CharlieRP ScreenShareTool

CharlieRP ScreenShareTool is a comprehensive forensic analysis tool designed for Minecraft server administration. It detects multi-accounting, cheat self-destruction, registry alterations, suspicious deletions, and account switches across multiple Minecraft launchers.

Originally written in PowerShell, v3.0 has been completely rewritten in Python (Windows/macOS/Linux) and Bash (macOS/Linux/FreeBSD) with optimized performance, reduced false positives, and clean organized text reports.

winget install LeoGalli.CharlieRPScreenShareTool

Download the latest screensharetool.exe from Releases and run it directly. No Python installation required.

# Clone the repository
git clone https://github.com/Leo-Galli/ScreenShareTool.git
cd ScreenShareTool

# Run directly
python -m screenshare_tool --days 7

# Or install as a package
pip install -e .
screenshare-tool --days 7

# Download and run
curl -O https://raw.githubusercontent.com/Leo-Galli/ScreenShareTool/main/ss_tool_unix.sh
sudo bash ss_tool_unix.sh

# Run as Administrator
python -m screenshare_tool

# With parameters
python -m screenshare_tool --days 7
python -m screenshare_tool --days 30 --output C:\MyOutput
python -m screenshare_tool --quick  # Skip slow modules (journal, full nick search)

# Run as root
sudo bash ss_tool_unix.sh

# When prompted, enter the number of days to analyze
# Example: 7 for last week, 30 for last month

All reports are saved to C:\CharlieRP_SS\ (Windows) or /tmp/CharlieRP_SS\ (macOS/Linux):

CharlieRP_SS/
├── 01_AccountFiles/         # MC account files found/modified
├── 02_DeletedRenamed/       # Deleted/renamed executables
├── 03_JNativeHook/          # Autoclicker traces
├── 04_PrefetchDel/          # Deleted .pf files
├── 05_WMIC_Stream/          # ADS stream bypass attempts
├── 06_SolaLettura/          # Immutable/read-only files
├── 07_Cacls/                # Permission changes
├── 08_ExtSpoofed/           # Unicode spoofed extensions
├── 09_CestinoExe/           # Executables in trash
├── 10_Replace/              # Cheat-to-legit replacement patterns
├── 11_Regedit/              # Registry analysis (BAM, Store, MuiCache, USB)
├── 12_Prefetch/             # Prefetch status and file list
├── 13_Macro/                # Macro software detection
├── 14_Minecraft/            # Launcher analysis, accounts, logs
├── 15_Misc/                 # Crash dumps, event logs, AnyDesk
├── 16_SystemInfo/           # VM, VPN, hardware info
└── 17_Network/              # TCP connections, DNS, hosts

Reads the USN Journal for each drive and filters by date range to extract:

• Account Files: Minecraft account JSON files deleted/modified
• Deleted/Renamed: Executables with suspicious delete+rename patterns
• JNativeHook: Autoclicker library traces in temp directories
• Prefetch Deleted: .pf files manually removed to hide execution
• ADS Streams: Alternate Data Stream bypass attempts
• Read-Only: Forced immutable attributes on Prefetch
• Permissions: DACL changes on Prefetch directory
• Unicode Spoofing: Non-ASCII characters in filenames
• Trash Analysis: Executables found in recycle bin
• Replace Patterns: DELETE+RENAME on same file (cheat→legit swap)

• Store: Compatibility Assistant (never-launched executables)
• MuiCache: Application name cache
• WinRAR History: Recent archive operations
• OpenSave: File dialog history
• FileExts: Non-standard registered extensions
• USB Devices + USBSTOR: Connected peripherals with last-connection timestamps
• ShimCache: Application compatibility cache

A dedicated parser (based on AstroSS) extracts every executable's last run time from the BAM registry key with:

• Timezone correction (ActiveTimeBias / DaylightBias)
• SID → username resolution
• Drive path reconstruction (\Device\HarddiskVolumeN → C:\)
• Authenticode signature verification of each executable
• Both BAM key variants (bam\State and bam\UserSettings)

Supports 15+ launchers:

Features:

• Account extraction from JSON files
• InGame Account Switcher (IGAS) detection
• Log analysis for account switches
• Server history (servers.dat parsing)
• Hidden mod detection
• Chat keyword scanning

Monitors 48 known cheat clients for traces of self-deletion:

Detection sources:

• NTFS Journal (DELETE/RENAME on .jar files)
• BAM / MuiCache / Store registry entries
• UserAssist last-execution timestamps
• Prefetch .pf files with cheat names
• Whole-PC scan of all user areas (Desktop, Downloads, AppData, Temp...)
• Ghost folders (empty after self-deletion)
• Cleanup/self-destruct scripts
• JumpList traces
• Temp DLL files
• JVM suspicious arguments
• DNS cache (cheat server domains)
• Browser history (download traces)
• Alternate Data Streams (ADS) hiding spots
• Authenticode signature verification of found executables

screenshare_tool/           # Python package (Windows + macOS + Linux)
├── __init__.py             # Package metadata
├── __main__.py             # CLI entry point + orchestrator
├── config.py               # Cross-platform paths, patterns, definitions
├── utils.py                # I/O, console, registry, WMI helpers
├── journal.py              # NTFS USN Journal analysis (Windows)
├── registry.py             # Registry analysis (Windows)
├── bam.py                  # AstroSS-grade BAM last-execution parser
├── prefetch.py             # Prefetch analysis (Windows)
├── macro.py                # Macro software detection (cross-platform)
├── minecraft.py            # Launcher detection + account extraction
├── cheat.py                # Cheat self-destruction detection
├── nick_search.py          # Parallel nickname search
├── system.py               # VM/VPN/hardware detection
├── network.py              # TCP/DNS/hosts analysis
└── events.py               # Windows Event Log analysis

ss_tool_unix.sh             # Bash script (macOS/Linux/FreeBSD)

Contributions are welcome! Please feel free to submit a Pull Request.

1. Fork the repository
2. Create your feature branch (git checkout -b feature/AmazingFeature)
3. Commit your changes (git commit -m 'Add some AmazingFeature')
4. Push to the branch (git push origin feature/AmazingFeature)
5. Open a Pull Request

This project is licensed under the MIT License — see the LICENSE file for details.