Operations and Anti-Cheat

Server moderation records, tier testing, and screenshare forensics for detecting injected Minecraft client modifications.

Tier Testing

In Minecraft CPvP (Crystal PvP), players duel tier testers to earn tiers on community tier lists. I tested applicants on the Vanilla Tier List (VTL), Light Tiers, and Lunar Tiers to assign verified tier rankings (LT5 to HT3), with a personal peak of High Tier 3 (HT3) Vanilla (currently Low Tier 3 (LT3)).

During tier-tests, I evaluated player mechanics:

• Mechanics such as hit crystals, anchors, safe anchors, crystaling speed, and toteming speed.
• Client inputs and behavior for unusual reach distances, triggerbots, and cheats/macros that deviate from human mechanical limits.

Server Moderation

• VanillaPvp Club Server and Community Moderator
  Moderated competitive community channels and matches. Handled player report tickets, reviewed duel footage for suspected reach modifications and cheats/macros, and enforced server rules and player sanctions.
• Cpvpprac Moderator and Anti-Cheat Investigator
  Cpvpprac is a Crystal PvP practice server. I monitored live matches and investigated anti-cheat alerts on TotemGuard. Because connection latency can trigger false flags, my job was to distinguish network drops from packet injection, freeze suspected players for screenshare inspections, and issue IP bans against ban-evading accounts.
• Decree SMP and EgyPrac Server Moderator
  Moderated active survival CPvP servers. Handled rule enforcement, player reports, and security investigations, including tracking accounts and IP ranges involved in doxxing threats and player harassment.

Screenshare Forensics

Screensharing involves freezing a suspected player in-game and inspecting their system over Discord or AnyDesk to identify hidden or deleted cheats. Modern ghost clients are engineered to bypass automated scanner utilities, requiring manual artifact analysis.

Process Memory and JVM Inspection

Ghost clients inject into javaw.exe or attach via the Java Instrumentation API. During a live screenshare, I inspect process memory and JVM thread state:

• Dumping process strings using System Informer to search for known cheat package paths, hook definitions, and obfuscated class names.
• Capturing running thread stacks with jstack to locate unmapped or external threads outside standard client and Fabric/Forge loaders.
• Checking open DLL handles to identify injected dynamic libraries.

Operating System Execution Artifacts

Even if a player deletes a cheat binary before an investigation, Windows logs process executions across several persistent artifacts on disk.

In C:\Windows\Prefetch, the operating system creates a .pf hash file whenever an executable runs, logging run counters and execution timestamps. When a cheat loader is deleted from disk, its corresponding prefetch file remains in this directory until rolled over.

The Background Activity Moderator (BAM) registry key located at SYSTEM\CurrentControlSet\Services\bam\State\UserSettings logs full absolute file paths and timestamps for binaries run by each user account.

On NTFS filesystems, the USN change journal ($UsnJrnl) records file system events including creations, renames, and deletions. Parsing the journal reveals whether files were deleted immediately after an in-game freeze command was issued.

Packet Timing and Autototem Detection

Autototem cheats swap totems into the offhand slot immediately after a totem pop. Differentiating legitimate defensive reaction from automated script execution requires analyzing packet intervals:

• Human players exhibit reaction latency variance, typically between 80ms and 180ms (can differ from person to person), with irregular mechanical click spacing.
• Automated swap scripts send packets at fixed millisecond offsets or zero-tick intervals, causing slot desync alerts on the server.