Detects Logs
List of detections marked as important using Ocean Screenshare Tool on Minecraft
Ocean has several detection capabilities, including direct, generic, and specific detections. In this section, we will go step by step through the generic and specific detections, as it is practically impossible to describe all our direct detections.
Direct
Direct cheat detections using residues or other detection methods (e.g., Skript Loader).
Generic
Detections of highly suspicious executables; while they are not 100% certain detections (unless otherwise specified by this documentation), they indicate a strong likelihood of cheating.
Specific
Detections of tampering or modification methods used to gain illegal advantages, cheat dependencies, etc.
Generic Clicker (JNativeHook)
Indicates that the user used a generic autoclicker that uses JNativeHook imports (usually seen in autoclickers made with Java).
Suspicious Unloaded Module
Indicates that a DLL was unloaded from the game process.
Generic Cheat Render
Indicates that a GUI/Render module external to the game was injected.
Generic Detour Hooking
Examine critical operating system functions to detect modifications to their original behavior, Looking for patterns that indicate execution redirection.
Generic ManualMap Injection
Indicates a dll injection using the Manual Map technique
Generic Cheat Injection
Indicates that an illegal external injection to the game was found.
Generic UI A
A GUI rendering external to the game process was detected, which was practically impossible and very rare to false-flag.
Game Process Injection
Secure cheat injection
Generic Modifications
Ocean can detect changes to game-loaded files, reducing to 0% the possibility of modifying a file within the game instance without being detected.
Generic JVM/JVMTI Injection
Generic detections for cheats that execute instructions using JVM and JVMTI.
Generic Internal SelfDestruct [Type C]
Indicates that there was a selfdestruct of an internal cheat.
Jnic Obfuscator Functions
Indicates that a mod loaded in the game is obfuscated using JNIC; this does not allow us to read the mod code, which makes it highly suspicious, and a manual check is required.
Game Hooking
Indicates that the suspect hooked a game process import, clearly indicating an injection
Generic Network Hooking
Examines network communication functions to detect interception or modification of network traffic An example is detailed here
Generic Input Hooking
Examines system input functions to detect interception of keyboard or mouse events. An example is detailed here
Generic Memory Hooking
Analyzes memory management functions to identify modifications that allow unauthorized memory manipulation. An example is detailed here
Generic Thread Hooking
Examines functions related to thread creation and management to detect manipulation of the threading system. An example is detailed here
Generic Region Hooking
Identifies small regions of executable memory containing multiple execution redirection patterns, which is characteristic of certain techniques An example is detailed here
Generic Render Hooking
Verifies the integrity of functions related to graphics rendering. Analyzes whether the original functions have been modified or redirected to unauthorized locations. An example is detailed here
Generic Shellcode Injection
Searches for patterns of executable code in memory that do not belong to known modules. Identifies common code injection techniques. An example is detailed here
Generic VA Injection
Detects executable memory allocations that are unusually close to loaded modules, which may indicate specific injection techniques. An example is detailed here
Generic Cheat A
Indicates a clear cheat injection to the game process
Generic Cheat C
Indicates a clear cheat injection to the game process
Generic Game Cheat Render
Indicates a clear cheat injection to the game process
Generic VP Cheat
Detects suspicious changes in memory permissions, specifically when memory regions change from non-executable to executable without being associated with legitimate modules. Can false in mod loaders or custom clients
Anomalous Class Detected
Detects classes that are obfuscated, packaged, or simply do not belong to the inheritance tree of a normal Java application. It may false in modloaders such as Lunar Client or Badlion Client (But its rare), since they are closed source and their code is likely to be obfuscated.
