# ===========================================
# Minecraft External JAR Injection Monitor
# ===========================================
param(
[string]$MinecraftRoot = "$env:APPDATA\.minecraft",
[int]$IntervalSeconds = 30
)
function Get-JavaMinecraftProcesses {
Get-CimInstance Win32_Process | Where-Object {
($_.Name -match 'javaw?\.exe') -and
($_.CommandLine -match 'net\.minecraft|minecraft|launcher')
}
}
function Parse-JavaArgs([string]$cmd) {
$agents = @()
$classpath = @()
# Match -javaagent
$agentRegex = '-javaagent:("[^"]+"|\S+)'
foreach ($m in [regex]::Matches($cmd, $agentRegex)) {
$val = $[Link][1].[Link]('"')
$agents += $val
}
# Match -cp or -classpath
if ($cmd -match '[-/]c(lass)?path\s+("([^"]+)"|(\S+))') {
$cpval = ($Matches[3]; $Matches[4]) -join '' | Where-Object {$_}
if ($cpval) {
$sep = ";" # Windows path separator
$classpath += $cpval -split [regex]::Escape($sep)
}
}
return [PSCustomObject]@{ Agents=$agents; ClassPath=$classpath }
}
Write-Host "===== Minecraft External JAR Injection Monitor ====="
$mcRootFull = (Resolve-Path $MinecraftRoot).Path
while ($true) {
$now = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
Write-Host "`n[$now] Scanning for external injected JARs..."
$procs = Get-JavaMinecraftProcesses
if (-not $procs) {
Write-Host "[INFO] No Minecraft java process found."
}
else {
foreach ($p in $procs) {
Write-Host "`n[PROCESS] PID $($[Link]) - $($[Link])"
$args = Parse-JavaArgs $[Link]
# Check -javaagent
if ($[Link] -gt 0) {
Write-Host "[CHECK] -javaagent entries:"
foreach ($a in $[Link]) {
if ($a -and (-not $[Link]($mcRootFull,
[[Link]]::OrdinalIgnoreCase))) {
Write-Host " [ALERT] EXTERNAL INJECTOR: $a"
} else {
Write-Host " [OK - inside .minecraft] $a"
}
}
} else {
Write-Host "[OK] No -javaagent flags."
}
# Check classpath jars
if ($[Link] -gt 0) {
Write-Host "[CHECK] ClassPath entries:"
foreach ($c in $[Link]) {
if ($c -and $[Link]().EndsWith(".jar")) {
if (-not $[Link]($mcRootFull,
[[Link]]::OrdinalIgnoreCase))) {
Write-Host " [ALERT] EXTERNAL JAR in classpath: $c"
}
}
}
}
}
}
Write-Host "`n[INFO] Sleeping $IntervalSeconds seconds before next scan..."
Start-Sleep -Seconds $IntervalSeconds
}