Osu! Hacks - How they all work, and how to catch them.
Hello everyone! Since I am writing this, I hope you will take the time to read through the entire text. It will be fairly lengthy, as it has to cover a variety of different hacks. I want to add this: Even if, as I describe features, you believe "Oh I could use this hack", I highly advise against it. Every cheater I have ever known, has always become disappointed with themselves. They might like it at first, feeling like they are finally improving, but eventually, reality will catch up to you. The shame you will feel, is worse than any consequence the staff will give you. So think twice. Chances are, even if you decide "I won't feel shame", you will get caught. I did not mention the name of any hacks in this, and simply explained what they are. They are all bad things, and using them, you are more likely to get caught than not to, so please, do remember that.
This is not very hack out there. Some people make their own private hacks, never to release them to the public. But, these are the majority you will see.
Firstly: Commonly available and used hacks:
The current, popular hacks are currently only three. There are hacks that 1) tap for you, 2) change speed of the song, and 3) change AR/hidden.
1) Explanation of the tapping hack There are currently two forms of tapping hacks, but I will only discuss the first, popular of them here. The first tapping hack does not work like the relax mod from osu. Instead, it simply taps for you. You can either alternate or single tap, there is a random offset that you can set (normally ~~ 23 or so is what people use, about the od8 accuracy SS setting), that allows people to not just have all their taps happening at the same time. There are two hotkeys: One for making you tap a 100, one for making you "gradually" lose accuracy, by making the taps slower and slower (IE: looking like you're running out of stamina). Finally, there are two settings for when it taps. One setting makes aiming easier, as it will tap when you are over the note (note detection), this is more likely to fuck up and not tap when a player misaims. However, the second version is harder to get used to, but harder to detect. This version taps based on the timing of the note, and not whether you are over it or not. You will tap if you miss a note with this version. Both of these are within the same hack, you just pick what you want. The second of these, where it taps for you whether or not you're over the note, is the easiest to catch on if someone snaps to a note, and begins to move away, and AFTER they move away, there is a tap. That sort of mis-timing is not something you will do if you're a human player. (Seriously, think about playing osu, that's just not how you play). Remember, only if it happens a lot, if it happens once, on one replay, its probably a fluke. The *******ination can come in low AR, but if low AR is the reason, it should be obvious. Please do not take this occssionally happening, or this being the only reason, to suspect someone.
Catching the tapping hack
Currently, the easiest ways to catch this hack, are either spectating and watching the player miss notes (the hack will not tap). Most people use note detection, so this works. However, what if the player doesn't miss? The easiest way for me is to look at streams. How are their streams balanced? When a normal player streams, their taps will fall relatively close together. A tap-hacker, however, will have their taps be on completely opposite sides of the hit error bar while streaming. They may hit at -12 ms, and then the next tap be +12 ms, and then -12 ms again (or something around there). If this continues throughout a stream, you can almost be guaranteed it's a tapping hack (but if it's once or twice, their fingers may just have locked up). This is not a sure fire way to catch someone, but it is fairly obvious when watching replays of a tapping hacker.
2) Explanation and how to catch the speed-changing hack
The song speed modifying hack is a very hard to detect hack for someone spectating (unless they use it blatantly, in which case your spectating will keep lagging and freezing), and can be hard to detect watching a replay. At the moment, it is "Detected", peppy will know if you are using it if he catches you in the act. This hack no longer works in increments, its now based off of any % a hacker wants. Whether it's 99%, or 1%, anything in between. It means it allows people to soft hack easier, and less noticeable. Obviously, if they are hacking at a way lower speed, it will still be obvious to catch, including in the replays (super fast cursor, inhuman reaction time to the next note)
EDIT: This has been updated, it still works on intervals, but its'
3) The AR-Changing hack, and how to possibly catch it This hack is pretty infamous, as niko used it in his atama play. The hack works by allowing you to enter a custom AR (Or a custom speed for the approach circles to come in, such as 500ms). This hack also allows for you to disable hidden, and to disable flashlight affect. This was also most likely the hack that cl8n was using (as it would be effective for all his susp. scores). Disabling hidden is very hard to catch (unless they are sightreading gods at gimmicky maps with hidden), and flashlight is kind of a no-brainer (played the map 3 times and fc'd with flashlight? I don't think so). However, to catch someone AR hacking is far harder. If it is someone setting everything to ar10, then they will always have a "late" reaction time to the note, if the ar is 9 or lower (9-9.9 is very hard to notice). The best way to catch someone AR hacking is: have them play ez mod, and make sure they don't leave osu/play another map and then immediately leave the map (as they could be resetting what AR they are hacking to). If someone goes from playing ar9.8 edited on an ar9 map, to ez, it will be very obvious when they react to ez mod like its just another ar9.8 map. Overall, this is probably the most abused hack, and I know many people in the top 1000 use it. However, as hard as it is to catch, it (luckily) doesn't provide as much advantage as tapping hack or song speed modifier. Do not suspect everyone in the top 1k of ar hacking, or everyone in general. However, it is definitely the most rampant, hard to catch, hack.
** Cursor hack: Currently reserved for when the new hack gets released**
The current cursor/aim hack is not working, and is blatant as hell when people use it, so I'll update this when the new hack gets released.
A couple, not-so-well known hacks.
1)Possibly tapping hack #2, plus other things it can do. Brief explanation of ways to catch it
The first of the hacks is a replay-player. It allows you to export a replay into it, and you can have that replay play on your osu as if someone is actually playing. This is VERY hard to detect, as they can either timewarp a play offline, save the replay, and then play the replay back at full speed on their osu, or they can grab a hd replay on a map, take off hd, and have it play on osu as well. The worst part about this hack, is that it allows "keys only", meaning you could have it work as a tapping hack. This is the second "tapping hack" I am talking about. The only way to catch if they are using this hack, is either if they are dumb and start a map that does not match their replay loaded (so their keys are off), or if they try a map multiple times using the keys-only option, and its obvious their key taps are identical each time. The best way to catch this, is spin speed. If they try to make a normal play DT, or a HT play normal speed, the spin speed will go crazy high. If a person who normally spins 350 is spinning 450 suddenly, and the play looks susp enough, it's a sign.
2) The playcount increasing hack, what it does, how to catch people using it
The last hack is one helpful for catching "smarter" multiaccounters. This hack is a playcount increaser, and it does as it saids. It allows you to increase your playcount by selecting a variety of maps in your osu folder, and it will submit failed attempts at a timed interval with certain score data (IE how many hits, 300s,100s,50s, and how long you played, as well as the score you failed at). The best way to catch a multiaccounter using this, is if their playcount is going up, but they aren't online (or you can't spectate them, yet they are gaining mass playcount). The other thing this hack lets you do, is change the submitted score data. This allows players to "level" their accounts, by failing a map at 1 billion score for instance, and 10000 hits. The hits and score get added to level, allowing you to quickly level up.
That's really it for the standard hacks, however, I will add the current mania hack as it seems to be rampant as well.
Mania hack - Ways to catch it and explanation
The mania hack works much like the tapping hack from standard, you have an offset you can choose, you can force 200s. This hack, the easiest way to detect it, it by random ass 200s, or a mass amount of rainbows in the hardest part of maps. As the hack is random with its offset, the hacker may look inhuman, by being able to nearly fully-rainbow the hardest part of, maniera for instance, but then randomly getting 200s on easy parts. For the most part, to detect this hack, just pay attention to how they do on one part of the map versus the hardest part, and where their 200s are, as well as their hit-timing spread. Just like in osu, their spread will be completely random AT ALL TIMES. If you are a mania player, you will know certain patterns are easier to hit than others, and slow parts are easier to time than others.
Final words: Thanks for reading all of this, it took some time to type up and is bound to have some typos as I have to edit it after I post it, however I hope you found it informative. Feel free to ask questions if you need me to clear something up (as I will happily), or just tell me to go die (if you're noklz, it's his favorite pass time. ). Remember, hacking is something that will only make yourself feel bad in the end, and I advise against it with all my will. I will do my best to keep this post updated (I don't regularly play osu anymore, much less monitor the hacking scene, especially since I dropped developing tools for the game). Remember that while this info may help to point to a cheater, none of the info in here is a fool-proof way to catch a cheater. Ultimately, people have different playstyles, and weird things can happen. However, use your brain, and normally you will be able to figure it out for yourself.
SERIOUS NOTE: DO NOT TRY TO ASK WHERE TO FIND THESE, OR EVEN GO ATTEMPT TO LOOK FOR THEM. JUST GOING ON THE WEBSITES THAT PROVIDE THEM CAN GET YOU RESET OR EVEN BANNED. IT IS NOT WORTH IT, NO MATTER HOW MUCH YOU MIGHT WANT IT. NATURAL IMPROVEMENT WILL ALWAYS BEAT HACKING, EVERY SINGLE TIME.
If this is helpful enough, I might try to message some of the osu! report moderators and see if they can either link this in the sideline, or sticky it.
If this is too much information on the hacks, I might make another post (If this one goes down), less on how the hack works, and more on how they fuck up. Not give the actual details of how each hack works, but give the "1) can not tap when you miss a note", type of info out instead. But do message me first, mods, please.
edit: PLEASE REFRAIN FROM MENTIONING ANYTHING ABOUT WHAT THESE ARE, WHERE TO GET THEM, OR ANYTHING ELSE IN THE COMMENTS. THEY WILL GET REMOVED. THANK YOU.
edit 2: If you see this post, and are thinking "Man, hacking could finally let me get over that pp-slump", please drop me a pm. I know how hard it is when you're just not improving, and I can try to help you improve. It's much better to focus on your own improvement, and feels so much better in the end. Cheating is never worth it, so please, just drop me a pm. I'll try to work with you and help you improve, rather than having you go have hacks do it for you.