Detection Rules Documentation

Calculates angular offsets (yaw and pitch) toward target hitboxes using trigonometry (atan2, asin) and directly overrides the client player's camera orientation, forcing the crosshair onto targets automatically.

Automates Respawn Anchor crystal PvP mechanics. In Overworld PvP, placing a Respawn Anchor, loading it with Glowstone, and interacting with an empty hand causes a catastrophic explosion equivalent to charged TNT. This cheat executes all 3 actions within a single tick.

Instantly swaps the player's active hotbar slot to an axe the moment an opponent begins blocking with a shield, executes an attack that triggers vanilla shield disabling mechanics (5 seconds lockout), and switches back to a sword in 1 game tick.

In vanilla Minecraft combat, critical hits deliver +50% extra base damage and bonus spark particles, but the game engine strictly requires the attacker to be falling downwards (fallDistance > 0), not in water/lava, not climbing, and crucially: NOT sprinting. This combat module intercepts the attack action to momentarily clear the player's sprinting flag (setSprinting(false)) on the client tick before the attack packet is sent, allowing 100% guaranteed critical attacks while sprinting continuously forward at full sprint speed.

In vanilla Minecraft PvP, detonating a TNT Minecart requires manual sequential execution: placing a rail block, placing the TNT minecart, and instantly detonating it via an ignited arrow, charged crossbow, or flint and steel. Insta Cart modifications automate this entire sequence within several game ticks. By tracking bow charge duration or crosshair target coordinates, the mod programmatically releases the bow, alters pitch angles, swaps hotbar slots to rails, simulates block placement clicks, and places the TNT minecart directly into the arrow path, creating instantaneous fatal explosive damage.

Iterates through loaded world entities, filters for targetable players/mobs, sorts them by distance or remaining health using Comparators, and cycles automated attacks across multiple entities simultaneously.

In vanilla Minecraft, whenever a living entity jumps, `LivingEntity.jumpingCooldown` is set to 10 ticks (0.5 seconds). While this countdown is greater than zero, the player cannot initiate another jump from the ground. Cheat modifications reset `jumpingCooldown` to 0 on every client tick, allowing uninterrupted continuous jumping without ground friction delays, resulting in automated bunnyhopping and increased travel speed.

Dispatches synthetic micro-jump movement packets (PlayerMoveC2SPacket.PositionAndOnGround with y + 0.003, onGround = false) right as an attack occurs, forcing server-side critical strikes even while standing still, falling slowly, or trapped in cobwebs.

Crafts synthetic movement packets (PlayerMoveC2SPacket) with aimbot-computed yaw/pitch angles to transmit to the server while leaving the client player's local camera completely unaltered. The attacker looks straight ahead on screen while striking targets behind or beside them.

Automatically triggers attacks the exact millisecond the player's crosshair raycast intersects an enemy hitbox. Removes human visual reaction time delay (~150-250ms) entirely, guaranteeing an instant first strike whenever an enemy traverses the crosshair cone in duels.

Calculates high-frequency vector raycasts from the player camera eye coordinate to detect targets within custom spherical hit ranges, bypassing vanilla entity picking logic and triggering instant attacks before vanilla crosshair registration.

In vanilla Minecraft, End Crystals placed on obsidian or bedrock can be detonated by attacking them, delivering massive explosion damage often exceeding 10 hearts at point-blank range. Players leverage this mechanic in competitive "crystal PvP" by manually placing obsidian, right-clicking to place an end crystal, and timing melee attacks to explode it while minimizing self-damage. Auto_Crystal automates this entire combat loop. In the inspected cheat module from `com.larpclient.module.impl.AutoCrystalModule`, the modification executes `onTick()` during every client tick. When the activation trigger key is held, it checks the player's crosshair target. If an End Crystal (`class_1511`) is targeted or positioned over an obsidian base (`class_2246.field_10540`), `serviceBase()` either breaks an existing crystal via `tryBreak()` or immediately equips an End Crystal (`class_1802.field_8301`) and places it using `BlockHelper.interactBlock()`. The detonation in `tryBreak()` verifies distance limits against `range`, executes `attackEntity(player, crystal)` (`method_2918`), and triggers hand swinging (`method_6104`) with customizable tick delay counters (`breakDelay` and `placeDelay`). This automated loop allows clients to place and explode crystals far faster and more consistently than manual human clicking.

Despawns Armor Stands and Minecarts from the client-side world via Entity.remove(), removing raycast and crosshair obstructions so the player can attack enemies, place crystals, and throw ender pearls unhindered through entity-spam traps.

Spams projectile or velocity packets in a single game tick to create extreme velocity multipliers, propelling arrows or TNT with massive kinetic power.

Automates pathfinding, block breaking, and inventory management to strip-mine ores autonomously without human oversight.

Contains embedded Baritone pathing framework classes (baritone.api, baritone.pathing), granting full autonomous navigation, path calculation, and block placement.

In survival Minecraft, breaking a block requires a calculated duration based on the block hardness, the tool used, and active status effects (such as Haste or Mining Fatigue). During block breaking, the client dispatches `PlayerActionC2SPacket` with action types `START_DESTROY_BLOCK`, `ABORT_DESTROY_BLOCK`, and `STOP_DESTROY_BLOCK`. On the server side, `ServerPlayerInteractionManager.processBlockBreakingAction()` counts the elapsed ticks between start and stop actions, computing cumulative progress via `calcBlockBreakingDelta()`. The server only authorizes destruction if the progress reaches 1.0 (100%). In the inspected exploit module (`com.example.timer.mixin.ServerPlayerInteractionManagerMixin`), the method `timer$scaleStopValidation` acts as a server-side compensation hook for the Timer speed multiplier. When `STOP_DESTROY_BLOCK` arrives, the mixin calculates scaled ticks by multiplying elapsed ticks by `TimerState.get().tickMultiplier()` (`scaledTicks = Math.max(1, Math.round((this.field_14000 - this.field_20326) * multiplier))`). If the resulting mining progress reaches `0.7F` (70%), the method immediately calls `this.method_21717(pos, sequence, "destroyed")` and cancels vanilla processing via `ci.cancel()`, effectively lowering the required mining duration by 30% in addition to the tick speed multiplier. Because `ServerPlayerInteractionManager` resides in server-side game logic, this mixin only takes effect in singleplayer worlds, local integrated LAN hosts, or when installed directly on a server. On a remote multiplayer server, the remote server conducts authoritative validation, ignoring client-side mixins on server classes. Pure client-side FastBreak cheats targeting remote servers typically hook into `ClientPlayerInteractionManager` to eliminate the 5-tick `blockBreakDelay` or manipulate client-side packet dispatching. In legitimate modding, event libraries such as Fabric API (`ServerPlayerGameModeMixin`) also inject into `processBlockBreakingAction` to invoke event callbacks like `AttackBlockCallback` and `PlayerBlockBreakEvents.Before`, but do not modify destruction progress or invoke `finishBlockBreakingAction` (`method_21717`).

Directly overrides client world blocks with Blocks.AIR without server synchronization, allowing the player to look or phase through solid walls and terrain client-side.

Hooks entity collision calculation methods to inject artificial solid VoxelShape boxes, enabling the player to walk on empty air or stand on phantom surfaces.

In vanilla Minecraft, client-side physics, movement calculations, input polling, and local block breaking advance at a fixed baseline of 20 ticks per second (50 milliseconds per tick). In Minecraft 1.20.3+, Mojang introduced dynamic tick rate capabilities, delegating the per-tick duration calculation to `MinecraftClient.getTargetMillisPerTick()`. Timer cheats hook into this method to artificially divide the returned milliseconds per tick by a user-defined multiplier (for example, 2.0x or 3.0x). In the inspected timer module (`com.example.timer.mixin.MinecraftClientMixin`), `@Inject` hooks into the `RETURN` of `method_54785` with `cancellable = true`. If the cheat is active, it reads `TimerState.get().tickMultiplier()` and sets the return value to `cir.getReturnValueF() / multiplier`. This causes the client loop to execute multiple ticks within the time normally allotted for a single tick, allowing the local player to traverse terrain, process movement inputs, and cycle interactions faster in real-world time. When connected to an authoritative multiplayer server, the server maintains its own tick rate at 20 TPS regardless of the client's local configuration. An accelerated client will dispatch movement packets (`PlayerMoveC2SPacket`) and interaction packets at an abnormally elevated frequency relative to server elapsed time. Modern server-side anticheats monitor incoming packet intervals and flag such bursts as Timer or Speed violations. In legitimate contexts, Minecraft provides the official command `/tick rate <rate>` (introduced in 1.20.3) for server operators to synchronously adjust global simulation speed across all connected clients. Camera and cinematics utilities such as ReplayMod adjust rendering interpolation during offline timeline scrubbing and video rendering, but do not manipulate live competitive gameplay tick multipliers.

Directly constructs synthetic EntityHitResult objects and injects them into MinecraftClient.crosshairTarget, causing vanilla click handlers to register attacks on targets even when the crosshair points at empty space.

Instantiates hardcoded Box instances with extreme numeric expansion constants (>10.0 blocks), expanding hitboxes across entire arenas to hit opponents through walls from immense distances.

Runs an automated tick loop across all loaded client entities and updates every remote player's bounding box to expanded dimensions, keeping hitboxes perpetually enlarged regardless of server resets.

Hooks Entity.getBoundingBox() or Entity.getTargetingMargin() via Mixin annotations (@ModifyReturnValue, @Inject) to return an inflated bounding box, making players clickable and attackable far beyond their visible character model.

Subscribes to Forge render bus events (RenderPlayerEvent, RenderLivingEvent) to overwrite entity bounding boxes every time the game renders an entity.

Hooks WorldRenderer.renderEntity() via @Inject right before rendering frames to overwrite entity bounding boxes, ensuring hitboxes stay inflated every single frame without interfering with server tick synchronization.

Directly mutates enemy entities' axis-aligned bounding boxes using setBoundingBox() combined with Box.expand() or Box.stretch(), artificially enlarging the physical volume where attacks and projectile hits register.

Monitors the player's offhand slot. The millisecond the offhand Totem of Undying is consumed or destroyed, this module searches the inventory for a spare totem and swaps it into the offhand slot via clickSlot window packets in 0 ticks.

Monitors player health, totem counts, or enemy proximity. When health drops below a configurable threshold (e.g. 4 hearts) or zero totems remain, the client instantly severs the network connection to avoid losing gear in hardcore/anarchy servers.

In high-pace PvP situations, throwing an Ender Pearl requires manually selecting the item in the hotbar, right-clicking to throw, and switching back to weapons. AutoPearl / FastPearl exploits automate this sequence upon pressing a hotkey (such as the middle mouse button): the module searches the player's hotbar for an Ender Pearl, swaps the active slot, calls `interactItem` to throw the projectile immediately, and restores the previously equipped slot within 1 tick.

Automatically swaps utility items (Ender Pearls, Golden Apples, Potions, Obsidian) into hotbar slots the instant a keybind or health condition is triggered.

Refills TNT Minecarts, Bows, or Arrows into the active hotbar automatically from shulker boxes during combat duels.

Bypasses vanilla 4-tick right-click delay by resetting MinecraftClient.itemUseCooldown via Mixin Accessor, enabling machine-gun block placement, rapid EXP bottle throwing, and instant crystal spam.

Monitors totem destruction events (EntityStatusS2SPacket status 35) or health drop thresholds to immediately pre-fill the offhand before damage resolves.

Java applications running Minecraft operate in user space within the virtual machine. While some utility tools and server wrappers legitimately invoke external helper scripts or opening tools, in-game modifications rarely need to launch OS shell interpreters to execute network download utilities. Cmd_Curl_Dropper targets code patterns where a class references process execution APIs (`ProcessBuilder`, `Runtime`) alongside shell command names and download utility strings. In malicious scenarios, this combination can be used to delegate file retrieval and execution to native operating system tools: the spawned shell invokes `curl`, `wget`, `certutil`, or `bitsadmin` to download a secondary executable payload into a user directory and execute it independently of the game process via `ProcessBuilder.start()` or `Runtime.getRuntime().exec()`. The success of such execution depends on the platform and local security posture. If endpoint protection systems, User Account Control (UAC), or operating system execution policies restrict child processes spawned by `javaw.exe`, process creation fails or terminates with an error.

Most third-party services and modding platforms rely on registered domain names resolved via the Domain Name System (DNS). Domain names provide organizational transparency, public SSL/TLS certificate records, and domain reputation tracking. Direct_IP_URL flags modifications that embed routable numeric IP addresses (such as `http://203.0.113[.]42:8080/`) directly into their network connection routines. While local network testing and private self-hosted servers sometimes use direct IP addresses, embedding public numeric IP addresses in distributed mods is uncommon. In malicious scenarios, attackers can use direct IP endpoints via standard networking APIs (like `HttpURLConnection` or raw sockets) to communicate with command-and-control servers or data drop points without generating DNS query logs that could be intercepted by monitoring systems or blocked via DNS sinkholes. The presence of a hardcoded IP address does not automatically establish malicious intent, but it warrants review of the associated network protocol, data payload, and server ownership.

Discord incoming webhooks allow external applications to post formatted JSON messages and attachments to specific text channels via HTTP POST requests without running a full bot user. Discord_Webhook flags mods containing hardcoded webhook URLs. In malicious scenarios, Discord webhook endpoints can be used as an automated exfiltration route for sensitive files and credentials found on the player's system (such as session tokens from launcher profiles, browser cookies, or system credentials) using standard HTTP client APIs like `HttpURLConnection`. Because traffic to Discord domains is commonly allowed through network firewalls, outbound webhook requests often pass without triggering perimeter alerts. While some development utilities or server crash-reporters legitimately send error notifications to Discord channels, embedding incoming webhook endpoints in client-side mods exposes the webhook token to extraction and abuse by anyone who inspects the archive.

Standard mod loaders load modifications by adding JAR files to the classpath. Mod logic executes within the JVM runtime, interacting with the game through events, mixins, and engine APIs. Dropper_Download_Exec identifies bytecode sequences where a single method retrieves an external binary over the network, writes it to the local filesystem, and immediately executes it. In the inspected sample from `com.magma4496.Creatormagma`, the modification executes `fetchAndExec()` inside a background updater thread. The routine sends an HTTP GET request using `HttpClient.send()`, saving the response directly to a temporary file via `BodyHandlers.ofFile(dest)`. If the server returns HTTP status 200, the method marks the file as executable via `setExecutable(true)` and spawns it using `powershell` with `-NoProfile`, `-WindowStyle Hidden`, and `-Command Start-Process ... -Verb RunAs` to request administrative elevation (UAC prompt). Notably, there is no operating system check in `fetchAndExec()`. Because the code unconditionally invokes `powershell` and launches a Windows `.exe` binary without verifying `System.getProperty("os.name")`, execution will only succeed on Windows systems with PowerShell installed. On Linux or macOS environments where PowerShell is absent or unable to launch Windows executables, process creation fails and the resulting exception is silently caught by the empty catch block.

Mods routinely contact external servers for legitimate features such as update checks, displaying documentation or issue tracker links, rendering custom skins, or displaying social community buttons on custom menus. Embedded_URL inventories all hardcoded URL addresses present in mod classes. In the inspected sample from Destra Client (`ru.destra.gui.MainMenuScreen`), embedded URL string constants (`SOCIAL_URL_*`) are referenced by the menu initialization method `ensureSocialButtons()` to instantiate clickable UI buttons. Notably, in the author's original code, `SOCIAL_ICON_TELEGRAM` is passed alongside `SOCIAL_URL_DISCORD`, and `SOCIAL_ICON_DISCORD` alongside `SOCIAL_URL_TELEGRAM`. The presence of hardcoded URLs does not make a modification malicious on its own; many legitimate mods include documentation and donation links. However, recording embedded URLs provides visibility into what external infrastructure a mod references, helping auditors identify telemetry endpoints, ad redirectors, or unindexed download hosts.

Mods distributed for Minecraft are packaged as Java archive (`.jar`) files and executed within the Java Virtual Machine. When mods need to download additional assets, sounds, or libraries, those files are typically retrieved in cross-platform formats (such as `.jar`, `.json`, `.ogg`, or `.png`). Executable_Download_URL identifies code containing direct links to native executable files (`.exe`, `.bat`, `.ps1`). In confirmed malware samples (such as the inspected `com.hittools.HitToolsClient`), the author embeds a direct GitHub link to an `.exe` file (`autostartadd.exe`). Upon execution, the mod downloads the executable into the user's temporary folder and invokes `Runtime.getRuntime().exec()` to execute the helper and add the mod JAR to Windows system startup. The impact of this behavior is operating-system specific: the inspected sample explicitly verifies that `os.name` contains `windows` before executing the download and launcher logic. On non-Windows platforms (such as Linux or macOS), the routine logs an error message and terminates without downloading the payload.

Mod Menu is the standard graphical modification browser for the Fabric and Quilt ecosystems, reading loaded mods and configuration settings to render in-game mod lists. ModMenu_Config_Hiding detects modifications that tamper with the persistent `<config>/modmenu.json` configuration file to hide themselves from the menu interface. In the inspected sample (`com.example.timer.TimerClientMod`), the mod registers as an `onPreLaunch` entrypoint. Before the client user interface is loaded, `hideFromModMenu()` locates `modmenu.json`, parses its structure via `JsonParser.parseReader()`, iterates through both `"hidden_mods"` and `"hiddenMods"` arrays, and injects `"timer"` if it is not already present. It then creates any missing parent directories and writes the modified JSON document back to disk via `Files.newBufferedWriter()` and `GsonBuilder().toJson(root, writer)`. When Mod Menu subsequently initializes, it reads the modified file and omits the modification from the GUI list. The mod continues executing with full privileges, but is omitted from the visible in-game modification list. This file-based concealment technique directly complements `Modlist_Self_Hide` (score 9): while `Modlist_Self_Hide` targets mods that use reflection to purge their container from the loader's mod list, ModMenu_Config_Hiding targets mods that manipulate Mod Menu's configuration file on disk. In legitimate software, Mod Menu itself (`com.terraformersmc.modmenu`) manages `modmenu.json` via user interactions in its settings screen, and modpack creators may pre-populate configuration files. However, an independent third-party mod programmatically altering this file in `preLaunch` indicates deliberate stealth evasion.

Mod loaders maintain internal collections of loaded modifications and expose public APIs (such as `FabricLoader.getInstance().getAllMods()`) used by menus and diagnostic utilities to query active mods. Modlist_Self_Hide targets routines that access internal loader data structures via reflection and remove specific mod entries from the active list. When a mod removes its container, it remains active in the JVM and continues executing, but becomes invisible to queries made via loader APIs and in-game listing screens. This reflection-based list modification directly complements file-based concealment (`ModMenu_Config_Hiding`, score 9), which instead tampers with `modmenu.json` on disk to omit mods from the GUI. This concealment technique is used to hide cheat modules during manual mod inspections. However, modifying internal loader collections can break other mods that iterate over loaded dependencies or cause unexpected errors during game shutdown.

The Java Native Interface (JNI) allows Java programs to invoke compiled C, C++, or Rust code. Core Minecraft dependencies (such as LWJGL for OpenGL/Vulkan rendering and OpenAL for sound) rely on native libraries. Furthermore, several legitimate performance mods (e.g., memory allocators, input latency reducers) bundle native shared libraries for specific operating systems. Native_Library_Dropper flags classes that extract binary files to temporary locations and load them via `System.load()`. While this pattern exists in benign system integrations, native libraries can also be used in hostile modifications to execute machine code directly within the process memory space. Native code runs outside the JVM bytecode interpreter, enabling direct memory manipulation and interaction with native operating system APIs. Because unpacking native libraries is shared by both legitimate optimization libraries and hostile modules, detection severity is categorized as medium (score 5) and requires reviewing the binary payload itself.

Applications use centralized configuration endpoints to dynamically update announcement banners, retrieve emergency notices, or update server listings without publishing new application builds. Pastebin_C2 targets modifications that embed direct links to raw text-hosting endpoints (`pastebin.com/raw/`). In hostile modifications, public pastebins can serve as low-cost dead-drop resolvers: attackers store dynamic command-and-control configurations (such as newly registered Discord webhook URLs, kill-switch flags, or secondary dropper addresses) inside an anonymous text paste. The mod retrieves the raw text via network stream APIs (such as `URL.openStream()`) on client startup and parses it to update its operational parameters. While reading public text files does not directly execute code, relying on unauthenticated public pastes allows the creator of the paste to alter the mod's network behavior at any time without the user's awareness or consent.

Info-stealers and malicious payload droppers target Minecraft players to extract session tokens, browser credentials, and Discord tokens. Malicious mods embed Telegram Bot tokens and use HTTP POST requests to `api.telegram.org/bot<token>/sendMessage` or `sendDocument` to exfiltrate stolen credentials directly to an attacker's private chat.

Many developers and modding teams maintain official community channels on platforms such as Discord, Telegram, or Matrix to publish change logs, support requests, and release announcements. Telegram_Link identifies class files that store `t.me/` link literals. In the inspected sample from `ru.pulse.Pulse`, the modification executes a method (`runtimeBrandingTick()`) that modifies the GLFW game window title to include promotional attribution, checks a system property flag, and forcibly launches the player's default web browser to open two Telegram channels via `Desktop.getDesktop().browse()`. If the desktop API is unavailable, it invokes a Windows system command (`rundll32 url.dll,FileProtocolHandler`) as a fallback. While this mechanism does not constitute a command-and-control (C2) backdoor or data-stealing channel, unsolicited browser redirection during game startup disrupts the player experience and forces promotional web traffic without explicit user action.

All method, field, and parameter names are stripped and replaced with short uniform tokens across the entire package.

Builds sensitive strings (URLs, tokens) by concatenating individual char arrays or integers at runtime to evade simple regex string scanners.

Linear method execution is broken into basic blocks nested inside an infinite while(true) loop controlled by a complex tableswitch/lookupswitch state machine.

Strings throughout classes are stored in encrypted byte arrays and passed to static decryption routines before use.

JAR archive contains class files with abnormal entry names, trailing spaces, or invalid characters designed to crash standard decompilers and zip extractors.

Uses lookalike Cyrillic or Greek Unicode characters (e.g. Cyrillic 'а', 'е', 'о', 'р') inside identifier names to deceive manual code auditors.

Mod declares entrypoints in fabric.mod.json or mods.toml that do not exist or point to encrypted loader stubs.

Class names consist of random alphanumeric hash sequences (e.g. IIlIlIIllI, O0OO0OO) designed to hinder reverse engineering.

Mod bytecode is encrypted using AES/XOR/DES algorithms and dynamically decrypted at runtime via custom ClassLoaders (defineClass).

Mod contains multiple classes named with single letters (e.g., a.class, b.class, c.class), characteristic of heavy ProGuard or Zelix KlassMaster renaming.

Prior to Minecraft 1.20.5, player interaction range and attack reach were hardcoded constants in client and server code (3.0 blocks for survival attacks, 4.5 for creative mode). Beginning with version 1.20.5, Mojang modularized these limits into native entity attributes: `player.entity_interaction_range` (`PLAYER_ENTITY_INTERACTION_RANGE`) and `player.block_interaction_range` (`PLAYER_BLOCK_INTERACTION_RANGE`). Reach_Attribute_Modifier flags code that instantiates `EntityAttributeModifier` instances targeting these interaction range attributes. In a cheat scenario, a modification creates an attribute modifier (for example, with an addition operation mode) and applies it to the local player's attribute container. This boosts the maximum reach threshold recognized by the client engine without needing to directly patch raycasting methods or bytecode instructions in `ClientPlayerInteractionManager`. On servers running vanilla attribute validation or anticheats that enforce server-side distance checks, client-side attribute changes that are not mirrored by server attributes will result in server packet rejections or silent hit cancellations.

In Minecraft, `ClientPlayerInteractionManager` coordinates player actions in the world, including block placement, breaking, and entity interactions. The method `getReachDistance()` returns the client reach distance in blocks, while `hasExtendedReach()` checks whether creative or extended range mode is currently active. Reach_Mixin_Override detects mods that hook into `ClientPlayerInteractionManager` via SpongePowered Mixin to override these methods. In the Phosphor cheat client (`net.caffeinemc.phosphor.mixin.ClientPlayerInteractionManagerMixin`), `@Inject` hooks into `getReachDistance()F` at `HEAD` with `cancellable = true`. If the client module is active and `blockReachToggle` is enabled, it cancels vanilla calculation and immediately returns a custom float (`reachModule.blockReach.getFValue()`). Simultaneously, `hasExtendedReach()Z` is hooked to return `false` to avoid triggering client-side creative-mode discrepancies. While this allows the client to target blocks and entities from greater distances, server-side position validation will still discard interaction packets if the server calculates the distance between player and target as exceeding server limits.

In vanilla Minecraft, melee combat relies on `GameRenderer.updateTargetedEntity()` to perform crosshair raycasting. For players in survival mode, the maximum attack distance to acquire an `EntityHitResult` is capped at 3.0 blocks. Targets situated beyond 3.0 blocks cannot be hit with melee weapons. Reach_Raycast_Extended flags combat modules that perform independent raycast queries using `ProjectileUtil.raycast()` with extended reach multipliers. In the SimpleAutoAttack mod (`org.simpleautoattack.SimpleAutoAttack.AutoAttack`), the method `AutoMeleeTick()` calculates an extended look vector: `float reach = (float)(mc.field_1724.method_7337() ? 4.5 : ...)` where creative mode reach of `4.5` blocks is cast to float. It feeds `camera.add(rotation.multiply(reach))` into `ProjectileUtil.raycast(..., reach * reach)`. If a valid entity is encountered within that expanded reach boundary, it immediately invokes `attackEntity(player, result.getEntity())` (`method_2918`). This allows the client to automatically lock on and strike targets at extended range. However, if the target exceeds the server's maximum reach limit, the server will reject the attack packet.

In Minecraft, the rendered viewpoint is anchored to the player entity. Every frame, `Camera.update()` recalculates camera position and orientation based on player coordinates, eye height, and view angles, while `clipToSpace()` prevents third-person cameras from clipping through solid geometry. Freecam_Camera_Detached flags modifications that hook into `Camera` (`class_4184`) to detach the rendering perspective from the player body. In the inspected cheat module from `com.larpclient.mixin.CameraFreecamMixin`, `@Inject` targets the `TAIL` of `Camera.update()` (`method_19321`). When `FreecamModule` is active, the mixin overrides the camera's orientation with `this.method_19325(freecam.getInterpolatedYaw(), freecam.getInterpolatedPitch())` and its world coordinates with `this.method_19322(freecam.getInterpolatedPos())`. This allows the player to pilot an invisible detached viewpoint freely through solid walls and terrain to scout enemy bases, hidden underground chests, and caves, all while the real player character remains stationary on the server.

In Minecraft, the Glowing status effect renders a bright colored outline around entities that remains visible through opaque terrain and solid walls. In vanilla gameplay, this effect is granted only through specific game events, such as spectral arrows or status potions applied by the server. Glow_Mixin_Override detects modifications that hook `Entity.isGlowing()` (`method_5851`) via Mixin. In the FriendHighlight mod (`net.maksaidev.friendhighlight.mixin.EntityGlowMixin`), `@Inject` hooks into `isGlowing` at `HEAD` with `cancellable = true`. When the entity is a player (`class_742`), it queries `FriendManager.isFriend(name)`. If confirmed, it calls `cir.setReturnValue(true)`. By returning `true`, the game engine renders the glowing outline through solid blocks, providing clear wallhack visibility. While the sample demonstrates a targeted utility use case (highlighting teammates), the identical bytecode pattern is employed by malicious ESP and wallhack cheats to reveal all opponents in competitive environments.

In Minecraft, the rendering pipeline relies on OpenGL Z-buffer depth testing to occlude geometry located behind solid blocks. When depth testing is enabled, pixels located behind closer blocks are discarded during rendering. Trap_ESP detects modifications that hook into Fabric's world rendering pipeline (`WorldRenderEvents.AFTER_ENTITIES`) while configuring custom render layers with depth testing disabled (`depthTest(false)` / `method_23617(false)`). In the Antitrap mod (`ru.antitrap.TrapRenderer`), the class registers a listener on `WorldRenderEvents.AFTER_ENTITIES`. It scans surrounding blocks within a 35-block spherical radius for specific trap configurations (such as anchor or trap blocks and armor stands). Found positions are stored and rendered using `HIGHLIGHT_LAYER`, which disables depth testing via `.method_23617(false)`. Disabling depth testing causes the bounding box highlights to render directly over solid walls and terrain, giving the player an unfair wallhack view of hidden traps, base structures, or enemy placements through obstacles.