SNITCH

SNITCH

Server-side Notifier Inspecting Translation To Catch Hackers

A Paper/Spigot plugin that detects client-side mods (and resource packs) by abusing MC-265322 — the sign-translation vulnerability. The server fabricates an invisible sign, stuffs a mod's translation key into it with a fallback word, opens and force-closes the sign editor, and reads back the text the client reports. If the returned text differs from the fallback, that translation key resolved on the client — meaning the mod (or a resource pack defining the key) is installed.

⚠️ For server operators detecting mods on their own server. This relies on a known client vulnerability. A patch mod (e.g. by Nick Overflow) exists for players who want to block it. Use responsibly and within your jurisdiction's rules.

How it works

For each player, SNITCH runs this packet sequence (mirroring the technique from the video that inspired it):

1. Block Change → place a throwaway sign a few blocks below the player (never visible).
2. Block Entity Data → set the sign's lines to translatable components, each carrying a unique random fallback word.
3. Open Sign Editor → the client opens the editor and converts the translation keys to plain text.
4. Container Close → forces the editor closed; the client reports the resolved text.
5. Update Sign (inbound) → SNITCH compares each line to its fallback. A mismatch = the key resolved = mod detected.
6. Block Change → revert the fake sign to the real block.

A single sign carries four lines, so keys are probed four at a time. Batches are sent sequentially — the next batch only fires after the previous one gets a response. This prevents key mismatches when multiple mods are installed.

The scan fires shortly after join, during the terrain-loading screen, so the editor GUI is never seen.

Install

1. Install ProtocolLib (required).
2. Drop SNITCH-x.x.x.jar into plugins/.
3. Start the server — plugins/SNITCH/config.yml is generated with defaults.
4. Set your server-name, configure mods:, then /snitch reload.

Requirements: Paper/Spigot 1.21.x, Java 21, ProtocolLib.

Configuration

Server name

Shown in kick and ban messages via the %server% placeholder:

server-name: "My Server"

Flag actions

Each time a player is caught with the same mod, their flag count for that mod increases. You configure what happens at each count:

action:
  flags:
    1: KICK   # first detection → kick
    2: BAN    # second detection → permanent ban
  # Any count not listed defaults to LOG (console only).

  kick-message: "&cYou have been kicked from &e%server%&c: &f%mod% &cis not allowed."
  ban-message:  "&cYou have been permanently banned from &e%server%&c for using &f%mod%&c."

Supported actions: LOG, KICK, BAN.

Optional console commands run on every detection regardless of the flag action. Placeholders: %player%, %mod%, %key%, %evidence%, %flag%, %server%:

  commands:
    - "tellraw @a[permission=snitch.admin] {\"text\":\"[SNITCH] %player% flagged for %mod% (flag %flag%)\",\"color\":\"red\"}"

Configuring mods

Each mod entry maps a friendly name to a list of translation keys. The player is flagged as soon as any one key resolves — multiple keys per mod give more reliable detection.

To find the real keys for a mod, open its .jar (it's just a zip) and read assets/<modid>/lang/en_us.json. A wrong key simply never matches — there are no false positives.

mods:
  Freecam:
    - "key.freecam.toggle"
    - "key.freecam.config.open"
    - "key.freecam.controlPlayer.toggle"

  MeteorClient:
    - "key.meteor-client.open-gui"
    - "key.meteor-client.open-commands"
    - "key.category.meteor-client.meteor-client"

Note: Mods with no lang file (pure library/mixin mods like baritone-meteor) cannot be detected via this technique.

Commands

All under /snitch (permission snitch.admin):

Players with snitch.bypass are never scanned. Tab completion works on all subcommands.

Building

mvn package
# -> target/SNITCH-x.x.x.jar

Caveats

• Version sensitivity. Built against the 1.21 packet layout. If a batch never reports, tune close-delay-ticks in the config.
• In-game scans (/snitch scan on an already-loaded player) may briefly flash a sign editor. Join-time scans do not.
• This is an exploit of a real client bug. Mojang may patch it, and client-side patch mods can block it.
• Mods with no lang file (pure libraries, mixins-only) cannot be detected via this technique.

License

Provided as-is for educational and server-administration purposes.