threadtear VS SpicyClient

If you're very paranoid, Threadtear does have some amount of protection against potential code execution when decompiling, although it hasn't been updated in a while and it's still always a risk (albeit one I never personally encountered). If you suspect that the file you want to decompile does have a way to execute code when decompiling it, you could try using a virtual machine for some added protection.

I used recaf for the plugin.yml, I used deobfuscator to remove the obfuscation, then I used threadtear for decompilation. I use threadtear pretty much always, but it's allatori deobfuscation is somewhat lacking which is why I used a separate program. Also it does not show resources in the jar, which is why I had to use recaf.

learn java then get https://github.com/GraxCode/threadtear read all files be weary if its obfuscated

Ok, I'll tell you how but please keep in mind that StackOverflow is for coding and not making Minecraft hacks. if you want help with hacks the java channel in the zeroday discord is a great place for help. As for reach there are 2 things you need to do. The first is setting the block reach which is how far you can break and place blocks. The second is setting the combat reach which is how far you can hit. To set the block reach you can override this method in the player controller mp class. To do this I just made an event. For the combat reach you need to override this variable in the entity renderer class

Spicy Client

I've reviewed the source code for Spicy client and it has a token logger. See this line in the source code