How a RedM anticheat actually works (and why most of them fail)

An anticheat is a machine built to answer one question: is what this client claims physically possible? Everything else - the panel, the alerts, the bans - is downstream of that question. This article walks through how you answer it on RedM, where the real ceiling is, and why an anticheat that works on FiveM starts lying the moment you drop it into Red Dead.

The starting position: the client holds every card

In RedM, like every multiplayer game built on RAGE, the game runs on the player's machine. That machine decides where the character stands, when the trigger is pulled, and what the bullet hit. Your server receives a story about it. A cheater is not "hacking your server" - he is editing the story before it is sent.

Which gives you the first rule, and it already disqualifies half the products on the market: a detection that lives on the player's machine can be switched off by the player. An injected menu shares the game's memory space. It can read your client Lua, patch it, or simply keep it from starting. Anything that matters has to be established somewhere the cheater does not own.

Three families of detection, weakest last

1. Cross-client corroboration - the strongest evidence

If the shooter says he hit someone, the victim gets a vote. Two independent clients describing the same event are hard to reconcile unless one of them is lying. This is the backbone of silent aim detection: the shooter reports an aim vector down the middle of the street, the victim reports taking a round that vector could never reach. To stay consistent, the cheater would have to corrupt both machines - including one belonging to a player he has never met.

2. Internal contradiction - strong, and cheap to run

Here the client contradicts itself. A character that covers thirty metres in half a second while the engine reports a movement speed of zero is not running; his coordinates are being written. A player who absorbs fifteen impacts confirmed by fifteen different shooters without losing a single point of health is not lucky.

This family carries most of the load in practice, because it needs no cooperation from anyone. The lie is visible inside the data the cheater sent you himself.

3. State observation - the weakest, and the most advertised

"The player has the invincibility flag set." True, trivial to read, and the number one source of false positives - because your own framework sets that flag on revive, during a cutscene, inside a safe zone, at spawn, while a medic script runs. An anticheat that alerts on a state without asking what caused it ends up accusing your admins and your own scripts.

Why a FiveM anticheat does not survive the move to RedM

RedM is not FiveM with horses. The assumptions that hold on GTA V fall over one by one on RDR3:

• The natives are different. Some do not exist. Others carry the same name with different behaviour. A guard written for GTA V simply never fires on RedM, and never raises an error while failing.

• Damage events do not behave the same. The event every FiveM anticheat leans on to count impacts is silent on the victim side in a share of RDR2 cases. Port the detector as-is and it sees nothing while reporting itself perfectly healthy.

• Mounts and trains break naive physics. A player standing in a moving wagon travels at the wagon's speed without "moving" - a speedhack, as far as a distance-over-time check is concerned. A horse at full gallop lands exactly on the threshold you would have picked for a man on foot.

• Fast travel and RP scripts relocate players constantly. Stagecoach rides, jail teleports, property interiors: without a way to recognise a scripted relocation, every one of them reads as a teleport.

The classic outcome of a port is thousands of alerts, nobody reading them, and staff who learn to ignore the channel. An anticheat that screams constantly is exactly as useful as one that is turned off. That failure mode has its own article: why your anticheat accuses your honest players. The full comparison, detector by detector, is in RedM anticheat vs FiveM anticheat.

What no anticheat will ever see

Stated plainly, because you will not be told this elsewhere: an anticheat running inside the game cannot see what happens outside the game. An external program reading memory without ever calling a game function, a second machine analysing the video feed, a hardware device nudging the mouse - none of it goes through the engine, so none of it can be observed from the engine. Any vendor claiming otherwise is selling you a feeling.

What stays observable is the effect. An external aimbot eventually produces an aim movement no human hand produces: an instant angular jump, a dead stop, a shot within the following instant. You do not detect the program. You detect the trace it leaves in the kinematics of the aim.

The exact values stay in-house, and not out of vanity: a cheat developer who knows them tunes his software to sit just underneath. This is one of the few places where secrecy actually buys defence rather than marketing copy.

Detecting is not enough - you have to be able to prove it

An alert is an accusation. When the player disputes it - and he will, often with a chunk of your community behind him - a line in a log file is worth nothing. What holds up is the reconstruction: where everyone stood, who fired, what the victim received, and the exact point where the two accounts stop agreeing.

That is the difference between "the anticheat flagged him" and "here is what happened". The distinction is not technical, it is political: it decides whether your ruling survives contact with your own playerbase.

The short version

1. 1

   Anything living on the player's machine can be neutralised by the player. The decision has to be made server-side.

2. 2

   Corroboration between two independent clients is the hardest evidence to forge.

3. 3

   State observation alone mostly produces false positives, because your own server produces the same states.

4. 4

   On RedM the FiveM assumptions are wrong: mounts, trains, scripted relocations and missing natives leave ported detectors either mute or hysterical.

5. 5

   An honest anticheat also tells you what it cannot see.

If you want to see what those case files look like on real data, the demo panel is open and the pricing is public. Baobab anticheat is the product this article describes, detections and panel on one page. The corroboration argument is taken apart shot by shot in silent aim detection on RedM, and the architecture question is settled in server-side vs client-side.