Every mention of 舞萌DX (maimai DX) in this article refers to the version operated in mainland China by 华立科技.
This article was originally “Random notes on maimai cheats and a guide to using third-party tools”, and has now been split into several articles so the levels stay distinct.
This article is only in-depth maimai research, for study, reference and discussion only. Its main purpose is to teach the wider maimai player base some basic common sense, show you how to protect your Net account, and demonstrate how your account gets destroyed by cheaters. This article does not endorse any form of cheating or hacking.
Thanks here to every legend who has published their cheats on GitHub and other platforms.
To log in at a 舞萌DX cabinet, you need to get a QR code from the 「舞萌 | 中二」 official account. Long-press the QR code and the decoded string is the SGWCMAID.
CAUTION
Serious warning
Never leak your SGWCMAID in any public setting
Provide your SGWCMAID only to people or services you trust.
If someone else obtains your SGWCMAID, it means they have operating permission on your maimai account and can log into it within the valid login window.
At the bottom of the SGWCMAID page there’s a notice showing how long the QR code is valid. Once it expires, the QR code can no longer be used for cabinet login, and you need to generate a new one.
QR code validity: about 10 minutes
Account login validity: about 30 minutes (measured 2025/08/27)
Once about 30 minutes have passed since the last QR code was obtained, the account enters a “frozen” state and cannot be logged into by any means
The state clears after a new QR code is generated
This is a protection mechanism for the account, to prevent abuse by attackers
User ID is not a friend code but the maimai national ID card the account identifier, associated with SGWCMAID
You can get the corresponding User ID from a SGWCMAID
Having the User ID also means having permission to operate that account; it can be used to log in or to G-key cheat on your account
maimai DX’s User ID is a sequential counter with a fixed prefix
So User IDs can be used for enumeration attacks, which explains how cheaters cheat your account, they enumerate User IDs to log into your account. If your account happens to be within the login validity window and not logged in, then you’re out of luck. So login validity is Wahlap’s last line of defence; without it, anyone’s account could be logged into at any time
The maimai server’s login session timeout is 15 minutes
Login must use the timestamp from when it was generated; logout must also use the corresponding timestamp
If you don’t log out properly (e.g. due to server packet loss, high latency or an abnormal crash), the account enters what we call the black room, and you can only wait for the session to time out on its own, or use your tools to clear it
This is a protection mechanism the server uses to prevent session abuse
But because maimai’s server latency is high, the actual black room duration can be longer than 15 minutes
After successful verification the server usually turns that login into a short-lived session, valid for about 30 minutes (measured 2025/08/27)
After the session expires or is explicitly logged out, you need to use a new SGWCMAID to log in again
If the session validity passes and no new QR code has been obtained, the account is put into the “frozen” state and you need to obtain a QR code to clear it
SGWCMAID is essentially a one-time login credential: within the validity window the holder can be identified by the server and obtain the corresponding userID, thereby gaining operating permission on the account
Although the character verification is irreversible, a leaked one can still be accepted directly by the server (as long as the timestamp hasn’t expired), so it must be kept strictly secret
The structure of SGWCMAID and the server-side verification are irreversible and time-limited, so you can’t reliably work out the userID locally just by decoding (the server has to return it)
At least that’s how it is right now
The same SGWCMAID can be accepted directly by the server within its validity window, unless a new QR code is obtained or the QR code expires. If someone beats you to it and uses the leaked SGWCMAID to get the User ID, then good luck to you.
Maimai cheats come in many varieties. Strictly speaking, HDD, Bot, score trackers, hacks and so on all count as cheats, because they all more or less use non-official channels to obtain server information or the program itself; the only question is whether the effect is good or bad.
Let’s focus on hacks first — the thing every maimai player should worry about
The essence is: within a valid session, write the user’s scores or collectibles and so on directly to the server. This is not the normal play flow.
Take the most common case, score injection:
A cheater will typically construct and send packets to the server, setting the target fields in the packet (such as musicId, level, achievement etc.) to insert or replace scores
Then there’s black-room account scanning:
Enumeration scanning means an attacker predicts or sequentially probes User IDs, combined with acceptable temporary credentials or weak login paths, to rapidly attempt logins across a large number of accounts
If a tested account happens to be within its valid login window, the attacker can directly obtain that account’s session and log in, then not actively perform a logout, which stops that player from playing normally. More advanced attackers also auto-continue, keeping the account locked for more than fifteen minutes — in serious cases, in units of hours
The mainland “social engineering database”
There are already attackers who, using your rating, avatar, name frame, background, nickname and other information, can query an account database to work backwards to your User ID and file your information into a database; some attackers are already selling these services on platforms like Xianyu
NOTE
How to protect your account
Don’t send your QR code/SGWCMAID in untrusted public settings
Don’t casually fetch QR codes outside of your play sessions
When posting b50, hide unnecessary information like your nickname as much as possible
The game program proper that runs on a maimai DX cabinet. app is the game program the official cabinet runs; HDD is generally used to run on unofficial cabinets such as home setups, and may come with some mod features, such as Auto Play
Updates the server pushes to cabinets come as .opt files, containing the content of the update being pushed, such as song data and other information
push time The time an opt is pushed and the cabinet is notified to download this update
release time The time the cabinet applies this update
Even if a cabinet has downloaded the opt it won’t update immediately; it only updates once the release time is reached
cyan::Some notes on the mainland server in 2025
On the first day of the DX2025 update, I’m sure you all saw KALEID×SCOPE leaking early on the Net official account. The reason was that the cheater *2372462 uploaded data for four gates, and the server didn’t block the gates in time, which caused this to happen
Fun fact:
The DX2025 cabinet program already contains some data up to Prism, such as collectibles and the code related to Kaleidoscope mode, but no song data — it’s just meant to be unlocked gradually according to SEGA’s update schedule. If you’re able to push an opt with song data to the cabinet, you can play it early, which also explains how the previously circulated mainland content like 宙天 was done
Their main use is helping players see their Best50 and other play results. The mainstream trackers are 落雪查分器 and 水鱼查分器; there are too many bots to count, but they serve the same purpose
This work is licensed under CC BY-NC-SA 4.0. Redistribution, remixing and adaptation are allowed for non-commercial use, provided the same license is used and the original author is credited.
