Can server anticheats block Embedded Hardcoded URL?

Server-side anticheats monitor movement and packet anomalies, while static analysis with Leaf Mod Analyzer identifies hostile and unfair code before mods are loaded.

Embedded Hardcoded URL

Q: How does Leaf Mod Analyzer detect Embedded_URL?

Leaf Mod Analyzer performs static analysis of JVM bytecode and decompiled AST structures matching The detector inspects string constants in the class constant pool (`CONSTANT_Utf8`) for strings starting with `http://` or `https://` protocol prefixes. The rule flags any class that contains embedded web addresses. The primary technical limitation is that the check only records the existence of a URL string: it does not distinguish between legitimate resources (documentation, update JSON endpoints, bug trackers, translation platforms) and hostile endpoints (credential harvesters, unindexed binary droppers). in an isolated environment without executing untrusted JAR files.

🎮 Minecraft Gameplay Impact

Mods routinely contact external servers for legitimate features such as update checks, displaying documentation or issue tracker links, rendering custom skins, or displaying social community buttons on custom menus.

Embedded_URL inventories all hardcoded URL addresses present in mod classes. In the inspected sample from Destra Client (ru.destra.gui.MainMenuScreen), embedded URL string constants (SOCIAL_URL_*) are referenced by the menu initialization method ensureSocialButtons() to instantiate clickable UI buttons. Notably, in the author's original code, SOCIAL_ICON_TELEGRAM is passed alongside SOCIAL_URL_DISCORD, and SOCIAL_ICON_DISCORD alongside SOCIAL_URL_TELEGRAM.

The presence of hardcoded URLs does not make a modification malicious on its own; many legitimate mods include documentation and donation links. However, recording embedded URLs provides visibility into what external infrastructure a mod references, helping auditors identify telemetry endpoints, ad redirectors, or unindexed download hosts.

🔍 Functions & APIs Analyzed

ConstantPool CONSTANT_Utf8

String constant containing an http:// or https:// URL prefix.

⚙️ Decompiled Representation (Vineflower View)

public static final String SOCIAL_ICON_TELEGRAM = "c";
public static final String SOCIAL_URL_DISCORD = "hxxps://discord[.]gg/<redacted>";
public static final String SOCIAL_ICON_VK = "A";
public static final String SOCIAL_URL_VK = "hxxps://vk[.]ru/<redacted>";
public static final String SOCIAL_ICON_YOUTUBE = "b";
public static final String SOCIAL_URL_YOUTUBE = "hxxps://youtube[.]com/@<redacted>";
public static final String SOCIAL_ICON_DISCORD = "a";
public static final String SOCIAL_URL_TELEGRAM = "hxxps://t[.]me/<redacted>";

public void ensureSocialButtons() {
   if (this.socialButtons.isEmpty()) {
      this.socialButtons.add(new MainMenuSocialButton(this, FontManager.destraFont, SOCIAL_ICON_TELEGRAM, SOCIAL_URL_DISCORD));
      this.socialButtons.add(new MainMenuSocialButton(this, FontManager.mainFont, SOCIAL_ICON_VK, SOCIAL_URL_VK));
      this.socialButtons.add(new MainMenuSocialButton(this, FontManager.destraFont, SOCIAL_ICON_YOUTUBE, SOCIAL_URL_YOUTUBE));
      this.socialButtons.add(new MainMenuSocialButton(this, FontManager.destraFont, SOCIAL_ICON_DISCORD, SOCIAL_URL_TELEGRAM));
   }
}

🛡️ Bytecode Signature & Static Detection

The detector inspects string constants in the class constant pool (CONSTANT_Utf8) for strings starting with http:// or https:// protocol prefixes.

The rule flags any class that contains embedded web addresses. The primary technical limitation is that the check only records the existence of a URL string: it does not distinguish between legitimate resources (documentation, update JSON endpoints, bug trackers, translation platforms) and hostile endpoints (credential harvesters, unindexed binary droppers).