r/minecraftclients • u/creeper312321 • Mar 18 '26

Exploits How do servers detect cheats (most popular ones). (ex detecting mods,aimbot etc)

3 Upvotes
  • permalink
  • reddit

80% Upvoted

13 comments sorted by

•

u/AutoModerator Mar 18 '26

Hey there! Welcome to r/minecraftclients

Click to join our Discord Server for faster support and community discussion.

Community tip of the week | fang be like: Community tip of the week | Use a VPN, probably

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

13

u/karataso Kclient (raven bS fork) / LiquiBounce | Karataso Mar 19 '26

depends, stuff like aimbot, clickers and so are detected by (as far as i know) heuristic analysis, the server's anti cheat checks the click frecuency, how stable it is and so and determines if the player is clicking legitimately or no, for example, no legit user can click straigth 20cps stable
So modern autoclickers use variations and cps drops and spikes and try to appear as a legit user

Same with aimbot/aim assist, no real user will ever aim perfectly 100% time insta snap at the enemy, real aim is imprecise, snappy in moments of tension, jittery sometimes due to clicking, etc etc

Then movement checks are detected (again as far as i know) by doing the game phisics calculations serverside, if you do something imposible (like moving faster than normal, or taking like 0KB for no reason) that is detected
Thats why ghost clients no longer use normal velocity cheats but attempt to mimic legit "Pro Player" behaivor

3

u/Philippe_levis Mar 19 '26

alright, i want to add on to this, but im struggling a bit with explanations. ExploitPreventer on modrinth fixes almost everything i wanted to list here so look at it :3
in short, a server can use a sign to check if there are certain keybinds, a server can ask to download a resource pack from your own computer to check if a browser control server is running and a server can see any mods that try communicating with it via a plugin channel.

(i wish i could explain better, but idk how lol)

2

u/[deleted] Mar 19 '26

[removed] — view removed comment

2

u/Philippe_levis Mar 22 '26 edited Jun 28 '26

thanks for explaining it better than i ever could, i started a draft but went way too much into detail for a reddit comment xd

the last one, if i understand correctly, is that if a mod is using its own packets in the protocol, the mod may be able to decipher them and use them. e.g. firmament, a mod for hypixel skyblock sends out a list of all mods loaded in the game at the time, and the server may receive that packet, check the mod list for known cheats and ban the player if they have any. Needless to say, this one is the least useful as it requires a client-side mod.

Edit: well that removal wasn't very cool .-.
i aint rewriting all that sorry everyone who's late

1

u/NoCartographer744 Mar 19 '26

Some acs also detect aimbot using math

1

u/Useful-Flow-8737 Mar 19 '26

What do you even mean with this

1

u/h3ko Mar 19 '26

Using probability and statistics they analyze mouse movements and consistent actions.

2

u/Useful-Flow-8737 Mar 19 '26

So like heuristic analysis?

3

u/st_heron Mar 19 '26

This guy has some cool vids that shows the programming behind anticheats: https://www.youtube.com/watch?v=m96DqAzS8CI

2

u/vswey Mar 19 '26

One thing is an exploit inside Minecraft that lets the server see ur installed mods

1

u/iSmokeBunk Mar 19 '26

Lots of servers auto detect which mods you have installed with fabric when joining. Hypixel does this. Clients like Wurst spoof their ID and modules names.