Sonar Bypass
A packet-level bypass for Sonar's Minecraft bot verification. Node.js on the raw socket — no client mod, no patched library, no filtering proxy in the middle.
What it is
Sonar sits in front of a Minecraft server and runs a short verification sequence before it lets you into the lobby. It is not a captcha and there is no config flag to turn it off: it watches how your client behaves on the wire.
This project reproduces that behaviour from a plain Node.js process. The script logs in, answers the config phase, replays the movement the server expects during the gravity and vehicle stages, and echoes the two packet checks. When it works, the server sees a vanilla client.
The five stages
| Stage | What Sonar does | What the script does |
|---|---|---|
| login | Normal handshake, then a config phase instead of the world. | Answers client_information and brand immediately, then finish_configuration. |
| gravity | Two teleports set an arena, then it watches a fall onto a platform block. | Records both teleports, computes the spawn, sends unique priming frames, lands on the right block height. |
| protocol | Sends packet IDs that the standard library does not decode. | Reads the raw socket and replies by hand instead of trusting the library. |
| vehicle | Boat and minecart states, advanced by keepalives. | Switches to vehicle movement packets and mirrors the expected motion. |
| finish | Confirms spawn and releases the player. | Proves spawn with a chat message and hands the connection over. |
What makes it hard
- Undecoded packet IDs. The library silently drops parts of the protocol stage, so the bypass reads the socket directly. A library-only client fails there without an error.
- Frame deduplication. Sonar ignores byte-identical position frames. The three priming packets have to differ by a small amount or the gravity check never completes.
- Ordering. The teleport confirm has to describe where you were when the teleport was issued. Send it after you move and the server's motion baseline is wrong for the rest of the sequence.
Run it
USERNAME=your_account PASS=your_password node verify-pass.js
A clean IP per attempt — the servers rate-limit per address. All the byte-level
detail, including the packet logger setup, is in
research.md and main.md in the repo.
Tested on
- Sonar 2.1.52 and 2.1.53
- Two public Indian servers (cubixmc, poormc) and two private Sonar instances
- Protocol 26.1 and 1.21.x, with a Fabric packet logger on the side
Notes
The interesting part is not the bypass itself — it is how much a server can infer from packet order and timing alone, without ever asking the client a question.
Related projects
If this research interests you, also look at Sonar Bypass v2 — the cleaner second iteration — or the Minecraft AFK Bot. Everything lives on github.com/SirYadav1, or browse all projects by SirYadav.
More from SirYadav1
Sonar Bypass is one of many open-source projects by Sundram Yadav. If you found it useful, star it on GitHub — github.com/SirYadav1/sonar-bypass — and check the rest of the profile at github.com/SirYadav1 for network scanners, Minecraft research, bots and developer tooling. New projects ship regularly; the project index on this site stays up to date with every one of them.
About the author
Sundram Yadav — known online as SirYadav (GitHub: SirYadav1) — is a backend developer and security researcher from India. He builds open-source software in PHP, Node.js, Python and Go: network scanners, Minecraft protocol research, Android apps, Telegram bots and automation tooling. Everything on this page — and much more — lives on his GitHub repositories. Browse the full collection on the project index, or connect on Telegram and X (Twitter).