Nemesis: Behind the Scenes of Minecraft's Best Anti-Cheat

Paladium is one of the largest Minecraft servers in France, operating since 2015 with over 700,000 unique players and up to 6,000 concurrent connections. Like any growing server, they have dealt with cheating at scale. Nemesis is their in-house solution to this problem. This article reveals how it functions.

Minecraft trusts the client by default. When a player's game reports a position, the server records it without verifying if that movement is possible. Combat also follows this pattern: the client declares a hit, and the server applies damage. Speed, reach, and attack speed are all determined by the client's input. Since Minecraft is written in Java, a language without inherent security, its code can be opened and modified directly.

Alternatively, code can be injected into an already-running session or executed externally to monitor player activity.

Anti-cheat measures revolve around two questions: is what the player is doing physically possible, and can the player's machine be trusted? Most servers lack the ability to interact with the client as Nemesis does, running its own launcher. This allows Nemesis to address both concerns.

Cheating can range from simple modifications to complex native code outside Java. External memory reading and kernel drivers are also possible methods. Hardware solutions, like DMA cards, are also employed.

Nemesis follows a philosophy of blocking cheaters first, addressing punishment afterward. They use a two-stage approach. First, they stop the cheat from working by making movements impossible or terminating the effect. If a cheat is too deeply embedded, the game closes to prevent further risk. Unsuccessful attempts result in sanctions only as a last resort.

On the server side, Nemesis monitors players by creating digital twins of their clients and simulating them in parallel. This simulation checks if players are following game rules, including movement, interactions, and other mechanics. The server acts as a safety net for missed client-side detections, but most false positives are reviewed manually before any sanctions.

On the client side, Nemesis focuses on verifying the player's machine integrity. Instead of receiving all block data at once, ores are disguised as plain stone until the player can see them. The server predicts player movements and sends relevant information early, reducing latency and preventing cheating. If a cheat bypasses these measures, it can only see nearby ores for a short time. The server also monitors game integrity and terminates the game if cheats are detected.