pandaninjas

Introduction

I was casually using my YouTube crawling bot (Kaelego) as I usually do to find new fake Hypixel Skyblock modifications that are present in YouTube video descriptions, when I stumbled upon this peculiar sample (Video: https://www.youtube.com/watch?v=akZl0ZajV-Y).

The channel from which the video was uploaded, "Tutpeter", has another video, uploaded July 23. The video shows a "duping mod", but the download links (MediaFire) showed that both files were uploaded from Germany on July 24 at 8:51 AM. Both files are also exactly the same size (756.3 KB). It is possible that the link was changed in the first video to a fresh link, with a new sample of tjx6.

The JAR file was very weird from the get go as neither Java decompilation software such as Recaf

Same-file anchors for Github

Making an anchor to another heading in the same file as the anchor is straightforward.

[The header of this page](#same-file-anchors-for-github)

Will show as The header of this page.

The heading should be downcased, spaces changed to hyphens, and removed anything not a letter, hyphen, or space. If this id is not unique, you add "-1", "-2", and so forth to the header.

ANSI Escape Sequences

Standard escape codes are prefixed with Escape:

Ctrl-Key: ^[
Octal: \033
Unicode: \u001b
Hexadecimal: \x1B
Decimal: 27

	package me.ddozzi.exampleclient.mixins;

	import net.minecraft.launchwrapper.ITweaker;
	import net.minecraft.launchwrapper.LaunchClassLoader;
	import org.spongepowered.asm.launch.MixinBootstrap;
	import org.spongepowered.asm.mixin.MixinEnvironment;

	import java.io.File;
	import java.util.ArrayList;
	import java.util.List;