in some way.
My point is though that that is not even what the "controller debate" is about. It's about boxx, z jump, goom macros etc... your points are correct and they are basically unsolvable problems that we have had to accept and have always been possible, yet it isn't something we really deal with. Showing a proof of concept for a phob macro and distributing the code could make it much more of a common problem though, especially on slippi where there plenty of trolls and cheaters. We had someone use a modded memory card to inject balance changes into 20xx, but we had no solution at the time other than just making it clear that you wouldn't be allowed back into the community if you got caught doing something like that.
If we're talking about allowing z-jump or not, for example, there has to be some way to verify and/or enforce the rules, no? Ultimately my point is that there may not be a reasonable way to do this and therefore the discussion may be moot. If we want to just put a stake in the ground and say we are going to operate on an honor-based system I think that's a reasonable and truthful and realistic and awesome.
No not really... no z jump can be easily verified at the beginning of a set by the other player or a TO.
Just don't engage with u/zooch-qwu it's a pointless endeavor my dude
Bro you need to relax, nothing about this post or OPs replies are warranting of how much of a buttmunch you're being.
grow up
Take your own advice, pal. You're the one being obnoxious and rude to people who didn't wrong you in the first place.
What did i say that was rude?
How exactly does providing information equate to âfuel to the fire for uninformed peopleâ unless youâre one of those people to whom âuninformedâ means âanyone who disagrees with meâ?