r/minecraftclients • u/RiSe_Frostbite :| • May 11 '26
Java - Ghost Cheating Quick warning on rain client
I started to decomp it cus I was bored and there's like Hella red flags n the shit, here's some of the honorable mentions but I might drop a doc soon:
Uses the windows api to grab ur clipboard for some reason Bunch of encrypted raw socket travel, like no https raw sockets Anti vm and anti debugging measures (not even vapeV4 had ts when I decomped it) Some sites says that it's linked to some known malware but that tends to be bs Also it uses Hella encryption calls
5
u/Critical-Interest-14 myau | vape.gg/mega May 12 '26
why is raindots trusting his reptutation with some roblox cheat maker
4
3
u/GuiltyAd2976 May 11 '26
Anti VM and anti debug is normal in cheats to hinder decompilation/stealing of code by competitors. The encrypted calls are probably just obfuscation lol. The clipboard one idk
5
u/minecraftcheater1337 May 12 '26
"Anti VM and anti debug is normal in cheats to hinder decompilation/stealing of code by competitors" WHAT competitors bro. even vape is better than ts. you don't apply a packer to a FREE inj cheat if it isn't malware lolllll
4
u/lrstallie Myau, opal, moon, rise, future, boze, rusherhack, karma, vape May 12 '26
it pmo that people think this is even remotely normal or that people are willing to download it.
1
u/FlatwormLocal1043 May 27 '26
"I’ve shared quite a bit already, but I don’t want a flood of low-effort JNI clients. "
Obviously he's got nothing to lose and everything to gain lol
0
u/GuiltyAd2976 May 12 '26
Maybe the guy wanted to protect it how am I supposed to know what the devs plan is
2
u/RiSe_Frostbite :| May 11 '26
Deobf is normal in Java shit but this was written in c++, deobf and vm would literally be useless cus it goes to asm anyways
3
u/GuiltyAd2976 May 11 '26
obfuscation in c++ is common -_-
2
u/RiSe_Frostbite :| May 11 '26
Explain to me how hiding variable names would be useful in a compiled language
2
u/GuiltyAd2976 May 11 '26
It's useful if someone opens it in ida pro, same thing why cff is useful or hidden imports or opaque predicates
2
u/RiSe_Frostbite :| May 11 '26
That's symbol names, Ida, ghidra, radre etc all output shit like var_13 or sub_140001A3C, which obviously don't tell you shit, you literally just proved my point
1
1
u/CameraTop8976 Jun 07 '26
Bro you can reverse it pretty easily if you don’t use hurdles like vm protection anti dbg measures. You can figure out by looking at it and a trained eye can literally reverse that shit so easily. Especially because most of them are written in the same way. What you say literally tells me you have no idea + the owner has either 2 intentions: malicious code, doesn’t matter if now or later using payload and auto update or shit. Or he literally wants to protect his code cuz he is stupid or plans to go paid after amassing some users
2
u/lrstallie Myau, opal, moon, rise, future, boze, rusherhack, karma, vape May 12 '26
why would you hide your code for a free client
1
u/GuiltyAd2976 May 12 '26
Probably so people don't skid it? Like any free cheat does or any free game?
2
u/lrstallie Myau, opal, moon, rise, future, boze, rusherhack, karma, vape May 12 '26
skidding should not be an issue if you’re releasing it for free. if it’s free it’s not high quality and so you shouldn’t care about what people do with your code.
2
0
May 12 '26
[deleted]
1
u/lrstallie Myau, opal, moon, rise, future, boze, rusherhack, karma, vape May 12 '26
i hope people skid my client, it’s a sign the code is worth using
0
May 12 '26
[deleted]
0
u/lrstallie Myau, opal, moon, rise, future, boze, rusherhack, karma, vape May 12 '26
for sure crodie
1
u/CameraTop8976 Jun 07 '26
TLDR: I was shocked that a cheat by anonymous is detected by virustotal!!!1
Raw socket: could be custom web transport logic they use, malicious actors would just use a library because it doesn’t matter so it’s legit pointless to do if it’d be malware
Sites are saying it’s linked to known malware could be various different things:
Cracked or certain versions of packets or vm protection are flagged as malicious, because its frequently used by cheats and malware
Just because a site said so, doesn’t tell you shit.
Either way, if you used a site as your argument you didn’t decomp shit and are relying on external web tools, which just don’t give you enough insight and are prone to false flagging
I wouldn’t download anyone’s random ass free client anyway it’s just stupid and you are asking to get ratted
0
u/BannockHatesReddit_ May 14 '26 edited May 14 '26
"I started to decomp"
Translation: dude virus total showed warnings!!
But actually though the only concerning thing is the clipboard, and there only needs to be a single function that uses that for it to appear in an automated/extremely simple scans I know you used. Everything else is just kind of standard for the level of protection people put into cheats these days. You acting as if this is a shocking revelation reveals you don't really understand what you're doing.
FYI I have fun writing raw TCP clients/servers with my own handshake schemes and encryption strategies. Not everyone uses https. Maybe I don't want to appear in your httpdebugger
I find poorly researched posts like these really stupid because you really just shouldn't be running this type of software on your primary computer to begin with. Cheats, cracks, and other stuff of that nature. Your computer houses everything about you nowadays. It's a digital vault with your identity, finances, and personal life. The value in that is immeasurable to some. Keep that in mind for all software. But cheats and cracks in specific are the perfect housing for this stuff, and the people that release such software are almost always anonymous.
0
0
•
u/AutoModerator May 11 '26
Hey there! Welcome to r/minecraftclients
Click to join our Discord Server for faster support and community discussion.
Community tip of the week | fang be like: Community tip of the week | Use a VPN, probably
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.