ok so I'm not really a modder but I do know a little and that there's client side and server side mods and most mods are server side and such. My question is: what is possible with client side mods, in a cheating sense. I'm not in to cheating so if it already exists, don't tell me where. Is creating an item stack only something that a server can do, or is it possible to do that thought the client and then tell the server what happened? Another example: flying. I don't know how flying works, so is it possible to, say, press a key and fly? Does the server make you fly or do you? I don't know very much about how clients and servers interact and I feel like there is a lot to learn there and I don't have the time.
Items and the like are only created server-side; if the client tries to create one you'll get a "ghost" item which disappears (this is a common issue when developing mods; there is a flag, world.isRemote, which is true for client-side worlds and sometimes modders confuse it with meaning server-side (remote from the client) worlds).
The client controls most player movement so yes, you could try to fly but the server will kick you if you fly for too long (80 ticks or 4 seconds according to the code in NetServerHandler in 1.6.4). In fact, I've seen players get kicked while falling a long distance so even just falling counts (the code checks if flight is allowed, a player is in Creative, and for block collisions; it does not check to see if they are falling so this cannot be exploited to reset the "ticksForFloatKick" counter).
Some things that are possible on a client-side mod are bypassing reducedDebugInfo (disabled coordinates in F3) since the client must know where the player is so it is a simple matter of getting their coordinates, including when they die; for example, my own mod modifies the inventory GUI to display coordinates (I do this so I can just open my inventory to see my coordinates as well as other information without the clutter on the debug screen and harder to reach F3 key; my mod is actually for 1.6.4 so there is no need to bypass reducedDebugInfo):
public GuiInventoryTMCW(EntityPlayer par1EntityPlayer)
{
super(par1EntityPlayer);
// Initializes stats and other information
this.initialize(par1EntityPlayer);
}
protected void drawGuiContainerBackgroundLayer(float par1, int par2, int par3)
{
super.drawGuiContainerBackgroundLayer(par1, par2, par3);
// Calls method to display custom GUI
this.displayStats();
}
protected void initialize(EntityPlayer player)
{
this.score = player.experienceTotal;
this.playerPosX = MathHelper.floor_double(player.posX);
this.playerPosY = MathHelper.floor_double(player.posY - 1.5D);
this.playerPosZ = MathHelper.floor_double(player.posZ);
Likewise, anything that depends on blocks in the world can exploit this, such as x-ray hacks (servers can bypass this by not sending data or sending fake data for blocks which are not visible, though this does depend on the server knowing where the player is looking at). This also extends to entities, e.g. reach hacks (I don't know about current versions but in 1.6.4 the client calculates whether your cursor is over an entity and sends hit data to the server).
Basically anything that involves game logic -- like having an itemstack, placing or destroying a block, spawning an entity, taking damage, successfully using a recipe, etc. -- must have some server-side code running.
Anything that is purely for user interface, such as models, textures, sounds, text, and GUIs can usually be client-side only. Cheat mods basically take advantage of this -- like creating an arrow to show nearest ores, or highlighting enemies, etc.
Player movement is a bit funny because it starts on the client side (because client can provide smoother experience), but is verified on the server. In other words, if you had a client mod that cheated by causing flying or teleporting, the server will reset your position a few times every second. So basically you cannot achieve different player movement.
Player movement is a bit funny because it starts on the client side (because client can provide smoother experience), but is verified on the server. In other words, if you had a client mod that cheated by causing flying or teleporting, the server will reset your position a few times every second. So basically you cannot achieve different player movement.
How do fly hacks work then? In my experience (admittedly on 1.6.4) even if the server is lagging (thus can't keep up with player movement, if lagging mobs are any indication) it doesn't reset the player's position all the time, only sometimes, so there must be a threshold; in particular, the boat desync bug was caused by the fact that the client had sole control over the player's movement so any server lag (even if not normally noticeable) would cause it to become increasingly desynced from the client - sometimes you'd crash in the middle of an open ocean or even sail into unloaded chunks (client-side).
(it is worth noting that after fixing this bug myself with the fix given here it actually does cause the boat to jump back to its server-side location but I only changed a couple lines of code which appears to control how the client syncs wit the server)
Also, a comment a few posts after the one linked to above supports the idea that the client mainly controls the player, or you would not see other players "teleporting" around due to lag (e.g. the server updates their position to where they moved to between ticks):
The client does mostly own the body of its player. It's rare for the server to 'rubber-band' you outside of a few glitchy cases not related to lag, whereas others might see you skipping all over the place or taking a while to react to knockback. Last UHC had some amazing examples. Here's what's probably the most bizarre encounter, where it's evident that players own their own position:
How do fly hacks work then? In my experience (admittedly on 1.6.4) even if the server is lagging (thus can't keep up with player movement, if lagging mobs are any indication) it doesn't reset the player's position all the time, only sometimes, so there must be a threshold.
Well some fly hacks are really just enabling the allowFlying capability similar to the /fly command and is generally only usable if cheats are allowed. However, there is certainly some holes in the vanilla Minecraft logic that can be exploited. For example, similar to flying you could probably increase the walk speed slightly (up to some threshold) before it is detected as illegal motion as well.
However, any server that wants to prevent fly hacking can do so pretty easily as the "truth" about the player position still is maintained on the server.
Note that one thing that may confuse people is that on the client you can certainly create an impression of flying without alerting the server, but for example if you tried to break a block from the illegal client position the server would reject it as exceeding your reach distance.
I also think some of the logic has been tightened up in the versions since 1.6.4.
ok so I'm not really a modder but I do know a little and that there's client side and server side mods and most mods are server side and such. My question is: what is possible with client side mods, in a cheating sense. I'm not in to cheating so if it already exists, don't tell me where. Is creating an item stack only something that a server can do, or is it possible to do that thought the client and then tell the server what happened? Another example: flying. I don't know how flying works, so is it possible to, say, press a key and fly? Does the server make you fly or do you? I don't know very much about how clients and servers interact and I feel like there is a lot to learn there and I don't have the time.
Items and the like are only created server-side; if the client tries to create one you'll get a "ghost" item which disappears (this is a common issue when developing mods; there is a flag, world.isRemote, which is true for client-side worlds and sometimes modders confuse it with meaning server-side (remote from the client) worlds).
The client controls most player movement so yes, you could try to fly but the server will kick you if you fly for too long (80 ticks or 4 seconds according to the code in NetServerHandler in 1.6.4). In fact, I've seen players get kicked while falling a long distance so even just falling counts (the code checks if flight is allowed, a player is in Creative, and for block collisions; it does not check to see if they are falling so this cannot be exploited to reset the "ticksForFloatKick" counter).
Some things that are possible on a client-side mod are bypassing reducedDebugInfo (disabled coordinates in F3) since the client must know where the player is so it is a simple matter of getting their coordinates, including when they die; for example, my own mod modifies the inventory GUI to display coordinates (I do this so I can just open my inventory to see my coordinates as well as other information without the clutter on the debug screen and harder to reach F3 key; my mod is actually for 1.6.4 so there is no need to bypass reducedDebugInfo):
Likewise, anything that depends on blocks in the world can exploit this, such as x-ray hacks (servers can bypass this by not sending data or sending fake data for blocks which are not visible, though this does depend on the server knowing where the player is looking at). This also extends to entities, e.g. reach hacks (I don't know about current versions but in 1.6.4 the client calculates whether your cursor is over an entity and sends hit data to the server).
TheMasterCaver's First World - possibly the most caved-out world in Minecraft history - includes world download.
TheMasterCaver's World - my own version of Minecraft largely based on my views of how the game should have evolved since 1.6.4.
Why do I still play in 1.6.4?
Basically anything that involves game logic -- like having an itemstack, placing or destroying a block, spawning an entity, taking damage, successfully using a recipe, etc. -- must have some server-side code running.
Anything that is purely for user interface, such as models, textures, sounds, text, and GUIs can usually be client-side only. Cheat mods basically take advantage of this -- like creating an arrow to show nearest ores, or highlighting enemies, etc.
Player movement is a bit funny because it starts on the client side (because client can provide smoother experience), but is verified on the server. In other words, if you had a client mod that cheated by causing flying or teleporting, the server will reset your position a few times every second. So basically you cannot achieve different player movement.
How do fly hacks work then? In my experience (admittedly on 1.6.4) even if the server is lagging (thus can't keep up with player movement, if lagging mobs are any indication) it doesn't reset the player's position all the time, only sometimes, so there must be a threshold; in particular, the boat desync bug was caused by the fact that the client had sole control over the player's movement so any server lag (even if not normally noticeable) would cause it to become increasingly desynced from the client - sometimes you'd crash in the middle of an open ocean or even sail into unloaded chunks (client-side).
(it is worth noting that after fixing this bug myself with the fix given here it actually does cause the boat to jump back to its server-side location but I only changed a couple lines of code which appears to control how the client syncs wit the server)
Also, a comment a few posts after the one linked to above supports the idea that the client mainly controls the player, or you would not see other players "teleporting" around due to lag (e.g. the server updates their position to where they moved to between ticks):
TheMasterCaver's First World - possibly the most caved-out world in Minecraft history - includes world download.
TheMasterCaver's World - my own version of Minecraft largely based on my views of how the game should have evolved since 1.6.4.
Why do I still play in 1.6.4?
Well some fly hacks are really just enabling the allowFlying capability similar to the /fly command and is generally only usable if cheats are allowed. However, there is certainly some holes in the vanilla Minecraft logic that can be exploited. For example, similar to flying you could probably increase the walk speed slightly (up to some threshold) before it is detected as illegal motion as well.
However, any server that wants to prevent fly hacking can do so pretty easily as the "truth" about the player position still is maintained on the server.
Note that one thing that may confuse people is that on the client you can certainly create an impression of flying without alerting the server, but for example if you tried to break a block from the illegal client position the server would reject it as exceeding your reach distance.
I also think some of the logic has been tightened up in the versions since 1.6.4.
If you want to look at source code for a fly hack, you can check out SimplyHax: https://github.com/AtomicStryker/atomicstrykers-minecraft-mods/blob/1.12.2/SimplyHax/src/main/java/atomicstryker/simplyhax/SimplyHaxFlying.java