
Mirror AntiCheat
Filters sensitive outgoing packets, analyzes incoming packets, and detects cheaters
Mirror AntiCheat is a server-side anti-cheat designed to help server administrators detect cheating, malicious behavior, and alternate accounts, while providing tools to investigate.
The project focuses on being compatible with the latest Minecraft version (26.1+) and avoiding any false flag.
This project uses mixins to filter and analyze at the packet level. However, these mixins are currently not at a low enough level to be completely compatible with other mods
Dependency
This mod requires Ignite to work with Paper, Spigot, Bukkit and Purpur.
Next updates
You can suggest on the Github or on the Discord
- Support for Sponge
- Configuration for ingoing and outgoing packets
- Option to disable the auto antialt check
- Fix #1
- Fix #2
/mirror freezecommand
Known bugs
Clients receive a damage tilt when their food levels change and their health are not full
- https://github.com/Solmeye/Mirror-Anticheat/issues/1
- Versions :
0.38.0-alpha - Loader :
Paper
The client can decide when to use the auto resolver
When the client finishes loading a world, it sends the packet handleAcceptPlayerLoad, which automatically triggers the autoresolver. This happens with a Vanilla client, during a change of world (Overworld to Nether)
- https://github.com/Solmeye/Mirror-Anticheat/issues/2
- Version :
0.38.0-alpha - Loader :
All
Packet analysis
Ingoing
The following incoming packets are scanned for impossible or suspicious behavior
[None]
Outgoing
Subsequent outgoing packets are filtered and fake the data when a Vanilla client cannot distinguish the difference. This is done in order to prevent or limit the effectiveness of a cheat
ClientboundPlayerCombatEndPacket
- Packet
Cancelled
ClientboundPlayerCombatEnterPacket
- Packet
Cancelled
ClientboundSetExperiencePacket
- Field
ExperienceProgress
Lossless scrambling value accuracy
[To implement] Hides the value when it is not supposed to be exploitable (eg.when the locator bar is used)
- Field
TotalExperience
Hides the value
ClientboundSetHealthPacket
- Packet
Cancelled when the packet only update the saturation
- Field
Health
Lossless scrambling value accuracy
[To implement] Hides the value when it is not supposed to be exploitable (eg.when the gamemode is creative)
- Field
Food
[To implement] Hides the value when it is not supposed to be exploitable (eg.when riding a horse)
- Field
Saturation
Hides the value
Commands
-
/mirrorDisplays the mod version -
/mirror infoDisplays the mod version -
/mirror versionDisplays the mod version -
/mirror discordDisplays the Discord link -
/mirror modrinthDisplays the Modrinth link -
/mirror reloadReload the configuration -
/mirror profile <targets>Displays a player's profile (IP, latency, brand...) -
/mirror alt <targets>Try to detect alternative accounts -
/mirror crash <targets>Crashes a player's client -
/mirror schedule <command> <time>Schedules the execution of any command -
/mirror data <targets> <path> <value>Writes data to the json file associated with the player.s See https://datatracker.ietf.org/doc/html/rfc6901 -
/mirror webhook <message>Send a message through the webhook -
/mirror resolve <targets> <key>Resolves translation keys. Useful for detecting some resource packs or mods.
Configuration
Default configuration
{
"key": [
{
"identifier": "minecraft",
"keys": [
"key.forward",
"key.left",
"key.back",
"key.right",
"key.jump",
"key.sneak",
"key.sprint",
"key.inventory",
"key.swapOffhand",
"key.drop",
"key.use",
"key.attack",
"key.pickItem",
"key.chat",
"key.playerlist",
"key.command",
"key.socialInteractions",
"key.screenshot",
"key.togglePerspective",
"key.smoothCamera",
"key.fullscreen",
"key.advancements",
"key.quickActions",
"key.toggleGui",
"key.toggleSpectatorShaderEffects",
"key.hotbar.1",
"key.hotbar.2",
"key.hotbar.3",
"key.hotbar.4",
"key.hotbar.5",
"key.hotbar.6",
"key.hotbar.7",
"key.hotbar.8",
"key.hotbar.9",
"key.saveToolbarActivator",
"key.loadToolbarActivator",
"key.spectatorOutlines",
"key.spectatorHotbar",
"key.debug.overlay",
"key.debug.modifier",
"key.debug.crash",
"key.debug.reloadChunk",
"key.debug.showHitboxes",
"key.debug.clearChat",
"key.debug.showChunkBorders",
"key.debug.showAdvancedTooltips",
"key.debug.copyRecreateCommand",
"key.debug.spectate",
"key.debug.switchGameMode",
"key.debug.debugOptions",
"key.debug.focusPause",
"key.debug.dumpDynamicTextures",
"key.debug.reloadResourcePacks",
"key.debug.profiling",
"key.debug.copyLocation",
"key.debug.dumpVersion",
"key.debug.profilingChart",
"key.debug.fpsCharts",
"key.debug.networkCharts",
"key.debug.lightmapTexture"
],
"commandsOnEachFound": [
"mirror data %s \"fingerprint/translations/%c/0\" \"%t\"",
"mirror data %s \"fingerprint/translations/%c/1\" \"%k\""
],
"commandsOnEachNotFound": [
"kick %s Please remove your anti translation exploit software"
],
"autoresolve": true
}
],
"antiAlt": {
"scoreSuspicious": 65,
"scoreConfirmed": 90,
"scoreNormalCommand": [],
"scoreSuspiciousCommand": [
"mirror webhook \"`%s` is suspected of alting with [%i](https://namemc.com/%i)\\\\n-# Matching score : `%m`\""
],
"scoreConfirmedCommand": [
"mirror webhook \"`%s` is probably alting with [%i](https://namemc.com/%i)\\\\n-# Matching score : `%m`\\\\n-# Automatic action executed\"",
"mirror crash %s",
"ban %s Alting"
]
},
"delayAntiAltCheck": 30,
"ingoingFilter": {},
"outgoingFilter": {
"ClientboundSetHealthPacket": {
"enabled": true,
"options": {
"fakeSaturation": 20.0
}
}
},
"webhook": "",
"version": 1
}
Explanation
-
key-
identifierIdentifier where the key comes from. Used for display purposes only -
keysKey list -
commandsOnEachFoundCommand to execute for each key when resolved by autoresolve -
commandsOnEachNotFoundCommand to execute for each key when not resolved by autoresolve -
autoresolveAutomatically resolves this key group when connecting a player or not
-
-
antiAlt-
scoreSuspiciousThreshold to execute the commands associated. When the matching alt value is higher thanscoreSuspicious, it means that the match is suspicious and needs investigation. Min0Max100 -
scoreConfirmedThreshold to execute the commands associated. When the matching alt value is higher thanscoreConfirmed, it means that the match is confirmed an is an alternative account. Min0Max100 -
scoreNormalCommandCommands executed when the matching score is not suspicious or confirms an alt -
scoreSuspiciousCommandCommands executed when the matching score is suspicious -
scoreConfirmedCommandCommands executed when the matching score confirms an alt.
-
-
delayAntiAltCheck(In ticks) Delay before checking for alts after that a player joined your server. Higher values makes it easier to disconnect to avoid the scan. -
webhookWebhook of your Discord Webhook -
versionVersion of the configuration. Do not touch!
AntiAlt
The antialt system is not explained in detail to avoid easy bypass.
FAQ
How does this mod work?
Mirror AntiCheat modifies outgoing network packets to remove or alter data that a vanilla client does not rely on. This is intended to reduce unnecessary information exposure without affecting normal gameplay.
Is it possible to have a false flag?
Normally, no, with the default values.
What is the impact on performance?
Currently, no statistics have been compiled on the CPU impact. The impact can only be negative. However, due to the reduction in packets sent, bandwidth can be decreased.
Will this mod backport to previous versions of Minecraft 26.1?
No.
Can I install it on my client?
Yes. Please note, however, that this project may not work correctly if done.
What version should I update this project to?
Alpha versions may have unstable behavior.
Beta versions are relatively stable and will not pose a problem.
Releases are the most stable.
It is recommended to update this project to the latest beta or stable version, as appropriate
Is this compatible with [mod]?
To date, no incompatibilities have been reported. If you encounter any, please let me know.
