[INDL] MOD-HACK DETECTED: Server-Side Mod Integrity Scanner

Protect your server from hack clients. [INDL] MOD-HACK DETECTED is a powerful, server-side anti-cheat mod that scans every player's installed mods and classifies them using a 5-Level Trust System. From known hack clients like Wurst or Meteor to unknown suspicious JARs — nothing gets past unnoticed.

🚀 Why choose [INDL] MOD-HACK DETECTED?

Most anti-cheat solutions only detect known cheats. [INDL] MOD-HACK DETECTED goes further — it performs deep JAR analysis, scans for suspicious classes and packages, checks SHA-256 hashes against a blacklist database, and classifies every single mod a player has installed.

Even if a cheater renames their hack client, the hash stays the same. Even if the hash is unknown, the heuristic engine catches suspicious classes like KillAura, Nuker, or ESPModule.

---

🛡️ 5-Level Trust Classification System

Every mod installed by a player is classified into one of 5 trust levels, giving admins clear visibility into potential threats:

Level	Name	Description
L1 🔵	Server Core	Mod exists in the server's /mods folder. Auto-whitelisted.
L2 🟢	Verified Client	Manually approved by an admin via SHA-256 hash. Trusted.
L3 🟡	Unknown (Low Risk)	Unknown mod with no suspicious indicators. Monitor.
L4 🟠	Unknown (High Risk)	Unknown mod with suspicious classes, packages, or keywords detected.
L5 🔴	Confirmed Threat	Hash matches a known hack mod in the blacklist database.

How Classification Works

Player Joins → Client sends mod list + hashes
                    ↓
            ┌─ Hash in blacklist?     → 🔴 L5: Confirmed Threat
            ├─ Hash = server mod?     → 🔵 L1: Server Core
            ├─ Hash in whitelist?     → 🟢 L2: Verified Client
            ├─ Suspicious content?    → 🟠 L4: Unknown High Risk
            └─ None of the above      → 🟡 L3: Unknown Low Risk

---

🔍 Deep Detection Engine

SHA-256 Hash Matching

Each mod file has a unique SHA-256 fingerprint. Renaming a hack client won't help — the hash stays the same.

WurstClient-7.0.jar       → Hash: "e46ced73..."
TotallyLegitMod.jar       → Hash: "e46ced73..." ✅ DETECTED!

Heuristic JAR Analysis

When a mod's hash isn't in any list, the engine scans inside the JAR file for:

• Suspicious classes: KillAura, Nuker, SpeedHack, Xray, ESPModule, AimBot, FreeCam, WallHack, TriggerBot, NoFall…
• Suspicious packages: net.wurstclient, meteordevelopment.meteorclient, net.ccbluex.liquidbounce, org.rusherhack…
• Blacklisted keywords: wurst, meteor-client, killaura, xray, aimbot, forgehax, wallhack…
• Blacklisted authors: Known hack mod developers

CamelCase-Aware Matching

The class scanner uses intelligent token matching — ESP matches ChestESP or ESPModule but does NOT match Respawn or Response. This dramatically reduces false positives.

---

🖥️ Admin Panel (GUI)

Open the Admin Panel with /hkd gui for a real-time visual overview of all players and their mods.

Features:

• Player list with color-coded trust badges (L1-L5)
• Strike counter and ban status per player
• Per-mod inspector showing hash, filename, risk level, and reason
• One-click actions: Whitelist, Blacklist, Remove from WL/BL
• Scan, Kick, and Ban buttons directly from the panel
• Mutually exclusive lists — whitelisting auto-removes from blacklist and vice versa
• Instant UI refresh — changes reflect immediately without manual rescanning

---

⚡ Key Features

• ✅ Automatic Scans — Runs on join and at configurable intervals
• ✅ Real-Time Admin Alerts — OPs receive detailed notifications with mod names and reasons
• ✅ Progressive Strike System — Fair warnings before kick/ban
• ✅ SHA-256 Hash Blacklist — Instantly detect known hack mods
• ✅ Deep JAR Analysis — Scan class files, packages, and metadata inside JARs
• ✅ Auto-Whitelist Server Mods — Server-side mods are trusted automatically (Level 1)
• ✅ Manual Hash Whitelist — Approve specific client mods by hash (Level 2)
• ✅ Admin GUI Panel — Visual management with one-click approve/block actions
• ✅ Zero Lag — Async scanning with configurable JAR size limits
• ✅ Fully Configurable — Keywords, classes, packages, authors, and response actions

---

🛡️ Progressive Strike System

Instead of immediately kicking players, the mod can use a fair, progressive warning system:

Strike	Action
1st	⚠️ Warning + Admin notification
2nd	🔴 Auto-kick (configurable)
3rd	🚫 Auto-ban (configurable)

Strikes reset automatically after a configurable time period (default: 1 week).

---

🛠️ Commands & Permissions

Command	Alias	Description
/hackdetected help	/hkd help	Show help menu
/hackdetected status	/hkd status	View mod status and configuration
/hackdetected stats	/hkd stats	View global detection statistics
/hackdetected list	/hkd list	List all scanned players with trust levels
/hackdetected inspect <player>	/hkd inspect	Detailed mod list for a player
/hackdetected scan <player>	/hkd scan	Force an immediate rescan on a player
/hackdetected scanall	/hkd scanall	Force rescan on all online players
/hackdetected whitelist list	/hkd whitelist list	View all whitelisted mod hashes
/hackdetected whitelist add <hash>	/hkd whitelist add	Add a mod hash to the whitelist
/hackdetected whitelist remove <hash>	/hkd whitelist remove	Remove a mod hash from the whitelist
/hackdetected blacklist list	/hkd blacklist list	View all blacklisted hashes and names
/hackdetected blacklist add <hash>	/hkd blacklist add	Add a mod hash to the blacklist
/hackdetected blacklist remove <hash>	/hkd blacklist remove	Remove a mod hash from the blacklist
/hackdetected kick <player> [reason]	/hkd kick	Kick a player with optional reason
/hackdetected strikes <player>	/hkd strikes	View a player's current strike count
/hackdetected strikes <player> clear	/hkd strikes	Reset a player's strikes
/hackdetected reload	/hkd reload	Reload configuration and all lists
/hackdetected gui	/hkd gui	Open the Admin Panel

Note: All commands require OP Level 2 or higher.

---

⚙️ Configuration

File: config/hackdetected-common.toml

The mod is highly customizable. You control exactly what gets detected, what action is taken, and how aggressive the mod should be.

#=== Detection Settings ===
[detection]
    # Keywords in mod filenames/metadata that flag mods (case-insensitive)
    blacklistKeywords = ["wurst", "meteor-client", "killaura", "xray", "aimbot", "forgehax", ...]

    # Known hack mod authors
    blacklistAuthors = ["wurstimperium", "alexander01998", "meteordevelopment", ...]

    # Suspicious class names to search inside JARs (CamelCase-aware matching)
    suspiciousClasses = ["KillAura", "Nuker", "SpeedHack", "Xray", "ChestESP", "AimBot", ...]

    # Suspicious Java package prefixes
    suspiciousPackages = ["net.wurstclient", "meteordevelopment.meteorclient", ...]

    # Named whitelist for client mods (partial match, case-insensitive)
    whitelistMods = ["sodium", "optifine", "journeymap", "jei", "jade", ...]

    # Enable deep JAR analysis (scans class files inside JARs)
    scanJarContent = true

    # Check loaded JVM classes for injected code
    checkLoadedClasses = true

    # Max JAR size to scan in MB (0 = unlimited)
    maxJarSizeMB = 50

    # Auto-whitelist all server mods (Level 1)
    autoWhitelistServerMods = true

    # Use SHA-256 hash database for instant L5 detection
    useHashDatabase = true

    # Re-check interval in minutes (0 = only on join)
    checkIntervalMinutes = 5

#=== Response Level Settings ===
[responseLevels]
    # Action for Level 4 (Unknown High Risk). Options: LOG, NOTIFY, KICK
    unknownHighRisk = "NOTIFY"

    # Action for Level 5 (Confirmed Threat). Options: LOG, NOTIFY, KICK
    confirmedThreat = "KICK"

#=== Action Settings ===
[actions]
    notifyAdmins = true
    autoKick = true
    autoBan = false              # WARNING: Use with caution!
    actionDelaySeconds = 5
    kickMessage = "Unauthorized mod detected. Remove it and reconnect."
    banMessage = "Banned for using hack mods. Appeal on the server's Discord."

#=== Strike System ===
[strikes]
    useStrikeSystem = true
    strikesBeforeKick = 2
    strikesBeforeBan = 3
    strikeResetHours = 168       # Reset after 1 week

#=== Logging ===
[logging]
    logToFile = true             # Logs saved to config/hackdetected/logs/
    logToConsole = true

---

📁 File Structure

The mod generates the following files in config/hackdetected/:

File	Description
whitelist.json	Manually approved mod hashes (Level 2). Managed via /hkd whitelist or the Admin Panel.
blacklist_hashes.txt	Known hack mod SHA-256 hashes (Level 5). One hash=name per line.
blacklist_names.txt	Blacklisted mod name patterns. Matched case-insensitively.
logs/	Detection logs with timestamps, player names, and mod details.

Example blacklist_hashes.txt:

# Known hack mod hashes
# Format: sha256hash=ModName.jar
7a875ad6f0f2ceda0bcabc54db01f02bc9e48c3ec2c843c22fce90fc6b59a0e8=MadXray-1.0.0-forge-1.20.1.jar

Example whitelist.json:

{
  "7980d4a0beed1dcd2c283cf65f3c93f6b0085833f3ac490014979c95f1dfaf67": "Bookshelf-Forge-1.20.1-20.2.15.jar"
}

---

⚠️ Important Notes

• Server + Client required: Players must have the mod installed client-side for scanning to work. The server collects mod data; the client reports it.
• False positives are rare thanks to CamelCase-aware class matching and configurable keyword lists. Any false positive can be whitelisted in one click from the Admin Panel.
• Renaming won't help cheaters — SHA-256 hashes are based on file content, not filenames.
• The Admin Panel provides full control — approve, block, scan, kick, and ban all from one screen.
• Lightweight & async — scanning runs off the main thread with configurable size limits.