Cloud-Native Plugin Distribution & In-Memory Injection System for Minecraft Servers
VanityLicense is a complete cloud-based plugin management solution designed for secure, diskless plugin delivery. It consists of a Python Flask administration panel, a Spigot/Bukkit client plugin, and a high-performance C++ JNI native layer. It supports encrypted plugin uploads, cloud distribution, memory-only class loading, and full lifecycle server instance management.
- Python 3.11 + Flask: RESTful API and web administration interface.
- SQLite3: Lightweight database for server bindings and token management.
- Cryptography (AES-GCM): Secure encryption for plugin storage and transit.
- TOTP (pyotp): Two-factor authentication support.
- Custom PoW: Browser-based Proof-of-Work verification to mitigate DDoS attacks.
- Spigot API 1.8.8: Bukkit plugin framework compatibility.
- Maven: Build automation and dependency management.
- JNI Bridge: Interface between Java logic and native C++ performance modules.
- Cross-Platform: Native builds for Linux (glibc compatible) and Windows.
- Zero Dependencies: Custom implementations of SHA256/HMAC to ensure portability across Linux distributions.
- WinHTTP / BCrypt: Native Windows networking and cryptography APIs.
- miniz: Single-file ZIP parsing for JAR files directly in memory.
VanityLicense operates on a pull-based architecture where the Minecraft server fetches and loads plugins dynamically without touching the disk.
- Admin Upload: Plugins are uploaded via the web UI and stored encrypted on the server.
- Server Registration: The Minecraft server starts, and the native layer registers a unique hardware-bound token.
- Secure Fetch: The client requests plugins; the server streams AES-GCM encrypted data.
- Memory Injection: The native layer decrypts the JAR in memory, parses the bytecode, and injects classes directly into the JVM using JNI DefineClass, bypassing the filesystem entirely.
- Lifecycle Management: A heartbeat system keeps the connection alive and allows for remote administrative actions (e.g., graceful restarts).
The system utilizes a sophisticated JNI bridge to load compiled Java classes directly from memory. By leveraging Unsafe operations and custom ClassLoader manipulation, VanityLicense bypasses standard Java module restrictions to initialize plugins without writing .jar or .class files to the disk.
- At Rest: Plugins are encrypted using AES-GCM with a master key before being saved to the server's filesystem.
- In Transit: During download, plugins are re-encrypted with a temporary session key unique to each connection, ensuring forward secrecy.
Tokens are generated based on a combination of hardware identifiers (MAC address, Machine ID) and network information. This ensures that leaked credentials cannot be used on unauthorized machines.
The native layer includes built-in anti-debugging and anti-tampering measures. It monitors process status, detects attached debuggers, and protects against memory dumping tools (like jmap), ensuring the integrity of the runtime environment.
The web panel features a custom Proof-of-Work (PoW) challenge similar to Cloudflare Turnstile. Clients must solve a computational puzzle (SHA-256) before accessing the login portal, effectively mitigating brute-force and DDoS attacks.
| Layer | Protection |
|---|---|
| Transport | HTTPS enforced, HMAC-SHA256 request signing, Timestamp replay protection, Custom DNS resolution to prevent hijacking. |
| Storage | AES-GCM encrypted plugins, Session keys rotated per download, Automatic cleanup of expired sessions. |
| Auth | Hardware fingerprinting, IP locking, Rate limiting, TOTP 2FA for administrators. |
| Runtime | Anti-debugging threads, SIGQUIT interception (Linux), Watchdog processes, Java Agent blacklisting. |
© 2026 MoonJump Development. All Rights Reserved.