VitalProbe
In one line: a health-manipulation engine. It disassembles a mob's bytecode at runtime, reverse-engineers the dataflow behind
getHealth(), finds where the health value actually lives, writes to it, then verifies by reading it back.
- Minecraft 1.20.1 · Forge 47.4.x
- modid
vitalprobe(bccoreis kept as a command alias) - Dependencies none beyond Forge; everything else is soft-compatible
- Author ByteChen · License MIT
The problem it solves
"Set that mob's health to 20" is entity.setHealth(20) in vanilla. The moment another mod wants to stop you, that path is blocked in a dozen different ways:
| What the other mod does | Why a naive health write fails |
|---|---|
Overrides getHealth() to read its own field |
the field can be named anything, or live in another class |
| Stores health negated / modulo a cap / accumulated | value inversion and many-to-one mappings can't be statically inverted |
Keeps health in a HashMap / SynchedEntityData / custom hash table |
the value isn't a field at all |
| Encrypts health into a string, with a MAC | one character change invalidates it, and getHealth() then pretends to be full |
| Keeps health in native memory (a DLL), with three decoy read paths | there is no number on the Java heap to write |
Delegates health to a function object (operate(...) dispatch) |
it's neither a field nor a container |
| Defines the runtime class as a hidden class and filters members out of reflection | no bytecode, no visible methods |
| Force-heals or damage-caps every tick | your write gets pushed back immediately |
VitalProbe exists for exactly these cases. It never guesses member names and never hardcodes a target mod's classes or fields — it works by runtime disassembly plus measured read-back verification.
The strategy chain
Every write tries these in order. Each step is judged by reading getHealth() back afterwards; on failure it falls through to the next:
- ANALYZED — symbolic inversion: abstract-interpret the
getHealth()expression into an equation inTand solve for the value to write. - MAP_SWEEP — no inversion: walk the classes referenced by that expression, find the
Mapholding this entity, match the value and rewrite it. - ENCODED_PROBE — differential probing: when health is a string, write character by character and read back, measuring the encoding instead of decoding it.
- SET_HEALTH — vanilla
setHealth, after first checking whether its semantics really are "set" (an additive/heal-only override is skipped). - RECODE — rebuild a legal value by the container's own rules (take an existing valid value as a template, replace only the field that encodes health; the checksum is computed by the mod's own function).
- MUTATOR — borrow the mod's own writer primitive (auto-detects delta vs absolute semantics, measured per candidate).
- PROVIDER — borrow the mod's "health provider": confirm it is the health source by calling it with zero arguments, mine the command token out of its own bytecode (e.g.
internal), then write through its own hand. - FIELD_SCAN — generic field scan, including inverted forms such as
maxHealth - health. - MAX_HEALTH — when health is pinned to the cap, lower the max health instead.
Push-backs are handled separately: pulled back to the original value → limited rewrites; pulled back to a third value (the signature of a per-tick invariant) → a sustained-pressure window that walks the reading to the target at the other side's own rate, and counts as success once it holds stable for several ticks.
Strength (config)
general.strength, defaulting to UNSAFE (maximum):
| Level | Mechanism | Notes |
|---|---|---|
REFLECTION |
reflective assignment | most conservative; cannot write final |
VARHANDLE |
VarHandle |
can write private fields |
UNSAFE |
sun.misc.Unsafe memory offsets |
penetrates final, i.e. rewrites constants |
If a write fails, allowEscalation promotes the level automatically.
Void Sword (optional integration)
Hold hall:void_sword from RottenRuins:The Hall and right-click to set every living entity within 100 blocks to getHealth() - 20:
- sneak + scroll wheel adjusts the amount (step 10, absolute cap 1000);
- at zero health a finishing blow is applied so loot, death events and boss bars behave normally;
- item id list, radius, delta, whether players/yourself are affected, and cooldown are all configurable;
- no dependency on that mod: not a single line has to change on the item side, and it works fine without it.
Commands
All require OP level 2. /bccore is an equivalent alias of /vitalprobe.
| Command | Purpose |
|---|---|
/vitalprobe probe [target] |
full-chain diagnosis: bytecode readable? what was reversed? which candidate tables exist? current value, and a real write's read-back result |
/vitalprobe inspect [target] |
print the reversed getHealth() and every candidate write plan |
/vitalprobe set <targets> <health> |
write directly (no clamp to 0; negatives allowed) |
/vitalprobe add <targets> <delta> |
adjust relative to the current effective health |
/vitalprobe strength <level> |
switch strength at runtime (the config file still wins after restart) |
/vitalprobe delta [value] |
view/set the scroll-wheel amount |
/vitalprobe diagnose [detail] |
read-only: nearby mob classes and the strategy they're expected to take |
API for mod authors
// Soft dependency: call reflectively and degrade gracefully when VitalProbe is absent
org.bytechen.bccore.api.BCHealth.get(LivingEntity); // read effective health
org.bytechen.bccore.api.BCHealth.set(LivingEntity, float); // exact write (no 0 clamp)
org.bytechen.bccore.api.BCHealth.add(LivingEntity, float); // add/subtract
org.bytechen.bccore.api.BCHealth.triggerVoidSword(Player, ItemStack); // one area-wide pass
Resolve it behind ModList.get().isLoaded("vitalprobe") and wrap the whole chain in try/catch.
Known limits (stated honestly)
- Compile-time inlined constants cannot be changed: if the number inside
getHealth()was inlined at compile time, there is no writable location at runtime. - Borrowed primitives are as strong as the target allows: if the mod's own writer has i-frames or a per-hit cap, the result is reported as a partial success (never a fake "success"), and you either hit it repeatedly or let RECODE place the value in one shot.
- In the extreme combination of reflection filtered out and instance method handles unavailable, some targets genuinely have no reachable write location; the log then prints exactly which step failed (holders, reflection-vs-bytecode member comparison, candidate primitives) so it can be diagnosed.
- VitalProbe only touches effective health (the return value of
getHealth()). It does not alter armor, resistances or attribute caps unless the MAX_HEALTH step is reached.
Compatibility & performance
- Purely runtime, on-demand disassembly: no load-time transformer, so it doesn't fight other CoreMods over classes.
- Reversal results are cached per class; work happens only on right-click / command / detected reverts, with no idle tick cost.
- Install on both client and server; the write logic runs server-side.
Installation
Drop it into mods/. Config: config/vitalprobe-common.toml.
License MIT. Use it, change it, redistribute it. If something breaks, attach the lines containing [VitalProbe] from logs/latest.log.