They Cracked My Server!

Some players found my server and imprisoned me...
SeedcrackerX: github.com/19MisterX98/Seedcr...
Texture Rotation: github.com/19MisterX98/Textur...
Mathew Bolan Seedcracking: • Reversing a Minecraft ...
Episode 09:
00:00 - Intro
00:27 - Reviewing Server Logs
01:53 - Leaking Server IP
03:16 - Other Server Scanning Projects
03:54 - Getting Imprisoned!
05:17 - Escaping the Maze
07:40 - PIN Code Door
08:29 - Jumping Puzzle
09:37 - Failing Final Quiz
10:41 - The Well of Death
12:07 - Seedcracking with SeedcrackerX
13:27 - Attacking Blurry Seed
15:56 - Manual Seedcracking with 19MisterX98
16:37 - Step 1: Copy an Area From Video
18:30 - What is a "Random Seed"
16:37 - Step 2: Finding Coordinates Through Texture Rotation
24:58 - Step 3: Cracking Seed Through Tree Leaves
26:13 - How a Minecraft Tree Generates
26:33 - World Seed, Population Seed, Chunk Seed, ...
32:15 - Text Seed vs. Number Seed
=[ ❤️ Support ]=
→ per Video: / liveoverflow
→ per Month: / @liveoverflow
=[ 🐕 Social ]=
→ Twitter: / liveoverflow
→ Instagram: / liveoverflow
→ Blog: liveoverflow.com/
→ Subreddit: / liveoverflow
→ Facebook: / liveoverflow

[@CZghost]

Seed cracking is genuinely something that blows my mind. The Minecraft community was able to crack a seed from literally a single small image (64x64), which happens to be the default pack.png icon for the default vanilla resourcepack. This is amazing!

[@luigigaminglp]

Even more impressive is the fact that the game was still in early development. The image contains few trees (1 i believe) and a waterfall. And it was a screenshot taken somewhere in that world, not a spawn location. Oh, and you couldn't input a seed in the early alpha versions.

[@CreaZyp154]

*128x128, but yeah, really impressive...

[@adicsbtw]

If i remember correctly they actually developed a machine learning tool specifically for upscaling 64x64 images from that exact version of minecraft to a higher resolution so that they could figure out the exact locations of blocks in order to bruteforce it properly

[@lightning_11]

I remember DocM77 on Hermitcraft accidentally looked at some bedrock and someone DMed him the supposedly hidden Hermitcraft seed. Amazing.

[@egesanl1]

Tecnicly no since it is a 50 50. There are 2 seeds that generates that. We can't be shure whitch seed notch had.

[@PatrickHener]

Dude you are killing it with the balance between information, fun and wow effect. Go on and please never let this good series die!

[@scorbett1236]

Thanks for having the proper way to get the world seed in this video. My plan was along the right lines, just couldn't quite get it to work (I couldn't get the rotations right). So it's nice to see how I should've done it, but it's also painful to see how close I was. Thanks for also giving the challenge, as although I was feeling like banging my head against the desk most of the time, it was a fun project to try and work on.

[@eckersplode]

Loving this series! Educational, informative and fun!

[@dXter76]

finding a random seed just for us to return 1337 and 42. well played.

[@sbsftw4232]

I found your channel a while back and watched a few videos out of curiosity, but the content was honestly over my head and I stopped keeping up. Since you've started this Minecraft content, I've been watching every episode. I hope you are willing and able to continue this series, it's very informative and entertaining at the same time. Thank you!

[@metabrix]

This one's the most interesting episode imo, very informative, thank you, keep up the good work! Can't wait to see another episode of minecraft hacked :)

[@nicolaskeroack7860]

This channel is pure genius, and easy to understand even for a beginner. Keep on the amazing stuff!

[@devttyUSB0]

Awesome series. Thanks to all the people involved in this.

[@FunctionallyLiteratePerson]

I'm reminded of the AntVenom seed videos. Love this, thanks

[@RealMeanHumanBean]

The seed finding looks like a fun functional programming exercise

[@m8_981]

This is one of the most interesting video of this series. I absolutely love it!!!

[@Ami-Wishes]

One of my favorite discoveries related to Minecraft seeds is the fact that there are actually an insanely large number of seeds more than you can actually get in vanilla. Minecraft uses the "core" 64-bit world seed as a basis, and then generates *multiple* seeds *per dimension* for different things like the decorator, noise map, structures, things like that. The cool part comes with the realization that all of those values are their own 64-bit integers, and all values are valid for those individual seeds. This means that, theoretically, it's possible to have two minecraft worlds that generated the same overworld, but entirely different nethers. But it *also* means that, through world editing or mods, you can edit those individual seeds to give them values that the 64-bit "core" seed can't generate. Minecraft world generation is like an iceberg. We have a large amount of seeds possible to generate at the surface, but there is an unimaginably huge number of worlds that aren't accessible in vanilla, but are perfectly valid worlds.

[@matthewbolan8154]

Ayyy

[@JimTheScientist]

Ayyy +2

[@itsmefrancois6825]

Props to 19MisterX98. This took me a while to understand and im mind blown. Genius idea and understanding

[@znxster]

The technical MC community are amazing people.

[@xB-yg2iw]

I am in love with this series

[@purplenanite]

I'm kinda sad - I attempted the unblur too, and I got the original "6", but the rest failed.

[@drunkayylienz3706]

nice try anyway! you were on a good path :D

[@Schatzjaeger2]

I thought about that that method too. But it's not that easy, I guess. You have to know the blur algorithm and the dimensions of the blur box.

[@purplenanite]

the attempt i got was "6JYV4Vxk_" - i didn't consider there were just numbers lol

[@purplenanite]

@@Schatzjaeger2 I got the dimensions - it must have been the algorithm, i guess.

[@ignvqm]

Awesome video. Love this technical stuff.

[@jesusgalvan8281]

All I can say is wow! These videos are amazing!

[@SharkUte]

I've played a bit in the minecraft tech community a while ago, it's funny seeing some familiar names in one of my favourite hacking channel :D ! Love the series, I might get back to MC at some point because of it :p.

[@DavidRockin1]

Sheeesh. The only seed cracking method I know is to hold someone at gunpoint to get a block game seed. I love this series, please continue

[@vwvvvww]

The blurred seed can also be recovered with hashcat, because the decimal seed is a java hashcode of a seed string, I was able to find it that way aswell

[@Richard-wi5eb]

what, how?

[@vwvvvww]

@@Richard-wi5eb hashcat has the Java hashcode algo, look it up in the wiki or --help

[@Richard-wi5eb]

@@vwvvvww yes, but I don't see how that would help with the blurred image?

[@jamefarner2433]

Nice work all! that was really impressive to see!

[@EnderKill98]

Those cracking possibilities are really awesome! Also goes to show that anyone hosting a server for others, where a seed should not be know should NEVER use a seed based on text input. Reasons why a server admin would not want the seed to be known: Finding out slime chunks (for easy slime farms without a lot of searching), finding out elytra locations in the end. Both have convenient online tools which always need the full world seed. But the server actually sends the first 8 bytes of the sha256 result for the world seed in the Respawn Packet (see wiki vg, not sure if links are okay in comments). This also allows brute forcing it. For a text based seed, I can figure it out in about 22 seconds using my rust code which uses all cpu cores (Ryzen 3700X 8C/16T). So yeah, with the ip, I would have taking a few seconds to minutes (finding the values in the packet and starting my seed cracker) as well. For random seeds it's a lot harder. The seed is a "new Random().nextLong()". The default random seeds depends on some hardcoded magic values a constructor counter and the system uptime. So to figure that out, I would basically need the exact uptime of the PC, when the world generated. Just brute forcing a second takes a few minutes because a second can have a lot of nano seconds. I have not investigated it, but maybe it could be optimized more. So if someone wants to find out a seed, the general advice would probably be, to trick the server owner into believing default seeds are week and custom ones aren't before he creates the server world. Mabye a nice piece of advice for people hosting servers to not be fooled by it.

[@itskdog]

However, as shown in the video, if you're able to connect to the server, there are hack clients that can bruteforce the seed in-game, so the best workaround currently is to not use vanilla world generation at all, though I'm not sure if that could be guarded against still, and custom worldgen datapacks in vanilla is still "experimental" with breaking changes happening every so often as they're still working on it.

[@Makotom]

I don't know if your project is open source, but if so, could you share the link? I'm studying about rust and I would like to learn how you implemented the thread system :D

[@FireballPSNMods]

Love the series my dude

[@260Xander]

GAHHH, I saw the IP but assumed you'd have used a dummy server IP, not your real one! 😭 Lesson learned, challenge your assumptions lol

[@JimTheScientist]

That’s an assumption I make all the time, but after making content myself I realized that if I’m not too good at hiding things, other KZbinrs probably aren’t either

[@themadichib0d]

its an important lesson for real world bug hunting/security testing. How often do you read a writeup of a very serious vulnerability in a major organization that was ultimately super simple? So many people overlook it because they just assume big organization X wouldnt have made that mistake and even if they did, some smarter hacker would have found it already. But that very same assumption is what kept it undetected until then.

[@xpp1e]

Honoured to be in your video!

[@dani3l3_]

thanks for the generation of trees/world explanation

[@SergejFrank]

18:50 nicely chosen seed :D

[@Smokeyyy337]

thx so much for subtitles!

[@LostArchivist]

These seed wizards` sorceries are terrifying in their power.

[@_tk2217]

Apparently I somehow ended up in the video off of finding the ip somewhere lol

[@JimTheScientist]

Where did you find it? I assume same place I did.

[@Red1984AnimalFarm]

its impossible to watch youtube without finding someone from df

[@_tk2217]

@@JimTheScientist yea I just saw it at the start of the video, should probably search through mc logs to see if I can find it again

[@JimTheScientist]

@@_tk2217yeah, it was pretty weird just seeing it and logging on after spending so much time server scanning for it and trying to crack the seed. the server was fun though. you should have played in it with us.

[@_tk2217]

@@JimTheScientist yea I kinda just forgot it existed after joining once since I didn't watch the end of that video I also didn't even do any scanning and just saw in the video

[@Kynatosh]

It was fun to play on the server! Also it's very well explained

[@TosterCx]

MisterX98 has mastered leaf reading :)

[@w3z315]

2:34 I shouldn't watch your videos when I'm barely awake lol :D

[@kfftfuftur]

your home IP is also in: 24:58 - Crafting a Minecraft 0day... 0:21 - Scanning The Internet for Minecraft Servers

[@AirKiter]

Sad seems that he changed his IP already.

[@memegrinch]

@LiveOverflow, so its techneclly possible, to, get someones cord if you have: the seed + a picture of natural generated blocks in the background, if im right?

[@AUATUWVSH]

ahh yes, combinational puzzles, Folgunthur was fun to implement in a gal16v8!

[@justvs102]

Dieser Mann ist ein König.

[@andythurman2390]

The server softwares paper and spigot provide mechanisms to create random seeds for pretty much everything that can have a seed individually, instead of using one monolithic seed. This isn’t full proof, but can help a lot against seed-cracking. Maybe if you ever make another server you could use this method and see if they can crack it then?

[@Evercreeper]

i love your intro

[@roarene317]

A Nice content :) Breakthrough minecraft education video that never taught would be possible.

[@DHIRAL2908]

10:16 Reiner reference!!! 😳

[@beschbekifft]

I have no clue about Minecraft but this was really interesting

[@jakob_123]

Nice video 👍

amazing video

[@Valery0p5]

This feels like, after 10 years a console has been cracked open in every possible way, all the reverse engineering has been done and the devs just come here from time to time to update their already complete toolset. Like coming back to a good friend. Feels good.

[@drgabi18]

9:21 the club marte is just honey bottles? i've been lied my entire life

[@E_mosfet]

how can you not make out the difference between lapis blocks and water

[@generic_youtubename5395]

How did he know how to reverse engineer the blurring function exactly as yours was?

[@Reichstaubenminister]

If you want to know how Club Mate tastes: Either tasty or like ashtray soda

[@3ncy]

oh cool!

[@Schatzjaeger2]

I think someone anticipated that you would take 16, because it is a power of 2.

[@sk3yda005]

perfect

[@anand_bhasme]

I loved to see MisterX, xpple and PR0CESS here!! Those are some genius guys!

[@akr4s1a]

You might want to take a look into PR0CESS. He's really not a good guy.

[@akr4s1a]

@Sploshwazere He installed spyware on Helga Rakel's PC

[@d3w01d]

The client looks like a self coded client, nice.

[@CeilingPanda]

I tried the pixel method for like 4 hours manually and failed, oh well :^) Should probably have automated it - of course I'm not alone in this, I used ShareX to pixilate the screen but it had a different pixilation algorithm I assume so I guess I was off by a bit.

[@quade-mc]

Lmao love how you call them "jumping puzzles"

[@m4rt_]

3:29 Wait.. I recognize that voice. It's ionar2

[@user-jd3gf5xw1x]

2:38 as a server owner I... am disgraced

[@sWi5s]

13, 37, 42 :-) You rule

[@eliblaney]

I can't help but notice that he used goto statements... oh no

[@moke7658]

PR0CESS is a really cool dude, he deserves more subs

[@echtertill]

Challenge still there? I wanna try

[@keinael]

Jumping on a Lapis block 🤭

[@kitetm7596]

More minecraft content :)

[@Respectable_Username]

I'm surprised just how much is based on the world seed. Like why not just get something from whatever function calls /dev/random in that language rather than being so strict about the world seed? Though in retrospect with the game getting this big, the almost perfect reproducability of worlds is certainly handy! Though I wonder why there are still a small few parts of the world which aren't tied to the world seed? It's just enough to make set-seed speedruns frustratingly not perfectly predictable!

[@user-jd3gf5xw1x]

29:38 "it's java you can read it yourself" imagine if you did this series a year earlier. the source code wasn't even public and all we had were obfuscated variable names

[@floskater99]

Well to be fair, the source code still isn't public, and community-made mappings for the variable and function names already exist since like a decade.

[@user-jd3gf5xw1x]

@@floskater99 well, even tho mojang mapping is still not really public, it's wayy better than using spitgot mappings or some others as it still wasn't completely mapped out and the variable and functions names were still a or b. while the spigot mappings might make more sense and are more stable(according to them when I asked in their discord), it just feels so nice being able to read everything other than occassionally having to find out or re-remember what this function does. and I love that I can see all of the function names

[@theepicblock1169]

Spigot mappings aren't full, but we have other community mappings that are pretty much complete such as yarn or whatever forge uses

[@petergreenslade4510]

Live overflow like stack overflow ? xD

[@ironnoriboi]

You should lookup the random functions that are written in OpenGL shaders for a good laugh :)

[@oblivion_2852]

Oh god no they're horrible xD

[@techtheguy5180]

This motivated me to relearn java. If i don't reply to comments its probably because I had a stroke.

[@AirKiter]

Can we still join the server I we find the Ip?

[@Wither_Strike]

I’m sure you won’t see this but I’ll post it anyway. Random question, I’m at the start of the video and see that you use docker for the minecraft server, but what hosting service are you using and why that particular one if you can say?

[@ees4.]

He uses Hetzner

[@ees4.]

hetzner

[@convince_me]

Wait, how does cracking the seed allow you to find the ip of the server?

[@luizcosta8122]

Even though its the most rudimentary part of the video, I'm impressed and can't figure out how the intro was made? Can someone explain?

[@LiveOverflow]

I wrote a plugin that would place blocks with that animation. Basically I use a textfile defining each frame, and the plugin would set the blocks.

[@luizcosta8122]

@@LiveOverflow Clever! Really appreciate the quality and effort of this series, definitely a favorite along with the bug bounty vuln disclosure analysis

[@NotGeri]

As much as I love this series, PR0CESS is a big no no, chief.

[@DerAbonnierer]

Why?

[@brr349]

@@DerAbonnierer he’s done BAD things (google his name)

[@DerAbonnierer]

@@brr349 I can not find anything

[@NotGeri]

You can find more information on HelgaRakel's channel. Not trying to advertise, just merely inform people. It's not easy to verify information regarding accusations like this but the video has enough detail to do your own research and make your own conclusions.

[@DerAbonnierer]

@@NotGeri Thanks

[@relt_]

that was 6 bits not 5

[@LukeeboyPlays]

@LiveOverflow hallo Live! Mein Name ist Luke! Ich liebe deinen Kanal auf KZbin, und ich spreche etwas Deutsch! Meine Hauptsprache ist jedoch Englisch.

[@-_._-_._-_._-_._-_._-]

honey bottle yerba lol

[@andrijacvjetkovic4662]

Look up world RNG manipulation. It hurts my head 🤕. You can manipulate spawning, looting enchantment and so much more. Hopefully you find it interesting 🤔. Love you 😘😘😘

[@kr1v]

3:30 is dat mayro?!

[@raptorjesus7632]

At 1:49-ish. Was that apex?

[@LiEnby]

Me wondering why you didnt just fly during the parkour challenge lol

[@LiveOverflow]

wouldn't have been fun :)

[@user-jd3gf5xw1x]

@@LiveOverflow +rep

[@teamunfair5096]

He's clever

[@Zedoy]

The Lesson we learn today kids is: bruteforce all your problems away!

[@guiAI]

so.. is the server still up?

[@popstonia]

hehe

[@fledermaus7061]

I'm really angry at myself for being lazy as I basically knew everything in the video.

[@276-]

Server IP still working? I want to join!

[@cuckgames]

22:09 ain't no way that was accidental bruh 3.696

[@Scaramouche122]

Too hard

[@bujitself]

The code itself is also XOR

[@276-]

Also, why are you saying we can play The Well of Death? I don't think there is a world download...

[@LiveOverflow]

join the server?

[@cookingandjava7574]

brute forcing the pin door would probably be faster using gray code

[@emilsbergs2722]

well then everyone who understands blur will still find your ip

[@Min-nx4ti]

"this is communist server, you can take whatever you want from chest" "i came back and what a surprise, im in prison" **USSR flashbacks intensified**

[@diegonavarro5486]

2:44 leaked again XD

[@ees4.]

wait i would have found it while it was still active, noooo

[@micheallovis5369]

Can You Make A game Trainer For Me For a Price If yes how can we get in Touch thanks

[@Rmly]

Hetzner?