Malware scanner for unitypackage files
-
This is very interesting, tried it on a few things myself, there were a couple that flagged, one being "high" the other being critical. How can you tell between a false positive and a real critical? And say there was something that flagged a false positive and you went ahead and cleaned it anyways, would that remove any vital things from the package and possibly break it? Just curious.
@NewbKid Good question tho.
For the scanner, I try to avoid generic statements like "it has a .png extension, therefore it's a PNG." The scanner checks and verifies that things like images are what they claim to be. It also analyzes lines of code looking for potential unwanted behavior, such as file writing or Assembly code.
We're still working on the sanitization feature; it's difficult when you don't have a malicious .unitypackage file, haha. But for some files, the sanitizer deletes them. For scripts, it comments them out. That way, if there's any unusual behavior, instead of deleting everything and breaking the entire project, it simply crosses out that line of code, like crossing out a sentence in a notebook.
The false positives are mostly my interpretation and logic. A script has file writing capabilities, BUT it exists for some reason, whether it's due to an algorithm or menus, so it's added to a whitelist. The best example I can give you is Poiyomi.
Poiyomi uses many scripts that write to files/directories. This is where I check if that script exists in the official project, extract a unique hash (the file signature), and add it to a whitelist. This way, when an avatar's project is scanned and a Poiyomi file is found within it, I verify that the same file exists in the official project. If it does, it's skipped.
BUT, this doesn't mean the scanner says, "Ah, this file exists, I'll skip it." It verifies that the content is the same as in the official project using the file's hash.
Currently, many flags were created by an AI that thoroughly investigated all possible scenarios, such as HTTP injection, file writing, out-of-the-box code, disguised files, etc. However, over time, the criteria for what is considered critical or high, and their corresponding scores, are being updated.
-
New version v0.8.0
I've fixed the false positives that were generating audio files; for example, a project that had 126 warnings now only has 1. We're still working on reducing false positives so that eventually only real warnings will appear lol
https://github.com/vicentefelipechile/vrchat-scanner/releases
Web Version
I've also worked on a web version of this scanner for those who don't want to download a file. The web version includes a scan history, making it easier to share results. It also supports Discord embeds.
https://scanner.vrcstorage.lat/
Again, ty!! @anonberry for all ideas :3
-
Working on the version 0.9.0
Currently, the scan only has the bare minimum to function, but not everyone knows how to use a terminal, so I'm preparing a new version that includes an easy-to-use interface and runs everything locally.
This is my first time making a desktop application (without using a frontend), so you can expect to find some bugs.
Preview
-
Working on the version 0.9.0
Currently, the scan only has the bare minimum to function, but not everyone knows how to use a terminal, so I'm preparing a new version that includes an easy-to-use interface and runs everything locally.
This is my first time making a desktop application (without using a frontend), so you can expect to find some bugs.
Preview
-
@anonberry tyyy!!!
-
Version 0.9.0
I finished to build a desktop version for the scanner, now you can easily scan unitypackages, see their score, file tree and even export the content inside as ZIP or folder.
You can use it by downloading the installer from the releases
https://github.com/vicentefelipechile/vrchat-scanner/releases
Preview
-
-
It comes with their own icon btw
-
heyyyy, ive using this for awhile but im rn checking out stuff ive got from someone on gumroad called irongut, ive used his models before but they are reading critical- i hope its not a mistake,
-
i really wanna use these models that get critical but even after sanitizing them, i get nervous ~w~
-
@GoatonicReal sometomes, those mose who have a lot of red flags may are false positives
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login