feat: (anticheat) continuous detection and hardened server fingerprinting

The detector reported once at tick 41 and reset, before the plugin scan
reply arrived, then never corrected itself. Warm up longer and keep
re-evaluating so late plugin/command signals are used. Fingerprint from a
frozen join-time transaction sequence instead of a rolling window, scan
plugins earlier, fold the server MOTD into the token set and close token
gaps (grim, ncp, nocheat). Notifications now include brand, TPS and ping.

Author: opZywl

src/main/java/net/ccbluex/liquidbounce/features/module/modules/other/AnticheatDetector.kt

@@ -17,15 +17,20 @@ import net.ccbluex.liquidbounce.utils.client.chat
 import net.minecraft.network.play.server.S01PacketJoinGame
 import net.ccbluex.liquidbounce.utils.client.ServerUtils.remoteIp
 import net.ccbluex.liquidbounce.utils.client.ServerObserver
+import java.util.Locale
 
 object AnticheatDetector : Module("AntiCheatDetector", Category.OTHER, Category.SubCategory.MISCELLANEOUS) {
 
-    private val debug by boolean("Debug", true)
+    private const val WARMUP_TICKS = 60
+
+    private val debug by boolean("Debug", false)
         .describe("Print transaction action numbers to chat for debugging.")
     private var check = false
     private var ticksPassed = 0
+    private var loggedOnce = false
 
     var detectedACName: String = ""
+        private set
 
     val onPacket = handler<PacketEvent> { event ->
         if (event.packet is S01PacketJoinGame) {
@@ -35,28 +40,46 @@ object AnticheatDetector : Module("AntiCheatDetector", Category.OTHER, Category.
     }
 
     val onTick = handler<GameTickEvent> {
-        if (check && ticksPassed++ > 40) {
-            val result = ServerObserver.guessAnticheat(remoteIp) ?: "Unknown"
+        if (!check) return@handler
+        if (ticksPassed++ < WARMUP_TICKS) return@handler
+
+        val result = ServerObserver.guessAnticheat(remoteIp) ?: "Unknown"
+        if (result != detectedACName) {
             detectedACName = result
-            notify(result)
-            if (debug && result == "Unknown") logNumbers()
-            reset()
+            if (result != "Unknown") notify(result)
+        }
+        if (debug && result == "Unknown" && !loggedOnce) {
+            loggedOnce = true
+            logNumbers()
         }
     }
 
-    private fun notify(message: String) =
-        hud.addNotification(Notification("Alert", "§3Anticheat detected: $message", Type.WARNING, 3000))
-
+    private fun notify(message: String) {
+        val brand = ServerObserver.serverBrand ?: "?"
+        val tps = ServerObserver.tps
+        val tpsText = if (tps.isFinite()) String.format(Locale.ROOT, "%.1f", tps) else "?"
+        val ping = ServerObserver.ping
+        hud.addNotification(
+            Notification(
+                "Alert",
+                "§3AC: $message §7| Brand $brand | TPS $tpsText | ${ping}ms",
+                Type.WARNING,
+                3000
+            )
+        )
+    }
 
     private fun logNumbers() {
-        val actions = ServerObserver.transactions
+        val actions = ServerObserver.initialTransactions
         chat("Action Numbers: ${actions.joinToString()}")
         chat("Differences: ${actions.windowed(2) { it[1] - it[0] }.joinToString()}")
     }
 
     private fun reset() {
         ticksPassed = 0
         check = false
+        loggedOnce = false
+        detectedACName = ""
     }
 
     override fun onEnable() = reset()

src/main/java/net/ccbluex/liquidbounce/utils/client/ServerObserver.kt

@@ -35,10 +35,12 @@ object ServerObserver : MinecraftInstance, Listenable {
 
     private const val TPS_SAMPLE_COUNT = 15
     private const val TRANSACTION_SAMPLE_COUNT = 32
-    private const val PLUGIN_SCAN_DELAY_TICKS = 40
+    private const val INITIAL_TRANSACTION_COUNT = 8
+    private const val PLUGIN_SCAN_DELAY_TICKS = 20
 
     private val tpsIntervals = ArrayDeque<Long>(TPS_SAMPLE_COUNT + 1)
     private val transactionSamples = ArrayDeque<Int>(TRANSACTION_SAMPLE_COUNT + 1)
+    private val initialTransactionSamples = ArrayList<Int>(INITIAL_TRANSACTION_COUNT)
     private val mutablePlugins = TreeSet(String.CASE_INSENSITIVE_ORDER)
     private val mutablePayloadChannels = TreeSet(String.CASE_INSENSITIVE_ORDER)
 
@@ -76,6 +78,10 @@ object ServerObserver : MinecraftInstance, Listenable {
     val transactions: List<Int>
         get() = synchronized(transactionSamples) { transactionSamples.toList() }
 
+    /** The first transactions seen after joining, which is where the handshake fingerprint lives. */
+    val initialTransactions: List<Int>
+        get() = synchronized(initialTransactionSamples) { initialTransactionSamples.toList() }
+
     val ping: Int
         get() {
             val player = mc.thePlayer ?: return -1
@@ -126,7 +132,7 @@ object ServerObserver : MinecraftInstance, Listenable {
     fun guessAnticheat(address: String? = mc.currentServerData?.serverIP): String? {
         guessFromHost(address)?.let { return it }
         guessFromTokens()?.let { return it }
-        return guessFromTransactions(transactions)
+        return guessFromTransactions(initialTransactions)
     }
 
     /**
@@ -143,6 +149,7 @@ object ServerObserver : MinecraftInstance, Listenable {
         addAll(plugins)
         addAll(payloadChannels)
         serverBrand?.let(::add)
+        mc.currentServerData?.serverMOTD?.let(::add)
     }.map { normalize(it) }.filter(String::isNotEmpty)
 
     private fun guessFromTokens(): String? {
@@ -163,6 +170,7 @@ object ServerObserver : MinecraftInstance, Listenable {
     fun resetSession() {
         synchronized(tpsIntervals) { tpsIntervals.clear() }
         synchronized(transactionSamples) { transactionSamples.clear() }
+        synchronized(initialTransactionSamples) { initialTransactionSamples.clear() }
         synchronized(mutablePlugins) { mutablePlugins.clear() }
         synchronized(mutablePayloadChannels) { mutablePayloadChannels.clear() }
         lastTimeUpdateAt = -1L
@@ -195,6 +203,9 @@ object ServerObserver : MinecraftInstance, Listenable {
             transactionSamples.addLast(actionNumber)
             while (transactionSamples.size > TRANSACTION_SAMPLE_COUNT) transactionSamples.removeFirst()
         }
+        synchronized(initialTransactionSamples) {
+            if (initialTransactionSamples.size < INITIAL_TRANSACTION_COUNT) initialTransactionSamples.add(actionNumber)
+        }
     }
 
     private fun captureCommandSuggestions(packet: S3APacketTabComplete) {
@@ -288,7 +299,10 @@ object ServerObserver : MinecraftInstance, Listenable {
 
     private val KNOWN_ANTICHEATS = listOf(
         KnownAnticheat("nocheatplus", "NoCheatPlus"),
+        KnownAnticheat("nocheat", "NoCheatPlus"),
+        KnownAnticheat("ncp", "NoCheatPlus"),
         KnownAnticheat("grimac", "Grim"),
+        KnownAnticheat("grim", "Grim"),
         KnownAnticheat("vulcan", "Vulcan"),
         KnownAnticheat("matrix", "Matrix"),
         KnownAnticheat("spartan", "Spartan"),