GrimAnticheat / Grim

Fully async, multithreaded, predictive, open source, 3.01 reach, 1.005 timer, 0.01% speed, 99.99% antikb, "bypassable" 1.8-1.20 anticheat.
GNU General Public License v3.0
1.08k stars 317 forks source link

[BYPASS] GrimAC Combot Velocity (like 0% 100%) and Drop Noslow mode bypass #1599

Closed MatrixU5er closed 3 months ago

MatrixU5er commented 3 months ago

Describe the bypass and how to replicate it

use this velocity It will trigger when someone attacks you if (packet instanceof C0BPacketEntityAction) { C0BPacketEntityAction actionPacket = (C0BPacketEntityAction) packet; if (actionPacket.getAction() == C0BPacketEntityAction.Action.START_SPRINTING) { if (this.lastSprinting) { event.setCancelled(true); } this.lastSprinting = true; } else if (actionPacket.getAction() == C0BPacketEntityAction.Action.STOP_SPRINTING) { if (!this.lastSprinting) { event.setCancelled(true); } this.lastSprinting = false; } } } }

Grim version

latest

Server version

Unknown ( Chinese Minecraft : HuaYuTing )

https://github.com/user-attachments/assets/67693a2e-ea37-4b4e-af75-7867e8ffaf6c

https://github.com/user-attachments/assets/109f7dad-d003-4017-8a71-d8eb2a8f72c1

Plugins

grimac

MatrixU5er commented 3 months ago

object Drop : NoSlowMode("Drop") { var received = false private set

override fun onPacket(event: PacketEvent) {
    if (event.isCancelled)
        return

    if (!mc.thePlayer.isUsingItem)
        received = false

    if (event.packet.isUse && mc.thePlayer.heldItem.item.canUse) {
        sendPacket(C07PacketPlayerDigging(DROP_ITEM, ORIGIN, DOWN))
        received = false
    } else if (event.packet is S2FPacketSetSlot && mc.thePlayer.isUsingItem && !received) {
        if (event.packet.func_149175_c() != 0 || event.packet.func_149173_d() != serverSlot + 36)
            return

        event.cancelEvent()
        received = true

        mc.thePlayer.itemInUse = event.packet.func_149174_e()
        if (!mc.thePlayer.isUsingItem)
            mc.thePlayer.itemInUseCount = 0
        mc.thePlayer.inventory.mainInventory[serverSlot] = event.packet.func_149174_e()
    }
}

}

xia-mc commented 3 months ago

Super⭐QuickMacro⭐Time

145yeah commented 3 months ago

Super⭐QuickMacro⭐Time

ManInMyVan commented 3 months ago

object Drop : NoSlowMode("Drop") { var received = false private set

override fun onPacket(event: PacketEvent) {
    if (event.isCancelled)
        return

    if (!mc.thePlayer.isUsingItem)
        received = false

    if (event.packet.isUse && mc.thePlayer.heldItem.item.canUse) {
        sendPacket(C07PacketPlayerDigging(DROP_ITEM, ORIGIN, DOWN))
        received = false
    } else if (event.packet is S2FPacketSetSlot && mc.thePlayer.isUsingItem && !received) {
        if (event.packet.func_149175_c() != 0 || event.packet.func_149173_d() != serverSlot + 36)
            return

        event.cancelEvent()
        received = true

        mc.thePlayer.itemInUse = event.packet.func_149174_e()
        if (!mc.thePlayer.isUsingItem)
            mc.thePlayer.itemInUseCount = 0
        mc.thePlayer.inventory.mainInventory[serverSlot] = event.packet.func_149174_e()
    }
}

}

This abuses a desync (which is possible in vanilla) and isn't fixable unless we stop the player's item usage on slot update

ManInMyVan commented 3 months ago
        if (packet instanceof C0BPacketEntityAction) {
            C0BPacketEntityAction actionPacket = (C0BPacketEntityAction) packet;
            if (actionPacket.getAction() == C0BPacketEntityAction.Action.START_SPRINTING) {
                if (this.lastSprinting) {
                    event.setCancelled(true);
                }
                this.lastSprinting = true;
            } else if (actionPacket.getAction() == C0BPacketEntityAction.Action.STOP_SPRINTING) {
                if (!this.lastSprinting) {
                    event.setCancelled(true);
                }
                this.lastSprinting = false;
            }
        }
    }
}

This seems to only prevent BadPacketsF flags and not anything to do with velocity. "Combat Velocity" sounds like it's either using the attack slowdown (vanilla mechanic) or the entity collision leniency.

MatrixU5er commented 3 months ago
        if (packet instanceof C0BPacketEntityAction) {
            C0BPacketEntityAction actionPacket = (C0BPacketEntityAction) packet;
            if (actionPacket.getAction() == C0BPacketEntityAction.Action.START_SPRINTING) {
                if (this.lastSprinting) {
                    event.setCancelled(true);
                }
                this.lastSprinting = true;
            } else if (actionPacket.getAction() == C0BPacketEntityAction.Action.STOP_SPRINTING) {
                if (!this.lastSprinting) {
                    event.setCancelled(true);
                }
                this.lastSprinting = false;
            }
        }
    }
}

This seems to only prevent BadPacketsF flags and not anything to do with velocity. "Combat Velocity" sounds like it's either using the attack slowdown (vanilla mechanic) or the entity collision leniency.

This code is from other clients I found. Cheaters may have upgraded the code, and I tested your BadPackets3. java, which marks cheaters appropriately. I tested two clients from China (style and xylitol), each with a different marking situation。 But the premise is that I have lifted the loose check on 1.9+clients

MatrixU5er commented 3 months ago

i found another code and this velocity need for 1.9+ version https://github.com/xia-mc/Raven-XD/blob/master/src/main/java/keystrokesmod/module/impl/combat/Velocity.java

Main Code Logic for GrimAC Mode

1. Mode Setting

The mode setting part defines various modes, including the GrimAC mode:

public static final String[] MODES = new String[]{"Normal", "Hypixel", "Old Intave", "GrimAC", "Karhu", "Tick", "7-Zip"};
public static ModeSetting mode;
...
this.registerSetting(mode = new ModeSetting("Mode", MODES, 1));
...
private final SliderSetting reduce;
...
this.registerSetting(reduce = new SliderSetting("Reduce", 5, 0, 5, 1, new ModeOnly(mode, 3)));

Here, the modes are listed, and the GrimAC mode is assigned an index of 3. The reduce setting is also defined for this mode.

2. Handling GrimAC Mode in the onRotation Event

In the onRotation event, the code checks if the current mode is GrimAC and handles the velocity reduction accordingly:

@SubscribeEvent
public void onRotation(PreMotionEvent event) {
    if (lobbyCheck.isToggled() && isLobby()) {
        return;
    }

    if (mode.getInput() == 3) { // Index 3 corresponds to GrimAC mode
        if (gotVelocity && lastAttack != null
                && !KillAura.behindBlocks(new float[]{RotationHandler.getRotationYaw(), RotationHandler.getRotationPitch()}, lastAttack)) {
            final double motionX = mc.thePlayer.motionX;
            final double motionZ = mc.thePlayer.motionZ;
            if (((EntityPlayerSPAccessor) mc.thePlayer).isServerSprint() && MoveUtil.isMoving()) {
                grimAC$reduce();
            } else {
                mc.getNetHandler().addToSendQueue(new C0BPacketEntityAction(mc.thePlayer, C0BPacketEntityAction.Action.START_SPRINTING));
                grimAC$reduce();
                mc.getNetHandler().addToSendQueue(new C0BPacketEntityAction(mc.thePlayer, C0BPacketEntityAction.Action.STOP_SPRINTING));
            }
            if (debug.isToggled()) Utils.sendMessage(String.format("reduced %.2f %.2f", motionX - mc.thePlayer.motionX, motionZ - mc.thePlayer.motionZ));
        }
        gotVelocity = false;
    }
}

In this event, if the mode is GrimAC, the grimAC$reduce method is called to handle the knockback effect by reducing the player's velocity.

3. grimAC$reduce Method Implementation

The grimAC$reduce method sends animation and attack packets to reduce the player's movement speed:

private void grimAC$reduce() {
    for (int i = 0; i < (int) reduce.getInput(); i++) {
        PacketUtils.sendPacketNoEvent(new C0APacketAnimation());
        PacketUtils.sendPacketNoEvent(new C02PacketUseEntity(lastAttack, C02PacketUseEntity.Action.ATTACK));
        mc.thePlayer.motionX *= 0.6;
        mc.thePlayer.motionZ *= 0.6;
    }
}

This method reduces the player's motionX and motionZ values by multiplying them by 0.6, effectively reducing their velocity.

4. Handling GrimAC Mode in the onReceivePacket Event

In the onReceivePacket event, the code checks for the S12PacketEntityVelocity packet and handles it based on the current mode:

@SubscribeEvent
public void onReceivePacket(ReceivePacketEvent e) {
    if (!Utils.nullCheck() || LongJump.stopModules || e.isCanceled()) {
        return;
    }
    ...
    if (e.getPacket() instanceof S12PacketEntityVelocity) {
        if (((S12PacketEntityVelocity) e.getPacket()).getEntityID() == mc.thePlayer.getEntityId()) {
            if (onlyFirstHit.isToggled() && time - lastVelocityTime < resetTime.getInput()) {
                return;
            }
            lastVelocityTime = time;
            gotVelocity = true;
            if (lobbyCheck.isToggled() && isLobby()) {
                return;
            }
            switch ((int) mode.getInput()) {
                ...
                case 3: // Index 3 corresponds to GrimAC mode
                    // Handle knockback reduction for GrimAC mode
                    break;
                ...
            }
            ...
        }
    }
    ...
}

In this event, when receiving an S12PacketEntityVelocity packet, the code checks if the current mode is GrimAC and handles the knockback reduction accordingly.

Summary

The main logic for the GrimAC mode includes:

These code snippets collectively implement the logic for detecting and handling knockback effects in the GrimAC mode of the Minecraft plugin.

MatrixU5er commented 3 months ago

u can test on this client with viaforge

ManInMyVan commented 3 months ago

i found another code and this velocity need for 1.9+ version https://github.com/xia-mc/Raven-XD/blob/master/src/main/java/keystrokesmod/module/impl/combat/Velocity.java

Main Code Logic for GrimAC Mode

1. Mode Setting

The mode setting part defines various modes, including the GrimAC mode:

public static final String[] MODES = new String[]{"Normal", "Hypixel", "Old Intave", "GrimAC", "Karhu", "Tick", "7-Zip"};
public static ModeSetting mode;
...
this.registerSetting(mode = new ModeSetting("Mode", MODES, 1));
...
private final SliderSetting reduce;
...
this.registerSetting(reduce = new SliderSetting("Reduce", 5, 0, 5, 1, new ModeOnly(mode, 3)));

Here, the modes are listed, and the GrimAC mode is assigned an index of 3. The reduce setting is also defined for this mode.

2. Handling GrimAC Mode in the onRotation Event

In the onRotation event, the code checks if the current mode is GrimAC and handles the velocity reduction accordingly:

@SubscribeEvent
public void onRotation(PreMotionEvent event) {
    if (lobbyCheck.isToggled() && isLobby()) {
        return;
    }

    if (mode.getInput() == 3) { // Index 3 corresponds to GrimAC mode
        if (gotVelocity && lastAttack != null
                && !KillAura.behindBlocks(new float[]{RotationHandler.getRotationYaw(), RotationHandler.getRotationPitch()}, lastAttack)) {
            final double motionX = mc.thePlayer.motionX;
            final double motionZ = mc.thePlayer.motionZ;
            if (((EntityPlayerSPAccessor) mc.thePlayer).isServerSprint() && MoveUtil.isMoving()) {
                grimAC$reduce();
            } else {
                mc.getNetHandler().addToSendQueue(new C0BPacketEntityAction(mc.thePlayer, C0BPacketEntityAction.Action.START_SPRINTING));
                grimAC$reduce();
                mc.getNetHandler().addToSendQueue(new C0BPacketEntityAction(mc.thePlayer, C0BPacketEntityAction.Action.STOP_SPRINTING));
            }
            if (debug.isToggled()) Utils.sendMessage(String.format("reduced %.2f %.2f", motionX - mc.thePlayer.motionX, motionZ - mc.thePlayer.motionZ));
        }
        gotVelocity = false;
    }
}

In this event, if the mode is GrimAC, the grimAC$reduce method is called to handle the knockback effect by reducing the player's velocity.

3. grimAC$reduce Method Implementation

The grimAC$reduce method sends animation and attack packets to reduce the player's movement speed:

private void grimAC$reduce() {
    for (int i = 0; i < (int) reduce.getInput(); i++) {
        PacketUtils.sendPacketNoEvent(new C0APacketAnimation());
        PacketUtils.sendPacketNoEvent(new C02PacketUseEntity(lastAttack, C02PacketUseEntity.Action.ATTACK));
        mc.thePlayer.motionX *= 0.6;
        mc.thePlayer.motionZ *= 0.6;
    }
}

This method reduces the player's motionX and motionZ values by multiplying them by 0.6, effectively reducing their velocity.

4. Handling GrimAC Mode in the onReceivePacket Event

In the onReceivePacket event, the code checks for the S12PacketEntityVelocity packet and handles it based on the current mode:

@SubscribeEvent
public void onReceivePacket(ReceivePacketEvent e) {
    if (!Utils.nullCheck() || LongJump.stopModules || e.isCanceled()) {
        return;
    }
    ...
    if (e.getPacket() instanceof S12PacketEntityVelocity) {
        if (((S12PacketEntityVelocity) e.getPacket()).getEntityID() == mc.thePlayer.getEntityId()) {
            if (onlyFirstHit.isToggled() && time - lastVelocityTime < resetTime.getInput()) {
                return;
            }
            lastVelocityTime = time;
            gotVelocity = true;
            if (lobbyCheck.isToggled() && isLobby()) {
                return;
            }
            switch ((int) mode.getInput()) {
                ...
                case 3: // Index 3 corresponds to GrimAC mode
                    // Handle knockback reduction for GrimAC mode
                    break;
                ...
            }
            ...
        }
    }
    ...
}

In this event, when receiving an S12PacketEntityVelocity packet, the code checks if the current mode is GrimAC and handles the knockback reduction accordingly.

Summary

The main logic for the GrimAC mode includes:

  • Mode Setting: Defining the GrimAC mode and its related settings.
  • Event Handling: Checking the mode in onRotation and onReceivePacket events and calling the appropriate methods.
  • Knockback Handling: Using the grimAC$reduce method to reduce the player's movement speed, thereby controlling the knockback effect.

These code snippets collectively implement the logic for detecting and handling knockback effects in the GrimAC mode of the Minecraft plugin.

This uses the attack slowdown mechanic mentioned above, this isn't really fixable

MatrixU5er commented 3 months ago

All the problems that Grimac cannot solve can already infinitely amplify the advantage of cheaters, such as sprint scaffold, speed killaura noslow autoblock velocity backtrack superkb. :/

ManInMyVan commented 3 months ago

sprint scaffold

https://github.com/GrimAnticheat/Grim/blob/2.0/src/main/resources/config/en.yml#L45

MatrixU5er commented 2 months ago

sprint scaffold

https://github.com/GrimAnticheat/Grim/blob/2.0/src/main/resources/config/en.yml#L45

Should I open it or not , but I know that even if I open it, cheaters can still sprint scaffold

SamB440 commented 2 months ago

The velocity reduction wouldn't be possible if Mojang readded idle tick in a modern version