├── settings.gradle ├── sk1er_mod.properties ├── gradle └── wrapper │ ├── gradle-wrapper.jar │ └── gradle-wrapper.properties ├── gradle.properties ├── src └── main │ ├── java │ └── club │ │ └── sk1er │ │ └── resourceexploitfix │ │ ├── ResourceExploitFix.java │ │ ├── tweaker │ │ ├── transform │ │ │ └── ResourceTransformer.java │ │ ├── ClassTransformer.java │ │ └── ResourceTweaker.java │ │ ├── hook │ │ └── NetHandlerPlayClientHook.java │ │ └── asm │ │ └── NetHandlerPlayClientTransformer.java │ └── resources │ └── mcmod.info ├── mod_info.txt ├── .gitignore ├── README.md ├── LICENSE ├── gradlew.bat └── gradlew /settings.gradle: -------------------------------------------------------------------------------- 1 | rootProject.name = 'Resource Exploit Fix' -------------------------------------------------------------------------------- /sk1er_mod.properties: -------------------------------------------------------------------------------- 1 | mod_id=resourceexploitfix 2 | display_name=Resource Exploit Fix 3 | not_complete=false 4 | hide=false 5 | -------------------------------------------------------------------------------- /gradle/wrapper/gradle-wrapper.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Sk1erLLC/Resource-Exploit-Fix/HEAD/gradle/wrapper/gradle-wrapper.jar -------------------------------------------------------------------------------- /gradle.properties: -------------------------------------------------------------------------------- 1 | modGroup=club.sk1er 2 | modVersion=2.0 3 | modBaseName=Resource Exploit Fix 4 | forgeVersion=1.8.9-11.15.1.2318-1.8.9 5 | mcpVersion=stable_22 6 | -------------------------------------------------------------------------------- /gradle/wrapper/gradle-wrapper.properties: -------------------------------------------------------------------------------- 1 | #Wed Jan 01 11:24:50 EST 2020 2 | distributionBase=GRADLE_USER_HOME 3 | distributionPath=wrapper/dists 4 | zipStoreBase=GRADLE_USER_HOME 5 | zipStorePath=wrapper/dists 6 | distributionUrl=https\://services.gradle.org/distributions/gradle-4.10.3-all.zip 7 | -------------------------------------------------------------------------------- /src/main/java/club/sk1er/resourceexploitfix/ResourceExploitFix.java: -------------------------------------------------------------------------------- 1 | package club.sk1er.resourceexploitfix; 2 | 3 | import net.minecraftforge.fml.common.Mod; 4 | 5 | @Mod(modid = "resourceexploitfix", name = "Resource Exploit Fix", version = "2.0") 6 | public class ResourceExploitFix { 7 | } 8 | -------------------------------------------------------------------------------- /mod_info.txt: -------------------------------------------------------------------------------- 1 |
This has been superseded by Patcher.
2 |Resource Exploit Fix fixes a security exploit in Minecraft 1.8
4 |This exploit allows the server to check if you have a file on your computer, and wasn't fixed until 1.9.
6 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | # eclipse 2 | eclipse 3 | bin 4 | *.launch 5 | .settings 6 | .metadata 7 | .classpath 8 | .project 9 | 10 | # idea 11 | out 12 | classes 13 | *.ipr 14 | *.iws 15 | *.iml 16 | .idea 17 | 18 | # gradle 19 | build 20 | .gradle 21 | 22 | #Netbeans 23 | .nb-gradle 24 | .nb-gradle-properties 25 | 26 | # other 27 | run 28 | .DS_Store 29 | Thumbs.db -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Resource Exploit Fix 2 | Fixes a security exploit in 1.8 preventing malicious servers from checking if files exist on a player's computer. 3 | 4 | **This exploit cannot be used to read the contents of a file and can only tell the server if a specific file exists.** 5 | 6 | **Please read the detailed report of the bug: https://ungeek.eu/minecraft-18-file-access/** 7 | -------------------------------------------------------------------------------- /src/main/resources/mcmod.info: -------------------------------------------------------------------------------- 1 | [ 2 | { 3 | "modid": "resourceexploitfix", 4 | "name": "Resource Exploit Fix", 5 | "description": "Fixes a critical bug in Minecraft 1.8.X that can be exploited to check if files exist on a users computer", 6 | "version": "2.0", 7 | "mcversion": "1.8.9", 8 | "url": "https://ungeek.eu/minecraft-18-file-access/", 9 | "updateUrl": "", 10 | "authorList": [ 11 | "Sk1er LLC", 12 | "Punkeel" 13 | ], 14 | "credits": "", 15 | "logoFile": "", 16 | "screenshots": [], 17 | "dependencies": [] 18 | } 19 | ] -------------------------------------------------------------------------------- /src/main/java/club/sk1er/resourceexploitfix/tweaker/transform/ResourceTransformer.java: -------------------------------------------------------------------------------- 1 | package club.sk1er.resourceexploitfix.tweaker.transform; 2 | 3 | import net.minecraftforge.fml.common.asm.transformers.deobf.FMLDeobfuscatingRemapper; 4 | import org.objectweb.asm.tree.ClassNode; 5 | import org.objectweb.asm.tree.MethodNode; 6 | 7 | public interface ResourceTransformer { 8 | String[] getClassNames(); 9 | void transform(ClassNode classNode, String name); 10 | 11 | default String mapMethodName(ClassNode classNode, MethodNode methodNode) { 12 | return FMLDeobfuscatingRemapper.INSTANCE.mapMethodName(classNode.name, methodNode.name, methodNode.desc); 13 | } 14 | } 15 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2020 Sk1er LLC 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /src/main/java/club/sk1er/resourceexploitfix/hook/NetHandlerPlayClientHook.java: -------------------------------------------------------------------------------- 1 | package club.sk1er.resourceexploitfix.hook; 2 | 3 | import net.minecraft.client.Minecraft; 4 | import net.minecraft.client.entity.EntityPlayerSP; 5 | import net.minecraft.client.network.NetHandlerPlayClient; 6 | import net.minecraft.network.play.client.C19PacketResourcePackStatus; 7 | import net.minecraft.util.ChatComponentText; 8 | import net.minecraft.util.EnumChatFormatting; 9 | 10 | import java.io.UnsupportedEncodingException; 11 | import java.net.URI; 12 | import java.net.URISyntaxException; 13 | import java.net.URLDecoder; 14 | import java.nio.charset.StandardCharsets; 15 | 16 | public class NetHandlerPlayClientHook { 17 | 18 | public static boolean validateResourcePackUrl(NetHandlerPlayClient client, String url, String hash) { 19 | try { 20 | URI uri = new URI(url); 21 | String scheme = uri.getScheme(); 22 | boolean isLevelProtocol = "level".equals(scheme); 23 | 24 | if (!"http".equals(scheme) && !"https".equals(scheme) && !isLevelProtocol) { 25 | client.getNetworkManager().sendPacket(new C19PacketResourcePackStatus(hash, C19PacketResourcePackStatus.Action.FAILED_DOWNLOAD)); 26 | throw new URISyntaxException(url, "Wrong protocol"); 27 | } 28 | 29 | url = URLDecoder.decode(url.substring("level://".length()), StandardCharsets.UTF_8.toString()); 30 | 31 | if (isLevelProtocol && (url.contains("..") || !url.endsWith("/resources.zip"))) { 32 | System.out.println("Malicious server tried to access " + url); 33 | EntityPlayerSP player = Minecraft.getMinecraft().thePlayer; 34 | 35 | if (player != null) { 36 | player.addChatMessage(new ChatComponentText( 37 | EnumChatFormatting.RED + EnumChatFormatting.BOLD.toString() + 38 | "[WARNING] The current server has attempted to be malicious but we have stopped them.")); 39 | } 40 | 41 | throw new URISyntaxException(url, "Invalid levelstorage resourcepack path"); 42 | } 43 | 44 | return true; 45 | } catch (URISyntaxException e) { 46 | return false; 47 | } catch (UnsupportedEncodingException e) { 48 | e.printStackTrace(); 49 | } 50 | 51 | return false; 52 | } 53 | } 54 | -------------------------------------------------------------------------------- /gradlew.bat: -------------------------------------------------------------------------------- 1 | @if "%DEBUG%" == "" @echo off 2 | @rem ########################################################################## 3 | @rem 4 | @rem Gradle startup script for Windows 5 | @rem 6 | @rem ########################################################################## 7 | 8 | @rem Set local scope for the variables with windows NT shell 9 | if "%OS%"=="Windows_NT" setlocal 10 | 11 | set DIRNAME=%~dp0 12 | if "%DIRNAME%" == "" set DIRNAME=. 13 | set APP_BASE_NAME=%~n0 14 | set APP_HOME=%DIRNAME% 15 | 16 | @rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. 17 | set DEFAULT_JVM_OPTS= 18 | 19 | @rem Find java.exe 20 | if defined JAVA_HOME goto findJavaFromJavaHome 21 | 22 | set JAVA_EXE=java.exe 23 | %JAVA_EXE% -version >NUL 2>&1 24 | if "%ERRORLEVEL%" == "0" goto init 25 | 26 | echo. 27 | echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 28 | echo. 29 | echo Please set the JAVA_HOME variable in your environment to match the 30 | echo location of your Java installation. 31 | 32 | goto fail 33 | 34 | :findJavaFromJavaHome 35 | set JAVA_HOME=%JAVA_HOME:"=% 36 | set JAVA_EXE=%JAVA_HOME%/bin/java.exe 37 | 38 | if exist "%JAVA_EXE%" goto init 39 | 40 | echo. 41 | echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 42 | echo. 43 | echo Please set the JAVA_HOME variable in your environment to match the 44 | echo location of your Java installation. 45 | 46 | goto fail 47 | 48 | :init 49 | @rem Get command-line arguments, handling Windows variants 50 | 51 | if not "%OS%" == "Windows_NT" goto win9xME_args 52 | 53 | :win9xME_args 54 | @rem Slurp the command line arguments. 55 | set CMD_LINE_ARGS= 56 | set _SKIP=2 57 | 58 | :win9xME_args_slurp 59 | if "x%~1" == "x" goto execute 60 | 61 | set CMD_LINE_ARGS=%* 62 | 63 | :execute 64 | @rem Setup the command line 65 | 66 | set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar 67 | 68 | @rem Execute Gradle 69 | "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %CMD_LINE_ARGS% 70 | 71 | :end 72 | @rem End local scope for the variables with windows NT shell 73 | if "%ERRORLEVEL%"=="0" goto mainEnd 74 | 75 | :fail 76 | rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of 77 | rem the _cmd.exe /c_ return code! 78 | if not "" == "%GRADLE_EXIT_CONSOLE%" exit 1 79 | exit /b 1 80 | 81 | :mainEnd 82 | if "%OS%"=="Windows_NT" endlocal 83 | 84 | :omega 85 | -------------------------------------------------------------------------------- /src/main/java/club/sk1er/resourceexploitfix/asm/NetHandlerPlayClientTransformer.java: -------------------------------------------------------------------------------- 1 | package club.sk1er.resourceexploitfix.asm; 2 | 3 | import club.sk1er.resourceexploitfix.tweaker.transform.ResourceTransformer; 4 | import org.objectweb.asm.Opcodes; 5 | import org.objectweb.asm.tree.ClassNode; 6 | import org.objectweb.asm.tree.InsnList; 7 | import org.objectweb.asm.tree.InsnNode; 8 | import org.objectweb.asm.tree.JumpInsnNode; 9 | import org.objectweb.asm.tree.LabelNode; 10 | import org.objectweb.asm.tree.MethodInsnNode; 11 | import org.objectweb.asm.tree.MethodNode; 12 | import org.objectweb.asm.tree.VarInsnNode; 13 | 14 | public class NetHandlerPlayClientTransformer implements ResourceTransformer { 15 | @Override 16 | public String[] getClassNames() { 17 | return new String[]{"net.minecraft.client.network.NetHandlerPlayClient"}; 18 | } 19 | 20 | @Override 21 | public void transform(ClassNode classNode, String name) { 22 | for (MethodNode methodNode : classNode.methods) { 23 | String methodName = mapMethodName(classNode, methodNode); 24 | 25 | if (methodName.equals("handleResourcePack") || methodName.equals("func_175095_a")) { 26 | methodNode.instructions.insertBefore(methodNode.instructions.getFirst(), cancelIfNotSafe()); 27 | break; 28 | } 29 | 30 | break; 31 | } 32 | } 33 | 34 | private InsnList cancelIfNotSafe() { 35 | InsnList list = new InsnList(); 36 | list.add(new VarInsnNode(Opcodes.ALOAD, 0)); 37 | list.add(new VarInsnNode(Opcodes.ALOAD, 1)); 38 | list.add(new MethodInsnNode(Opcodes.INVOKEVIRTUAL, "net/minecraft/network/play/server/S48PacketResourcePackSend", 39 | "func_179784_b", "()Ljava/lang/String;", false)); 40 | list.add(new VarInsnNode(Opcodes.ALOAD, 1)); 41 | list.add(new MethodInsnNode(Opcodes.INVOKEVIRTUAL, "net/minecraft/network/play/server/S48PacketResourcePackSend", 42 | "func_179783_a", "()Ljava/lang/String;", false)); 43 | list.add(new MethodInsnNode(Opcodes.INVOKESTATIC, "club/sk1er/resourceexploitfix/hook/NetHandlerPlayClientHook", 44 | "validateResourcePackUrl", "(Lnet/minecraft/client/network/NetHandlerPlayClient;Ljava/lang/String;Ljava/lang/String;)Z", false)); 45 | LabelNode labelNode = new LabelNode(); 46 | list.add(new JumpInsnNode(Opcodes.IFNE, labelNode)); 47 | list.add(new InsnNode(Opcodes.RETURN)); 48 | list.add(labelNode); 49 | return list; 50 | } 51 | } 52 | -------------------------------------------------------------------------------- /src/main/java/club/sk1er/resourceexploitfix/tweaker/ClassTransformer.java: -------------------------------------------------------------------------------- 1 | package club.sk1er.resourceexploitfix.tweaker; 2 | 3 | import club.sk1er.resourceexploitfix.asm.NetHandlerPlayClientTransformer; 4 | import club.sk1er.resourceexploitfix.tweaker.transform.ResourceTransformer; 5 | import com.google.common.collect.ArrayListMultimap; 6 | import com.google.common.collect.Multimap; 7 | import net.minecraft.launchwrapper.IClassTransformer; 8 | import org.apache.logging.log4j.LogManager; 9 | import org.apache.logging.log4j.Logger; 10 | import org.objectweb.asm.ClassReader; 11 | import org.objectweb.asm.ClassWriter; 12 | import org.objectweb.asm.tree.ClassNode; 13 | 14 | import java.util.Collection; 15 | 16 | public class ClassTransformer implements IClassTransformer { 17 | 18 | private static final Logger LOGGER = LogManager.getLogger("ResourceTransformer"); 19 | private final Multimap