A Easy Way to Bypass CheckHacks

[Autotto]

Code Analysis

private HackResult evaluateResponse(HackDefinition hack, String resp, boolean exploitPreventer) {
    if (resp.isEmpty()) return HackResult.NOT_DETECTED;                 // Edge Case Privilege A: Empty
    String lowerKey = hack.getLowerKey();
    int keyLen = lowerKey.length();
    if (resp.length() == keyLen + 1 
            && resp.regionMatches(true, 0, lowerKey, 0, keyLen)
            && Character.isLetter(resp.charAt(keyLen))) {
        return HackResult.NOT_DETECTED;                                 // Edge Case Privilege B: key + "x"
    }
    return switch (hack.getMode()) { 
        case METEOR    -> { if (resp.equalsIgnoreCase(hack.getKey())) yield HackResult.DETECTED;
                            if (regionStartsWith(resp, hack.getLowerFallback())) yield HackResult.NOT_DETECTED;
                            yield HackResult.DETECTED; }
        case TRANSLATE -> { if (regionStartsWith(resp, hack.getLowerFallback())) yield HackResult.NOT_DETECTED;
                            if (resp.equalsIgnoreCase(hack.getKey())) yield HackResult.PROTECTED;
                            yield HackResult.DETECTED; }
        case KEYBIND   -> { if (exploitPreventer && resp.equalsIgnoreCase(hack.getKey())) yield HackResult.PROTECTED;
                            if (resp.equalsIgnoreCase(hack.getKey())) yield HackResult.NOT_DETECTED;
                            yield HackResult.DETECTED; }
    };
}

Bypass

Strategy	METEOR	TRANSLATE	KEYBIND (EP=false)	KEYBIND (EP=true)
FallBack Only	NOT_DETECTED	NOT_DETECTED	DETECTED	DETECTED
Key Only	DETECTED	PROTECTED	NOT_DETECTED	PROTECTED
Key + "x"	NOT_DETECTED	NOT_DETECTED	NOT_DETECTED	NOT_DETECTED
Empty Line	NOT_DETECTED	NOT_DETECTED	NOT_DETECTED	NOT_DETECTED
Any Value	DETECTED	DETECTED	DETECTED	DETECTED

btw, I guess we have another way to counter fallback based side channel attack ——
If a fallback value exists, return the fallback value.

[NikOverflow]

wait can it detect ep? I don't think so right? This is a timing thing or what? But what would happen if someone has bad ping?

[NikOverflow]

oh... yeah no. ExploitPreventer is safe. You could read the ExploitPreventer code to understand why it is safe. I'm working on an update that I publish in a few days. One of the things that is added then is that fabric-api is optional.

[Autotto]

yes, EP is safe, so I don't know why they're doing this.
and they also use another detect method: sending translation component with fallback values (like: ⟦NO_MODID⟧ etc).
If the returned result is the key itself, it will be flagged as PROTECTED.

[NikOverflow]

I mean it makes in a way sense. They try to detect as many mods that do this.

[NikOverflow]

I also looked into many mods that tries the same. Any other mod that I found can be detected in some way.

[NikOverflow]

I now created a new discussion that you can look into. Then you see what I mean.