• Disable Java ClassLoader signature verification to load classes with invalid signatures
• Disable Java public key signature checks
• Disable all Java SSL/TLS certificate checks
• Block Java URL connections
• Replace hosts of Java URL connections
• Make all Java HTTP(S) URLs fail
• Force all Java HTTPS URLs to HTTP
• Force all Java HTTP URLs to HTTPS
• Put all Java HTTP(S) URLs as a subdomain of a specified site, either with their current '.' separation or using an underscore (SSL/TLS certificate wildcards aren't multi-level)
• Force all Java HTTP(S) connections to be direct or through a specified proxy
• Set the cacerts trust store to one loaded from a URL at runtime
• Add certificates to the cacerts turst store temporarily at runtime
• Block all DNS queries
• Block all InetAddress resolutions
• Set the DNS resolver
• Block specified hosts or IP addresses from resolution
• Map a host or IP to another specified IP or host
• Set a list of hosts files to be loaded from URLs
• Set if the DNS server will respect the system hosts file mappings

• Replace Java Class getResourceAsStream loaded resources

• Replace yggdrasil_session_pubkey at runtime
• Block the blocked servers list from loading

You need to patch versions of Minecraft that are greater than, or equal to 1.7.6, or with authlib versions greater than, or equal to authlib-1.5.6.jar.

The yggdrasil_session_pubkey patches will have no effect on version that do not require it, and they will work the same without it or not.

See LICENSE.txt

1. Download/clone this repository, and cd into it
2. Edit build.ini and set the java_home entry in the GLOBAL section to your jva_home path.
3. Run build.py with python3
4. The JAR file will be in the build/jar directory

{ "respect_system_hosts": false, "dns_resolver": "127.0.0.1" }

This will set the DNS resolver to 127.0.0.1, and disable usage of the system hosts file for these queries.

{ "no_ssl": true, "force_proxy": {"type":"http", "address":"127.0.0.1", "port": 8080} }

This will disable all SSL/TLS certificate verification and force all URL connections to the HTTP proxy at 127.0.0.1:8080.

This can be useful if you want to send all of the Java application's web traffic through a web debugging proxy, such as mitmproxy or Fiddler. The disabling of certificate validation checks, or having a certificate store with their root certificate, is also need to decrypt HTTPS traffic.

{ "yggdrasil_session_pubkey": "http://1.0.0.127.in-addr.arpa/yggdrasil_session_pubkey.der", "underscore": "1.0.0.127.in-addr.arpa" }

This will replace the yggdrasil_session_pubkey.der file in authlib to be loaded from http://1.0.0.127.in-addr.arpa/yggdrasil_session_pubkey.der. This is loaded in when the JavaAgent starts, and it will be stored in memory for the remainder of the execution.

This will also cause all of the domains, such as sessionserver.mojang.com, to be changed to sessionserver_mojang_com.1.0.0.127.in-addr.arpa, and allow you to use the wildcard certificate that you have for 1.0.0.127.in-addr.arpa, or any actual domain, on sessionserver_mojang_com.1.0.0.127.in-addr.arpa.

System.out.println("The patch arguments are passed via the javaagent command line arguments, where the JavaAgent command is -javaagent:/path/to/javaagent.jar='THE_ARGUMENT_STRING_GOES_HERE'

They are formatted as a JSON string surrounded by single-tick quotes, such as '{"yggdrasil_session_pubkey":"https://example.com/my_fake_yggdrasil_session_pubkey.der", "debug":true}'

They are formatted as a JSON string surrounded by single-tick quotes, such as '{"dns_resolver":"127.0.0.1", "debug":true}'

They can also be passed as an URL to a configuration file. At all of the help sections where a URL is supported, file:/// and data: URLs are included. They will stay as the default if they are missing from the string, so you don't need to (but you can) have arguments in the argument string that are set as their listed default value.