NetworkChorus/SelectiveAuth
1
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
2 releases 2 tags
  • v0.2.0 50013a3ae5

    SelectiveAuth 0.2.0 — down to Minecraft 1.3.2, Legacy Fabric and BTWCE Stable

    NetworkChorus released this 2026-07-26 16:42:08 +00:00 | 1 commits to main since this release

    Extends SelectiveAuth down to Minecraft 1.3.2, and adds support for
    Legacy Fabric — validated against
    Better Than Wolves: Community Edition.

    The range is now 1.3.2 → 1.21.5

    The structural fingerprint already reached far below the previously tested
    floor. Scanning 1.2.5 through 1.6.4 found the auth gate unchanged on 1.3.2,
    1.4.7, 1.5.2 and 1.6.4 — and correctly found nothing on 1.2.5, because 1.3.1
    is where Mojang added the encryption handshake. Before that there is no
    getKeyPair, no encryption, and no branch worth forcing.

    13/13 jars now pass the real JVM bytecode verifier, spanning twelve years of
    Minecraft.

    Better Than Wolves: CE

    BTWCE is an unusual stack: Minecraft 1.6.4 on Legacy Fabric, running on
    Java 17–21 because it depends on GrossFabricHacks. It works drop-in, with
    all 12 of its mods loaded:

    alice -> AUTHENTICATE  serverId="-2bdbb7bf5b42fe41"
bob   -> NO_AUTH       serverId="-"
patched net/minecraft/class_801.method_1861
        (gate MinecraftServer.method_2984()Z, username in field_2888)

    Reproduce the whole stack with poc/setup-legacy.ps1. It must run on Java 17 —
    BTWCE rejects Java 8 outright at mod resolution.

    What pre-1.7 does differently

    • Pre-netty protocol. No VarInts, strings are length-prefixed UTF-16BE,
      different packet ids. poc/src/LegacyProbeClient.java speaks it.
    • Different discriminator. The server sends an encryption request either
      way       — encryption is not optional there. Intent is carried by the serverId
      inside it: a real hash means "verify with Mojang", "-" means "don't bother".
    • Auth goes to session.minecraft.net/checkserver.jsp, not authlib. That
      endpoint is still live, which is why selective auth is still meaningful on
      these versions.
    • No UUIDs exist. authlib arrived in 1.7.2; before that a player simply is
      their username.

    Changes

    Added the preLaunch Fabric entrypoint. This is what made it work at all.
    main and server are invoked through a hook the game provider injects into
    Minecraft's own startup, and Legacy Fabric's 1.6.4 provider injects neither on a
    dedicated server — the mod loaded, appeared in the mod list, and silently did
    nothing. preLaunch is invoked by Knot itself, so it fires on every Fabric
    variant, and it is the better moment regardless: it runs before any Minecraft
    class is defined. Modern Fabric now uses it too, with no regression.

    uuid-mode and skins-for-unauthenticated now warn on pre-1.7 servers. They
    already degraded to no-ops, but silently. The server now says plainly that they
    have nothing to act on, the same way it already warns about
    enforce-secure-profile. Selective authentication and reserve-premium-names
    work normally there.

    New tooling: poc/src/LegacyProbeClient.java (pre-1.7 login probe),
    poc/src/StringScan.java (works out how a given version talks to Mojang),
    poc/setup-legacy.ps1 (installs Legacy Fabric + BTWCE end to end).

    Unchanged

    Everything from 0.1.0 still passes: both modes, all three uuid-mode values,
    skins, reserve-premium-names, hot reload, and the imposter test. Verified live
    on Forge 1.12.2, Forge 1.20.1, NeoForge 1.21.1, Fabric 1.20.1, vanilla 1.21.1 and
    now Legacy Fabric 1.6.4 — six platforms, five naming schemes.

    Downloads