CRITICAL: fix bug within LuaCombatApi allowing attack to happen in same tick as C0BPacketEntityAction

README.md

@@ -1,7 +1,7 @@
 <div align="center">
   <img src="src/main/resources/assets/minecraft/client/assets/gui/logo.png" width="128" height="128" alt="Alya Logo" />
 
-# Alya
+<h1>Alya</h1>
 
 *A free, open-source Minecraft cheat client.*
 

jars/run_config/Start.run.xml

@@ -1,25 +1,7 @@
-<!--
-  ~ Copyright (c) 2026 Alya Client.
-  ~
-  ~ Alya Client is a free, open-source Minecraft hacked client.
-  ~
-  ~     This program is free software; you can redistribute it and/or modify
-  ~     it under the terms of the GNU General Public License as published by
-  ~     the Free Software Foundation; either version 2 of the License, or
-  ~     (at your option) any later version.
-  ~
-  ~     This program is distributed in the hope that it will be useful,
-  ~     but WITHOUT ANY WARRANTY; without even the implied warranty of
-  ~     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-  ~     GNU General Public License for more details.
-  ~
-  ~     You should have received a copy of the GNU General Public License along
-  ~     with this program; if not, write to the Free Software Foundation, Inc.,
-  ~     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-  -->
-
 <component name="ProjectRunConfigurationManager">
   <configuration default="false" name="Start" type="Application" factoryName="Application">
+    <option name="ALTERNATIVE_JRE_PATH" value="azul-25" />
+    <option name="ALTERNATIVE_JRE_PATH_ENABLED" value="true" />
     <option name="MAIN_CLASS_NAME" value="start.Main" />
     <module name="Alya.main" />
     <option name="VM_PARAMETERS" value="-Xms2G -Xmx4G --sun-misc-unsafe-memory-access=allow --enable-native-access=ALL-UNNAMED -Dalya.dev.resources=$PROJECT_DIR$/src/main/resources" />

src/main/java/bypass/Alya.java

@@ -45,7 +45,6 @@
 import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
 
-@SuppressWarnings("SpellCheckingInspection")
 public final class Alya {
 
     private static final Alya INSTANCE = new Alya();
@@ -70,6 +69,7 @@ private Alya() {
     }
 
     public void initialize() {
+        this.luaEngine.bindApi();
         LuaMinecraftApi.registerEvents(eventBus);
         moduleManager.putAll(new ClickGUI(), new HUDModule(), new KeystrokesModule());
         initCommands();

src/main/java/bypass/lua/LuaEngine.java

@@ -49,10 +49,9 @@ public final class LuaEngine {
 
     public LuaEngine() {
         globals = JsePlatform.standardGlobals();
-        bindApi();
     }
 
-    private void bindApi() {
+    public void bindApi() {
         eventApi = new LuaEventApi();
 
         final LuaTable alyaTable = new LuaTable();
@@ -108,30 +107,23 @@ public LuaValue call() {
                     @Override
                     public LuaValue call(LuaValue resourcePathValue) {
                         final String resourcePath = resourcePathValue.tojstring();
-                        try {
-                            final String devDir = System.getProperty("client.dev.resources");
-                            InputStream inputStream = null;
-                            if(devDir != null) {
-                                final File devFile = new File(devDir + resourcePath);
-                                if(devFile.exists()) {
-                                    inputStream = new FileInputStream(devFile);
-                                }
-                            }
-                            if(inputStream == null) {
-                                inputStream = LuaEngine.class.getResourceAsStream(resourcePath);
-                            }
+                        try(InputStream inputStream = openScriptStream(resourcePath)) {
                             if(inputStream == null) {
                                 Alya.getInstance().getLogger().error("Lua script not found: {}", resourcePath);
                                 return LuaValue.NIL;
                             }
                             final LuaValue chunk = globals.load(new InputStreamReader(inputStream), resourcePath);
                             return chunk.call();
-                        } catch(final LuaError |
-                                      FileNotFoundException luaError) {
+                        } catch(final FileNotFoundException luaError) {
                             Alya.getInstance()
                                     .getLogger()
                                     .error("Lua error loading {}: {}", resourcePath, luaError.getMessage());
                             return LuaValue.NIL;
+                        } catch(final IOException ioException) {
+                            Alya.getInstance()
+                                    .getLogger()
+                                    .error("Error loading {}: {}", resourcePath, ioException.getMessage());
+                            return LuaValue.NIL;
                         }
                     }
                 });
@@ -173,18 +165,7 @@ public LuaValue call() {
     }
 
     public void loadScript(final String resourcePath) {
-        try {
-            final String devDir = System.getProperty("alya.dev.resources");
-            InputStream inputStream = null;
-            if(devDir != null) {
-                final File devFile = new File(devDir + resourcePath);
-                if(devFile.exists()) {
-                    inputStream = new FileInputStream(devFile);
-                }
-            }
-            if(inputStream == null) {
-                inputStream = LuaEngine.class.getResourceAsStream(resourcePath);
-            }
+        try(InputStream inputStream = openScriptStream(resourcePath)) {
             if(inputStream == null) {
                 Alya.getInstance().getLogger().error("Lua script not found: {}", resourcePath);
                 return;
@@ -204,6 +185,19 @@ public void loadScript(final String resourcePath) {
         }
     }
 
+    private InputStream openScriptStream(final String resourcePath) throws FileNotFoundException {
+        final String devDir = Optional
+                .ofNullable(System.getProperty("alya.dev.resources"))
+                .orElse(System.getProperty("client.dev.resources"));
+        if(devDir != null) {
+            final File devFile = new File(devDir + resourcePath);
+            if(devFile.exists()) {
+                return new FileInputStream(devFile);
+            }
+        }
+        return LuaEngine.class.getResourceAsStream(resourcePath);
+    }
+
     private String[] getAlyaScriptCore() {
         return new String[]{
                 "util/movement.lua",
@@ -299,7 +293,7 @@ public void reload() {
                 .getCommandManager()
                 .getCommands()
                 .removeIf(
-                        command -> !(command.getClass().getName().startsWith("dev.thoq.command.commands")));
+                        command -> command.getClass().getName().startsWith("bypass.lua."));
         loadedScripts.clear();
         loadAll();
         new ArrayList<>(Alya.getInstance().getModuleManager().getModules())

src/main/java/bypass/lua/api/LuaCombatApi.java

@@ -20,6 +20,10 @@
 
 package bypass.lua.api;
 
+import bypass.Alya;
+import bypass.event.EventHandler;
+import bypass.event.events.PacketSendEvent;
+import bypass.event.events.TickEvent;
 import bypass.util.IUtil;
 import net.minecraft.client.Minecraft;
 import net.minecraft.client.settings.KeyBinding;
@@ -30,10 +34,10 @@
 import net.minecraft.entity.player.EntityPlayer;
 import net.minecraft.item.ItemStack;
 import net.minecraft.item.ItemSword;
-import net.minecraft.network.play.client.C02PacketUseEntity;
 import net.minecraft.network.play.client.C03PacketPlayer;
 import net.minecraft.network.play.client.C07PacketPlayerDigging;
 import net.minecraft.network.play.client.C08PacketPlayerBlockPlacement;
+import net.minecraft.network.play.client.C0BPacketEntityAction;
 import net.minecraft.util.BlockPos;
 import net.minecraft.util.EnumFacing;
 import org.luaj.vm2.LuaTable;
@@ -49,8 +53,10 @@ public final class LuaCombatApi extends LuaTable implements IUtil {
     private static final Minecraft mc = Minecraft.getMinecraft();
     private final Set<String> friends = new HashSet<>();
     public static boolean isForcedBlocking = false;
+    public boolean isC0BPacketEntityActionBeingSent = false;
 
     public LuaCombatApi() {
+        Alya.getInstance().getEventBus().subscribe(this);
         set(
                 "setForcedBlocking",
                 new OneArgFunction() {
@@ -245,14 +251,18 @@ public LuaValue call(LuaValue entityIdValue) {
                         if(mc.theWorld == null || mc.thePlayer == null) {
                             return LuaValue.NIL;
                         }
-                        int id = entityIdValue.toint();
-                        Entity entity = mc.theWorld.getEntityByID(id);
+                        final int id = entityIdValue.toint();
+                        final Entity entity = mc.theWorld.getEntityByID(id);
                         if(entity == null) {
                             return LuaValue.FALSE;
                         }
+
+                        if(isC0BPacketEntityActionBeingSent) {
+                            return LuaValue.FALSE;
+                        }
+
                         mc.thePlayer.swingItem();
-                        mc.getNetHandler()
-                                .addToSendQueue(new C02PacketUseEntity(entity, C02PacketUseEntity.Action.ATTACK));
+                        mc.playerController.attackEntity(mc.thePlayer, entity);
                         return LuaValue.TRUE;
                     }
                 });
@@ -546,8 +556,8 @@ public Varargs invoke(Varargs args) {
                         if(mc.thePlayer == null) {
                             return LuaValue.NIL;
                         }
-                        float yaw = (float) args.checkdouble(1);
-                        float pitch = (float) args.checkdouble(2);
+                        final float yaw = (float) args.checkdouble(1);
+                        final float pitch = (float) Math.clamp(args.checkdouble(2), -90.0, 90.0);
                         mc.thePlayer.rotationYaw = yaw;
                         mc.thePlayer.renderYawOffset = yaw;
                         mc.thePlayer.rotationYawHead = yaw;
@@ -684,4 +694,18 @@ private LuaTable entityToTable(EntityPlayer ep) {
         t.set("isInvisible", LuaValue.valueOf(ep.isInvisible()));
         return t;
     }
+
+    @EventHandler
+    public void onSendPacket(final PacketSendEvent event) {
+        if(event.getPacket().getClass() == C0BPacketEntityAction.class) {
+            this.isC0BPacketEntityActionBeingSent = true;
+        }
+    }
+
+    @EventHandler
+    public void onTick(final TickEvent event) {
+        this.isC0BPacketEntityActionBeingSent = false;
+    }
+
+
 }

src/main/java/bypass/lua/api/LuaEventApi.java

@@ -24,7 +24,6 @@
 import bypass.event.IEvent;
 import bypass.event.IEventListener;
 import bypass.event.events.*;
-import bypass.event.events.*;
 import net.minecraft.client.gui.ScaledResolution;
 import net.minecraft.network.Packet;
 import net.minecraft.network.play.INetHandlerPlayClient;
@@ -391,9 +390,9 @@ public LuaValue call() {
                     new ZeroArgFunction() {
                         @Override
                         public LuaValue call() {
-                            if(packetSendEvent.getPacket() instanceof C0BPacketEntityAction) {
+                            if(packetSendEvent.getPacket() instanceof final C0BPacketEntityAction c0BPacketEntityAction) {
                                 return LuaValue.valueOf(
-                                        ((C0BPacketEntityAction) packetSendEvent.getPacket()).getAction().name());
+                                        c0BPacketEntityAction.getAction().name());
                             }
                             return LuaValue.NIL;
                         }
@@ -421,7 +420,8 @@ public LuaValue call(LuaValue delayValue) {
                             new Thread(() -> {
                                 try {
                                     Thread.sleep(delay);
-                                } catch(InterruptedException ignored) {}
+                                } catch(InterruptedException ignored) {
+                                }
                                 mc.addScheduledTask(() -> {
                                     if(mc.getNetHandler() != null && mc.getNetHandler().getNetworkManager() != null) {
                                         mc.getNetHandler().getNetworkManager().sendPacketNoEvent(packet);
@@ -575,7 +575,8 @@ public LuaValue call(LuaValue delayValue) {
                             new Thread(() -> {
                                 try {
                                     Thread.sleep(delay);
-                                } catch(InterruptedException ignored) {}
+                                } catch(InterruptedException ignored) {
+                                }
                                 mc.addScheduledTask(() -> {
                                     if(mc.getNetHandler() != null) {
                                         ((Packet<INetHandlerPlayClient>) packet).processPacket(mc.getNetHandler());

src/main/java/bypass/module/modules/render/HUDModule.java

@@ -109,7 +109,7 @@ public void onRender2D(final Render2DEvent event) {
             if(image != null) {
                 final int screenWidth = event.scaledResolution().getScaledWidth();
                 final int screenHeight = event.scaledResolution().getScaledHeight();
-                final int maxSize = 100;
+                final int maxSize = 150;
                 MC.getTextureManager().bindTexture(image);
                 final int texW = GL11.glGetTexLevelParameteri(GL11.GL_TEXTURE_2D, 0, GL11.GL_TEXTURE_WIDTH);
                 final int texH = GL11.glGetTexLevelParameteri(GL11.GL_TEXTURE_2D, 0, GL11.GL_TEXTURE_HEIGHT);
@@ -125,7 +125,7 @@ public void onRender2D(final Render2DEvent event) {
     }
 
     private void updateBPS() {
-        if (MC.thePlayer == null) {
+        if(MC.thePlayer == null) {
             blocksPerSecond = 0;
             return;
         }
@@ -136,7 +136,9 @@ private void updateBPS() {
             final double deltaZ = MC.thePlayer.posZ - lastZ;
             final double distance = Math.sqrt(deltaX * deltaX + deltaY * deltaY + deltaZ * deltaZ);
             final double timeDelta = (currentTime - lastBPSUpdate) / 1000.0;
-            if(timeDelta > 0) blocksPerSecond = blocksPerSecond * 0.8 + (distance / timeDelta) * 0.2;
+            if(timeDelta > 0) {
+                blocksPerSecond = blocksPerSecond * 0.8 + (distance / timeDelta) * 0.2;
+            }
             lastX = MC.thePlayer.posX;
             lastY = MC.thePlayer.posY;
             lastZ = MC.thePlayer.posZ;

src/main/java/net/minecraft/client/gui/GuiMainMenu.java

@@ -543,7 +543,7 @@ public void drawScreen(int mouseX, int mouseY, float partialTicks) {
             this.mc.getTextureManager().bindTexture(randomImage);
             final int texW = GL11.glGetTexLevelParameteri(GL11.GL_TEXTURE_2D, 0, GL11.GL_TEXTURE_WIDTH);
             final int texH = GL11.glGetTexLevelParameteri(GL11.GL_TEXTURE_2D, 0, GL11.GL_TEXTURE_HEIGHT);
-            final int maxSize = 150;
+            final int maxSize = 200;
             final float scale = Math.min((float) maxSize / texW, (float) maxSize / texH);
             final int drawW = (int) (texW * scale);
             final int drawH = (int) (texH * scale);

src/main/resources/lua/modules/other/dev.lua

@@ -20,5 +20,12 @@
 
 local moduleTable = alya.modules.register("dev", "module for testing things", "OTHER")
 
-alya.events.on("motion", function(event)
+alya.events.on("packetsend", function(event)
+    if not moduleTable.isEnabled() then return end
+    alya.chat.info("PACKET:SEND::" .. event.getPacketClass())
+end)
+
+alya.events.on("packetreceive", function(event)
+    if not moduleTable.isEnabled() then return end
+    alya.chat.info("PACKET:RECIEVE::" .. event.getPacketClass())
 end)