Tool Encyclopedia
29 tools for Minecraft screen shares — install commands and usage notes.
RAM and Process Analysis
System Informer
site ↗Process, handle, loaded-DLL, and memory analysis. The primary tool for RAM dumps, inspecting modules loaded by javaw.exe, and detecting injected DLLs.
Usage
Open javaw.exe > Properties > Memory > Strings. Filter for .minecraft/mods, JNativeHook, or known cheat names.
Process Hacker 2
site ↗The predecessor to System Informer, with the same core capabilities: process, handle, DLL, and memory analysis.
Usage
Same workflow as System Informer. Useful as a fallback if it isn't available.
Strings (Sysinternals)
site ↗Extracts printable text strings from any binary file. Useful for analyzing .jar, .exe, and .dll files.
Usage
strings javaw.exe | findstr /i "killaura velocity fly" to search for strings inside a binary.
Filesystem and Search
Everything (VoidTools)
site ↗An MFT indexer with instant search across the entire filesystem. Finds any file in milliseconds.
Usage
Search for latest.log, ias.json, suspicious .jar files, files in %temp%, or hidden folders.
7-Zip
site ↗Archive extraction. Required for opening .log.gz, .zip, and .rar files.
Usage
Extract compressed Minecraft and launcher logs.
Notepad++
site ↗A text editor with regex search, file comparison, and syntax highlighting.
Usage
Open and search logs, JSON files, and configuration files with advanced find/replace.
Java Forensics
Luyten
site ↗A Java decompiler. Opens a .jar and shows its decompiled bytecode as readable Java source.
Usage
Open every .jar in the mods folder and look for suspicious packages or classes (liquidbounce, wurst, etc.).
JD-GUI
site ↗An alternative Java decompiler with a graphical interface for browsing decompiled source.
Usage
A drop-in alternative to Luyten for .jar analysis.
CFR
site ↗A command-line Java decompiler. Useful for automation and batch analysis.
Usage
java -jar cfr.jar mod.jar --outputdir ./decompiled/
Registry Forensics
RegScanner (NirSoft)
site ↗Advanced Windows Registry scanning with flexible filters.
Usage
Search for BAM, UserAssist, USBSTOR, ShellBags, and MuiCache entries.
RegistryLoaderView (NirSoft)
site ↗Shows registry keys loaded at system boot.
Usage
Check which keys are loaded at startup.
RegShot
site ↗Compares registry snapshots taken before and after an event to detect changes.
Usage
Take a snapshot before and after running a suspicious program.
Prefetch and Timeline Forensics
WinPrefetchView (NirSoft)
site ↗Displays and analyzes Windows Prefetch files, including executables run, dates, and run counts.
Usage
Search for conhost.exe, powershell.exe, wscript.exe, and javaw.exe. Check which files they loaded.
LastActivityView (NirSoft)
site ↗Shows recent system activity: files opened, programs run, and connections made.
Usage
Build a complete timeline of the player's recent activity.
ExecutedProgramsList (NirSoft)
site ↗A complete history of executed programs with dates and paths.
Usage
Find executables that shouldn't be present on the machine.
RecentFilesView (NirSoft)
site ↗Files opened or modified recently.
Usage
Find recently modified files that could indicate a cheat.
USB and Peripheral Forensics
USBDeview (NirSoft)
site ↗A complete history of every USB device connected, with first/last-connected timestamps and serial numbers.
Usage
Find USB devices disconnected just before the screen share (Flag D).
USBLogView (NirSoft)
site ↗Real-time logging of USB connect/disconnect events.
Usage
Monitor USB connections live during the screen share.
Network Forensics
Wireshark
site ↗Network packet analysis. See exactly what the machine is communicating with.
Usage
Deep inspection of traffic, protocols, and connections.
TCPView (Sysinternals)
site ↗Shows every active TCP/UDP connection alongside the owning process.
Usage
See which processes have active connections. Spot connections to VPN or cheat servers.
CurrPorts (NirSoft)
site ↗An alternative to TCPView with additional filtering options.
Usage
Same workflow as TCPView.
Disk Forensics
FTK Imager
site ↗Creates forensic disk images. Useful for preserving evidence.
Usage
Image the disk before modifying anything on it.
Autopsy
site ↗An open-source forensics platform for full disk analysis.
Usage
In-depth forensic analysis of the hard drive.
WinDirStat
site ↗Visualizes disk space usage to help locate large hidden folders.
Usage
Find large hidden folders that could contain cheats or logs.
System Tools
Autoruns (Sysinternals)
site ↗Every program configured to run at boot, logon, or service startup.
Usage
Find hidden programs configured to launch at startup.
AccessChk (Sysinternals)
site ↗Displays permissions on files, folders, and registry keys.
Usage
Check for suspicious permissions on files or folders.
AccessEnum (Sysinternals)
site ↗Shows permissions on files, folders, and registry keys in a single view.
Usage
Find files or folders with modified permissions.
Scripts and Automation
AstroSS
site ↗A PowerShell script for screen shares. Extracts BAM entries with timezone correction, Authenticode signature checks, and path reconstruction.
Usage
Run as Administrator to extract BAM entries with last-execution time and signature status.
ScreenShareTool
site ↗The forensic GUI/CLI behind this site: 48 tracked cheat clients, BAM parser, whole-PC scan, and false-positive filtering.
Usage
python -m screenshare_tool --gui for the app, or --days 7 for CLI.