Hidder 📂

Hidder is the client-side companion to the ModSeeker Paper plugin. Install it on your Fabric client and it handles the rest — reporting your installed mods, detecting your launcher, and proving everything through encrypted, tamper-proof communication that servers can trust.

Features

• Client-Side Only — Runs exclusively on the client with zero server-side components
• Native Security Module — Cryptographic operations run inside a compiled C++ library, not Java bytecode
• Hybrid Encryption — Mod list data is encrypted using RSA key exchange + AES-256-CBC
• Integrity Signatures — Every response includes a session-bound HMAC proving data authenticity
• Launcher Detection — Identifies which launcher started the game using native OS-level APIs
• Replay Attack Protection — Cryptographic nonces and timestamps prevent reuse of old responses
• Automatic Setup — Native libraries are extracted and loaded at runtime with no manual configuration

Version Compatibility

Download the JAR matching your Minecraft version from Modrinth or Releases.

Requirements

• Fabric Loader 0.17.2 or higher (0.18.0+ for 26.1)
• Fabric API
• Java 21+ (Java 25+ for Minecraft 26.1)
• A server running ModSeeker

Installation

1. Install Fabric Loader for your Minecraft version
2. Download the Hidder JAR matching your version from Modrinth or Releases
3. Place the JAR in your mods/ folder
4. Launch the game

No configuration is required. Hidder operates silently and responds automatically when a ModSeeker server requests verification.

How It Works

When you join a server running ModSeeker, the following process occurs automatically in the background:

Join Server
    |
    v
[ Announce Presence ]       -- Hidder tells the server it's installed
    |
    v
[ Cryptographic Challenge ] -- Server sends a unique challenge
    |                          Hidder signs it using the native security module
    v
[ Launcher Detection ]      -- Native module identifies your launcher
    |                          Result is sent alongside the challenge response
    v
[ Mod List Collection ]     -- Hidder reads your loaded mods from the Fabric runtime
    |                          Encrypts and signs the data
    |                          Sends it to the server
    v
[ Verification Complete ]   -- Server validates everything and admits you ✅

The entire process takes less than a second. You will not notice any delay during normal gameplay.

What Data Is Collected

All collected data is encrypted before transmission and can only be read by the target server.

Communication Protocol

Hidder communicates with ModSeeker over a custom Minecraft plugin messaging channel:

Security Architecture

Hidder's security is built on three principles: authentication, confidentiality, and integrity.

Authentication

Every connection uses a unique cryptographic challenge-response handshake. The server generates a random nonce; Hidder signs it using the native security module. This proves the client is running the authentic, unmodified Hidder mod.

Confidentiality

Mod list data is encrypted using hybrid encryption before transmission. A random AES-256 session key encrypts the payload, and the session key itself is encrypted with the server's RSA public key. Only the target server can decrypt the data.

Integrity

Each encrypted response includes a session-bound HMAC signature computed inside the native module. The server verifies this signature after decryption, ensuring the data was not modified and was produced during the current session — not replayed from a previous one.

Native Security Module

Critical operations run inside a compiled C++ library (hidder_vault.dll) rather than Java bytecode:

• Cryptographic key operations
• HMAC computation
• Launcher detection via OS APIs
• Data encryption

This significantly raises the difficulty of reverse engineering compared to standard Java-based mods.

Warning: Do not modify, replace, or delete the native library files. Doing so will break communication with ModSeeker servers.

Detected Launchers

Hidder can identify the following launchers through native OS-level inspection:

Unrecognized launchers are reported as unknown. Server administrators decide whether to allow or block unknown launchers.

Technical Summary

License

This project is licensed under AGPL-3.0. See the LICENSE file for details.