Can server anticheats block Mod Menu Stealth Concealment?

Server-side anticheats monitor movement and packet anomalies, while static analysis with Leaf Mod Analyzer identifies hostile and unfair code before mods are loaded.

Mod Menu Stealth Concealment

Q: How does Leaf Mod Analyzer detect Modlist_Self_Hide?

Leaf Mod Analyzer performs static analysis of JVM bytecode and decompiled AST structures matching The detector evaluates class bytecode specifically under Fabric and Quilt mod loaders, requiring a three-part condition within the class file: - A class reference to Fabric loader internal classes: `FabricLoaderImpl` or `ModContainerImpl`. - A reflection method reference: `java/lang/Class.getDeclaredField` or `setAccessible`. - A collection removal method reference: `java/util/List.removeIf`. This combination identifies attempts to access the internal private mod list maintained by the mod loader via reflection and purge specific mod containers from it. The primary limitation is vector and loader specificity: this detector targets runtime reflection on Fabric and Quilt internal class names; persistent file-based concealment that hides modifications by rewriting Mod Menu configuration on disk is detected separately by `ModMenu_Config_Hiding` (also score 9). in an isolated environment without executing untrusted JAR files.

🎮 Minecraft Gameplay Impact

Mod loaders maintain internal collections of loaded modifications and expose public APIs (such as FabricLoader.getInstance().getAllMods()) used by menus and diagnostic utilities to query active mods.

Modlist_Self_Hide targets routines that access internal loader data structures via reflection and remove specific mod entries from the active list. When a mod removes its container, it remains active in the JVM and continues executing, but becomes invisible to queries made via loader APIs and in-game listing screens. This reflection-based list modification directly complements file-based concealment (ModMenu_Config_Hiding, score 9), which instead tampers with modmenu.json on disk to omit mods from the GUI.

This concealment technique is used to hide cheat modules during manual mod inspections. However, modifying internal loader collections can break other mods that iterate over loaded dependencies or cause unexpected errors during game shutdown.

🔍 Functions & APIs Analyzed

FabricLoaderImpl / ModContainerImpl

Internal Fabric loader classes storing the registry of loaded mods.

Class.getDeclaredField / setAccessible

Reflection APIs used to access private fields holding mod collections.

List.removeIf

Collection predicate method used to filter out the target mod container.

💻 Mod Implementation (Dev Source / Mapped)

package com.example.stealth;

import java.lang.reflect.Field;
import java.util.List;
import net.fabricmc.loader.impl.FabricLoaderImpl;
import net.fabricmc.loader.impl.ModContainerImpl;

public class ModListPurger {
    public static void purgeFromLoader(String targetModId) {
        try {
            FabricLoaderImpl loader = FabricLoaderImpl.INSTANCE;
            Field modsField = FabricLoaderImpl.class.getDeclaredField("mods");
            modsField.setAccessible(true);

            @SuppressWarnings("unchecked")
            List<ModContainerImpl> mods = (List<ModContainerImpl>) modsField.get(loader);
            if (mods != null) {
                mods.removeIf(container -> container.getMetadata().getId().equals(targetModId));
            }
        } catch (Exception ignored) {
            // Игнорирование ошибок при отсутствии доступа
        }
    }
}

🛡️ Bytecode Signature & Static Detection

The detector evaluates class bytecode specifically under Fabric and Quilt mod loaders, requiring a three-part condition within the class file:

A class reference to Fabric loader internal classes: FabricLoaderImpl or ModContainerImpl.
A reflection method reference: java/lang/Class.getDeclaredField or setAccessible.
A collection removal method reference: java/util/List.removeIf.

This combination identifies attempts to access the internal private mod list maintained by the mod loader via reflection and purge specific mod containers from it. The primary limitation is vector and loader specificity: this detector targets runtime reflection on Fabric and Quilt internal class names; persistent file-based concealment that hides modifications by rewriting Mod Menu configuration on disk is detected separately by ModMenu_Config_Hiding (also score 9).