While you can [un]mark players as modders manually, 2T1 is also able to do it automatically, should certain conditions be met. This allows you to use the heavy Block From Modders feature to block stuff coming from them.
2T1 flags players as modders based on certain detections, which are always enabled (for example, if your protections block an incoming malicious event from them). However, you may also enable the following detections:
- Sync Crash Type Mismatch 2 is attempted.
Note that this detection could cause some false positives. Use it if the regular crash protections don't work for you.
- Poorly spoofed SCID is detected.
2T1 will compare the spoofed SCID with the real SCID. Useful against weak spoofs.
Spoofing the SCID to
0will crash everyone who leaves the lobby (2T1 patches this).
- Host token has been altered.
Host tokens identify your client in the peer network, and spoofing them is commonly used to force oneself as session host. You can see the token of other players in the Player Info Window.
- Character model is changed.
Peyote Plants will cause false positives when this detection is enabled.
- Lots of Script Events are sent.
Spamming certain Script Events in a single frame could cause the victim to crash. You can set a threshold between 5 and 100 events, although it's recommended to leave the default value (20): lower values would lead to a lot of false positives, and higher values could ignore an actual spam attempt.
You can also whitelist friends from the detection features, so that they're not (wrongfully) marked as modders. Fake Friends will also be whitelisted if they're added to the friends list.