0.03 allows excessive movement in cobweb

[Dbbtop]

Describe the bypass and how to replicate it

working at 0.39 speed.getValue()

(if (mode.getValue() == Mode.Fly) {
final double[] dir = MovementUtility.forward(speed.getValue());
mc.player.setVelocity(dir[0], 0, dir[1]);
if (mc.options.jumpKey.isPressed())
mc.player.setVelocity(mc.player.getVelocity().add(0, speed.getValue(), 0));
if (mc.options.sneakKey.isPressed())
mc.player.setVelocity(mc.player.getVelocity().add(0, -speed.getValue(), 0));)

Grim version

latest

Server version

1.19.4

Plugins

grim, LP, packetevents

[overkidding]

is this a troll or real? @SamB440 ?

[Dbbtop]

is this a troll or real? @SamB440 ?

I took this code from the cheat client

[Axionize]

What client is this from?

[Dbbtop]

What client is this from?

https://github.com/Pan4ur/ThunderHack-Recode

[SamB440]

This is a 0.03 issue, I will look into fixing this

[SamB440]

Although it might not be fixable on 2.0 engine due to how it calculates the possibility of 0.03

[Axionize]

Is the 0.002 on modern clients really enough uncertainty to let this bypass? Do we give 0.03 to clients that should only have 0.002?

[Axionize]

BadPacketsX and Z catches the ignore mode version of this. Enable experimental checks.

We really need to refactor and rename all the checks...

[ManInMyVan]

BadPacketsX catches this. Enable experimental checks.

it doesn't break blocks?

[Axionize]

The Ignore version is fixed by BadPacketsX/Z #1818 #1817

The fly version is not yet fixed but it can be mitigated on new versions by using the newer movement threshold. #1820

With the changes above on the latest MC version we go from easily bypassing at Fly Speed >=1.22 -> a max bypass speed of 0.64 while sprinting. 0.65 will instantly flag simulation and setback.