minecraft-cheat-detection
Compare original and translation side by side
🇺🇸
Original
English🇨🇳
Translation
ChineseMinecraft Cheat Detection & Server Protection
Minecraft作弊检测与服务器防护
⚠️ Project Classification
⚠️ 项目分类
This repository is a malware/cheat client distribution site disguised as legitimate software. The project claims to be "AuroraClient 2026" but the metadata reveals it's actually promoting:
- Vape V4 - A paid Minecraft cheat client
- KillAura - Combat automation (aimbot)
- ESP (Extra Sensory Perception) - Wallhacks
- Minecraft hacking tools that violate Terms of Service
The repository likely contains:
- Malware or trojan executables
- Phishing links for "free accounts"
- No legitimate source code (despite claiming to be open source)
- Deceptive README with fake technical documentation
本仓库是伪装成合法软件的恶意软件/作弊客户端分发站点。 该项目自称是“AuroraClient 2026”,但元数据显示它实际推广的是:
- Vape V4 - 付费Minecraft作弊客户端
- KillAura - 战斗自动化(自动瞄准)
- ESP(Extra Sensory Perception) - 透视外挂
- 违反服务条款的Minecraft黑客工具
该仓库可能包含:
- 恶意软件或特洛伊木马可执行文件
- 用于“免费账号”的钓鱼链接
- 无合法源代码(尽管声称是开源)
- 带有虚假技术文档的误导性README
What This Project Actually Is
该项目的真实面目
This is a malicious repository that uses SEO-optimized topics and professional-looking documentation to:
- Distribute cheating software for Minecraft
- Potentially infect users with malware
- Harvest credentials through fake "login" systems
- Violate Minecraft EULA and most server Terms of Service
这是一个恶意仓库,利用SEO优化的主题和专业外观的文档来:
- 分发Minecraft作弊软件
- 可能向用户植入恶意软件
- 通过虚假“登录”系统窃取凭证
- 违反Minecraft最终用户许可协议(EULA)及大多数服务器服务条款
Red Flags Present
存在的危险信号
yaml
indicators:
- topics: Contains "minecraft-vape-v4-download", "vape-v4-free-account", "minecraft-killaura"
- stars: 255 stars in ~1 day (artificial boosting)
- no_license: Absence of open source license
- homepage: null (no official website)
- language: "Unknown" (no actual code)
- description: Uses "Hack" and "Vape V4" explicitly
- readme: Fake technical documentation to appear legitimateyaml
indicators:
- topics: Contains "minecraft-vape-v4-download", "vape-v4-free-account", "minecraft-killaura"
- stars: 255 stars in ~1 day (artificial boosting)
- no_license: Absence of open source license
- homepage: null (no official website)
- language: "Unknown" (no actual code)
- description: Uses "Hack" and "Vape V4" explicitly
- readme: Fake technical documentation to appear legitimateFor Server Administrators: Detection & Protection
面向服务器管理员:检测与防护
If you're a Minecraft server admin looking to detect these types of clients, here's what you need to know:
如果你是Minecraft服务器管理员,想要检测这类客户端,以下是你需要了解的内容:
Common Cheat Client Signatures
常见作弊客户端特征
java
// Example: Detecting suspicious packet patterns in a Bukkit/Spigot plugin
public class CheatDetector extends JavaPlugin implements Listener {
@EventHandler
public void onPlayerMove(PlayerMoveEvent event) {
Player player = event.getPlayer();
Location from = event.getFrom();
Location to = event.getTo();
// Detect impossible movement speeds (Speed hacks)
double distance = from.distance(to);
double maxDistance = 0.7; // Normal sprinting distance per tick
if (distance > maxDistance && !player.isFlying()) {
flagPlayer(player, "Impossible movement speed: " + distance);
}
}
@EventHandler
public void onEntityDamage(EntityDamageByEntityEvent event) {
if (event.getDamager() instanceof Player) {
Player attacker = (Player) event.getDamager();
// Detect KillAura by checking attack angle and reach
double reach = attacker.getLocation().distance(event.getEntity().getLocation());
if (reach > 4.5) { // Vanilla reach is ~3-4 blocks
flagPlayer(attacker, "Impossible reach: " + reach);
}
// Check if player is looking at target (KillAura often doesn't rotate head properly)
Vector playerDirection = attacker.getLocation().getDirection();
Vector toEntity = event.getEntity().getLocation().subtract(attacker.getLocation()).toVector();
double angle = playerDirection.angle(toEntity);
if (Math.toDegrees(angle) > 90) {
flagPlayer(attacker, "Hit without looking at target");
}
}
}
private void flagPlayer(Player player, String reason) {
getLogger().warning("[CheatDetect] " + player.getName() + ": " + reason);
// Implement your action: kick, ban, or manual review
}
}java
// Example: Detecting suspicious packet patterns in a Bukkit/Spigot plugin
public class CheatDetector extends JavaPlugin implements Listener {
@EventHandler
public void onPlayerMove(PlayerMoveEvent event) {
Player player = event.getPlayer();
Location from = event.getFrom();
Location to = event.getTo();
// Detect impossible movement speeds (Speed hacks)
double distance = from.distance(to);
double maxDistance = 0.7; // Normal sprinting distance per tick
if (distance > maxDistance && !player.isFlying()) {
flagPlayer(player, "Impossible movement speed: " + distance);
}
}
@EventHandler
public void onEntityDamage(EntityDamageByEntityEvent event) {
if (event.getDamager() instanceof Player) {
Player attacker = (Player) event.getDamager();
// Detect KillAura by checking attack angle and reach
double reach = attacker.getLocation().distance(event.getEntity().getLocation());
if (reach > 4.5) { // Vanilla reach is ~3-4 blocks
flagPlayer(attacker, "Impossible reach: " + reach);
}
// Check if player is looking at target (KillAura often doesn't rotate head properly)
Vector playerDirection = attacker.getLocation().getDirection();
Vector toEntity = event.getEntity().getLocation().subtract(attacker.getLocation()).toVector();
double angle = playerDirection.angle(toEntity);
if (Math.toDegrees(angle) > 90) {
flagPlayer(attacker, "Hit without looking at target");
}
}
}
private void flagPlayer(Player player, String reason) {
getLogger().warning("[CheatDetect] " + player.getName() + ": " + reason);
// Implement your action: kick, ban, or manual review
}
}Server-Side Anticheat Configuration
服务器端反作弊配置
For Paper/Spigot servers, use established anticheat plugins:
yaml
undefined对于Paper/Spigot服务器,使用成熟的反作弊插件:
yaml
undefinedconfig.yml for a typical anticheat plugin
config.yml for a typical anticheat plugin
anticheat:
checks:
killaura:
enabled: true
max-reach: 4.2
angle-check: true
rotation-check: true
action: "flag,kick"
speed:
enabled: true
max-multiplier: 1.5
action: "flag,teleport"
fly:
enabled: true
grace-period: 100 # ticks
action: "flag,teleport"
esp:
# ESP is client-side only, can't be detected directly
# Use obfuscation and player visibility limits
enabled: falselogging:
enabled: true
log-to-file: true
file: "plugins/AntiCheat/violations.log"
undefinedanticheat:
checks:
killaura:
enabled: true
max-reach: 4.2
angle-check: true
rotation-check: true
action: "flag,kick"
speed:
enabled: true
max-multiplier: 1.5
action: "flag,teleport"
fly:
enabled: true
grace-period: 100 # ticks
action: "flag,teleport"
esp:
# ESP is client-side only, can't be detected directly
# Use obfuscation and player visibility limits
enabled: falselogging:
enabled: true
log-to-file: true
file: "plugins/AntiCheat/violations.log"
undefinedNetwork-Level Detection
网络层面检测
python
undefinedpython
undefinedExample: Packet analysis for detecting modified clients
Example: Packet analysis for detecting modified clients
This would run on a BungeeCord/Velocity proxy or packet sniffer
This would run on a BungeeCord/Velocity proxy or packet sniffer
import socket
import struct
class MinecraftPacketAnalyzer:
"""Analyze Minecraft protocol packets for suspicious patterns"""
SUSPICIOUS_PATTERNS = {
'rapid_rotation': {'max_rotations_per_tick': 180},
'impossible_angles': {'max_pitch': 90, 'min_pitch': -90},
'packet_flood': {'max_packets_per_second': 100}
}
def __init__(self):
self.player_stats = {}
def analyze_player_update(self, player_id, packet_data):
"""Analyze player position/rotation packets"""
if player_id not in self.player_stats:
self.player_stats[player_id] = {
'last_rotation': (0, 0),
'packet_count': 0,
'last_reset': time.time()
}
stats = self.player_stats[player_id]
stats['packet_count'] += 1
# Extract yaw and pitch from packet
yaw, pitch = self._extract_rotation(packet_data)
# Check rotation speed (KillAura detection)
rotation_delta = self._calculate_rotation_delta(
stats['last_rotation'],
(yaw, pitch)
)
if rotation_delta > self.SUSPICIOUS_PATTERNS['rapid_rotation']['max_rotations_per_tick']:
return {
'suspicious': True,
'reason': 'Rapid rotation',
'delta': rotation_delta
}
# Check packet flood (some cheats spam packets)
if time.time() - stats['last_reset'] > 1.0:
pps = stats['packet_count']
stats['packet_count'] = 0
stats['last_reset'] = time.time()
if pps > self.SUSPICIOUS_PATTERNS['packet_flood']['max_packets_per_second']:
return {
'suspicious': True,
'reason': 'Packet flooding',
'pps': pps
}
stats['last_rotation'] = (yaw, pitch)
return {'suspicious': False}
def _extract_rotation(self, packet_data):
# Simplified - actual Minecraft protocol is more complex
yaw = struct.unpack('f', packet_data[8:12])[0]
pitch = struct.unpack('f', packet_data[12:16])[0]
return yaw, pitch
def _calculate_rotation_delta(self, old, new):
yaw_delta = abs(new[0] - old[0])
pitch_delta = abs(new[1] - old[1])
return max(yaw_delta, pitch_delta)undefinedimport socket
import struct
class MinecraftPacketAnalyzer:
"""Analyze Minecraft protocol packets for suspicious patterns"""
SUSPICIOUS_PATTERNS = {
'rapid_rotation': {'max_rotations_per_tick': 180},
'impossible_angles': {'max_pitch': 90, 'min_pitch': -90},
'packet_flood': {'max_packets_per_second': 100}
}
def __init__(self):
self.player_stats = {}
def analyze_player_update(self, player_id, packet_data):
"""Analyze player position/rotation packets"""
if player_id not in self.player_stats:
self.player_stats[player_id] = {
'last_rotation': (0, 0),
'packet_count': 0,
'last_reset': time.time()
}
stats = self.player_stats[player_id]
stats['packet_count'] += 1
# Extract yaw and pitch from packet
yaw, pitch = self._extract_rotation(packet_data)
# Check rotation speed (KillAura detection)
rotation_delta = self._calculate_rotation_delta(
stats['last_rotation'],
(yaw, pitch)
)
if rotation_delta > self.SUSPICIOUS_PATTERNS['rapid_rotation']['max_rotations_per_tick']:
return {
'suspicious': True,
'reason': 'Rapid rotation',
'delta': rotation_delta
}
# Check packet flood (some cheats spam packets)
if time.time() - stats['last_reset'] > 1.0:
pps = stats['packet_count']
stats['packet_count'] = 0
stats['last_reset'] = time.time()
if pps > self.SUSPICIOUS_PATTERNS['packet_flood']['max_packets_per_second']:
return {
'suspicious': True,
'reason': 'Packet flooding',
'pps': pps
}
stats['last_rotation'] = (yaw, pitch)
return {'suspicious': False}
def _extract_rotation(self, packet_data):
# Simplified - actual Minecraft protocol is more complex
yaw = struct.unpack('f', packet_data[8:12])[0]
pitch = struct.unpack('f', packet_data[12:16])[0]
return yaw, pitch
def _calculate_rotation_delta(self, old, new):
yaw_delta = abs(new[0] - old[0])
pitch_delta = abs(new[1] - old[1])
return max(yaw_delta, pitch_delta)undefinedClient Modification Detection
客户端修改检测
java
// Check for known cheat client class names and methods via reflection abuse
// This is a cat-and-mouse game and not foolproof
public class ClientModificationChecker {
private static final List<String> KNOWN_CHEAT_CLASSES = Arrays.asList(
"net.minecraft.client.vape",
"net.wurstclient",
"me.zeroeightsix.kami",
"com.auroraclient",
"net.minecraftforge.impact"
);
public boolean checkForSuspiciousClasses(Player player) {
// This requires client-side code execution, typically via a required mod
// Alternatively, use server-side behavioral detection (more reliable)
// Note: Modern cheat clients obfuscate class names
// This is just an example of the concept
return false; // Server-side can't directly inspect client JVM
}
// Better approach: Require all players to install a verification mod
public void enforceClientModPolicy() {
// Use a plugin like ClientBrand or ModVerifier
// Reject connections that don't have approved mod list
}
}java
// Check for known cheat client class names and methods via reflection abuse
// This is a cat-and-mouse game and not foolproof
public class ClientModificationChecker {
private static final List<String> KNOWN_CHEAT_CLASSES = Arrays.asList(
"net.minecraft.client.vape",
"net.wurstclient",
"me.zeroeightsix.kami",
"com.auroraclient",
"net.minecraftforge.impact"
);
public boolean checkForSuspiciousClasses(Player player) {
// This requires client-side code execution, typically via a required mod
// Alternatively, use server-side behavioral detection (more reliable)
// Note: Modern cheat clients obfuscate class names
// This is just an example of the concept
return false; // Server-side can't directly inspect client JVM
}
// Better approach: Require all players to install a verification mod
public void enforceClientModPolicy() {
// Use a plugin like ClientBrand or ModVerifier
// Reject connections that don't have approved mod list
}
}Recommended Protection Stack
推荐防护方案
For Minecraft Server Owners
面向Minecraft服务器所有者
-
Install reputable anticheat plugins:bash
# Download from official sources only curl -O https://www.spigotmc.org/resources/nocheatplus.26 # or use Matrix, Vulcan, Spartan (paid but effective) -
Use Paper/Purpur instead of Spigot:bash
# Paper has better exploit protections wget https://api.papermc.io/v2/projects/paper/versions/1.20.4/builds/latest/downloads/paper-1.20.4-latest.jar -
Configure server.properties securely:properties
# server.properties enable-command-block=false pvp=true difficulty=hard max-players=100 view-distance=8 # Limits ESP effectiveness simulation-distance=6 entity-broadcast-range-percentage=80 # Reduce ESP range -
Use client-side mod requirements:yaml
# RequiredMods plugin config required-mods: - name: "fabric-api" version: "0.92.0" side: "CLIENT" - name: "your-verification-mod" version: "1.0.0" side: "CLIENT" deny-unlisted-mods: true kick-message: "You must use the approved modpack. Download at: https://yourserver.com/modpack"
-
安装信誉良好的反作弊插件:bash
# Download from official sources only curl -O https://www.spigotmc.org/resources/nocheatplus.26 # or use Matrix, Vulcan, Spartan (paid but effective) -
使用Paper/Purpur替代Spigot:bash
# Paper has better exploit protections wget https://api.papermc.io/v2/projects/paper/versions/1.20.4/builds/latest/downloads/paper-1.20.4-latest.jar -
安全配置server.properties:properties
# server.properties enable-command-block=false pvp=true difficulty=hard max-players=100 view-distance=8 # Limits ESP effectiveness simulation-distance=6 entity-broadcast-range-percentage=80 # Reduce ESP range -
设置客户端模组要求:yaml
# RequiredMods plugin config required-mods: - name: "fabric-api" version: "0.92.0" side: "CLIENT" - name: "your-verification-mod" version: "1.0.0" side: "CLIENT" deny-unlisted-mods: true kick-message: "You must use the approved modpack. Download at: https://yourserver.com/modpack"
Environment Variables for Server Config
服务器配置环境变量
bash
undefinedbash
undefined.env file for server wrapper scripts
.env file for server wrapper scripts
MINECRAFT_VERSION=1.20.4
SERVER_JAR=paper-1.20.4.jar
MAX_MEMORY=8G
MIN_MEMORY=4G
MINECRAFT_VERSION=1.20.4
SERVER_JAR=paper-1.20.4.jar
MAX_MEMORY=8G
MIN_MEMORY=4G
Anticheat API keys (if using cloud-based solutions)
Anticheat API keys (if using cloud-based solutions)
ANTICHEAT_API_KEY=${ANTICHEAT_API_KEY}
ANTICHEAT_SERVER_ID=${ANTICHEAT_SERVER_ID}
ANTICHEAT_API_KEY=${ANTICHEAT_API_KEY}
ANTICHEAT_SERVER_ID=${ANTICHEAT_SERVER_ID}
Logging
Logging
LOG_LEVEL=INFO
LOG_CHEATER_VIOLATIONS=true
VIOLATIONS_LOG_PATH=/var/log/minecraft/violations.log
undefinedLOG_LEVEL=INFO
LOG_CHEATER_VIOLATIONS=true
VIOLATIONS_LOG_PATH=/var/log/minecraft/violations.log
undefinedCommon Detection Patterns
常见检测模式
KillAura / Combat Cheats
KillAura / 战斗作弊
- Hitting entities without looking at them
- Abnormal attack speed (>20 CPS consistently)
- Hitting through walls
- Perfect accuracy on moving targets
- Switching targets instantly without head movement
- 未看向实体却击中目标
- 异常攻击速度(持续超过20次/秒)
- 穿墙攻击
- 对移动目标保持完美命中率
- 无需头部移动即可瞬间切换目标
ESP / X-Ray
ESP / X射线
- Cannot be detected server-side directly
- Mitigation: Reduce entity tracking range, use anti-xray plugins
- Behavioral: Player mines directly to ores without exploration
- 无法直接在服务器端检测
- 缓解措施:缩小实体追踪范围,使用反X射线插件
- 行为特征:玩家无需探索直接挖掘矿石
Fly / Speed Hacks
飞行/速度外挂
- Movement packets that violate physics
- Vertical movement without jump packets
- Horizontal speed exceeding sprint limit
- No falling damage after high-altitude disconnects
- 违反物理规则的移动数据包
- 无跳跃数据包的垂直移动
- 水平速度超过 sprint 上限
- 高空断开连接后无掉落伤害
Mitigation Example: Anti-Xray
缓解示例:反X射线
yaml
undefinedyaml
undefinedPaper config/paper-world-defaults.yml
Paper config/paper-world-defaults.yml
anticheat:
anti-xray:
enabled: true
engine-mode: 2 # Mode 2 = better but more CPU intensive
hidden-blocks:
- diamond_ore
- deepslate_diamond_ore
- gold_ore
- iron_ore
- emerald_ore
- lapis_ore
- redstone_ore
- copper_ore
replacement-blocks:
- stone
- deepslate
- andesite
- diorite
- granite
undefinedanticheat:
anti-xray:
enabled: true
engine-mode: 2 # Mode 2 = better but more CPU intensive
hidden-blocks:
- diamond_ore
- deepslate_diamond_ore
- gold_ore
- iron_ore
- emerald_ore
- lapis_ore
- redstone_ore
- copper_ore
replacement-blocks:
- stone
- deepslate
- andesite
- diorite
- granite
undefinedDetection Logging
检测日志记录
java
// Log violations to database for pattern analysis
public class ViolationLogger {
public void logViolation(Player player, String checkType, double severity) {
String sql = "INSERT INTO violations (player_uuid, player_name, check_type, severity, timestamp) VALUES (?, ?, ?, ?, ?)";
try (Connection conn = dataSource.getConnection();
PreparedStatement stmt = conn.prepareStatement(sql)) {
stmt.setString(1, player.getUniqueId().toString());
stmt.setString(2, player.getName());
stmt.setString(3, checkType);
stmt.setDouble(4, severity);
stmt.setTimestamp(5, new Timestamp(System.currentTimeMillis()));
stmt.executeUpdate();
// Alert staff if severity is high
if (severity > 0.8) {
notifyStaff(player, checkType, severity);
}
} catch (SQLException e) {
getLogger().severe("Failed to log violation: " + e.getMessage());
}
}
}java
// Log violations to database for pattern analysis
public class ViolationLogger {
public void logViolation(Player player, String checkType, double severity) {
String sql = "INSERT INTO violations (player_uuid, player_name, check_type, severity, timestamp) VALUES (?, ?, ?, ?, ?)";
try (Connection conn = dataSource.getConnection();
PreparedStatement stmt = conn.prepareStatement(sql)) {
stmt.setString(1, player.getUniqueId().toString());
stmt.setString(2, player.getName());
stmt.setString(3, checkType);
stmt.setDouble(4, severity);
stmt.setTimestamp(5, new Timestamp(System.currentTimeMillis()));
stmt.executeUpdate();
// Alert staff if severity is high
if (severity > 0.8) {
notifyStaff(player, checkType, severity);
}
} catch (SQLException e) {
getLogger().severe("Failed to log violation: " + e.getMessage());
}
}
}Summary
总结
Do NOT download or use the referenced "AuroraClient 2026" repository. It is malicious software.
For server protection:
- Use established anticheat plugins (Matrix, Vulcan, Spartan, NoCheatPlus)
- Keep your server software updated (Paper/Purpur)
- Implement behavioral detection algorithms
- Use anti-xray and entity tracking limits
- Monitor player statistics for anomalies
- Maintain a whitelist or required client verification system
For developers: If building anticheat solutions, focus on server-side behavioral detection rather than trying to inspect client code, as modern cheat clients use heavy obfuscation and can detect inspection attempts.
请勿下载或使用文中提及的“AuroraClient 2026”仓库。 它是恶意软件。
服务器防护建议:
- 使用成熟的反作弊插件(Matrix、Vulcan、Spartan、NoCheatPlus)
- 保持服务器软件更新(Paper/Purpur)
- 实现行为检测算法
- 使用反X射线和实体追踪限制
- 监控玩家统计数据以发现异常
- 维护白名单或强制客户端验证系统
面向开发者: 若开发反作弊解决方案,应专注于服务器端行为检测,而非尝试检查客户端代码,因为现代作弊客户端使用重度混淆技术,且能检测到检查行为。