Malware scanner for unitypackage files

[PanConChancho]

@ManMachine As @anonberry said, it's more likely to be a false positive, in the latest poiyomi version (v10) they implement more stuff that isn't the version 9 so I have to update

[ManMachine]

perfect, ty. I can use them without worry, then

[NewbKid]

This is very interesting, tried it on a few things myself, there were a couple that flagged, one being "high" the other being critical. How can you tell between a false positive and a real critical? And say there was something that flagged a false positive and you went ahead and cleaned it anyways, would that remove any vital things from the package and possibly break it? Just curious.

[PanConChancho]

@NewbKid Good question tho.

For the scanner, I try to avoid generic statements like "it has a .png extension, therefore it's a PNG." The scanner checks and verifies that things like images are what they claim to be. It also analyzes lines of code looking for potential unwanted behavior, such as file writing or Assembly code.

We're still working on the sanitization feature; it's difficult when you don't have a malicious .unitypackage file, haha. But for some files, the sanitizer deletes them. For scripts, it comments them out. That way, if there's any unusual behavior, instead of deleting everything and breaking the entire project, it simply crosses out that line of code, like crossing out a sentence in a notebook.

The false positives are mostly my interpretation and logic. A script has file writing capabilities, BUT it exists for some reason, whether it's due to an algorithm or menus, so it's added to a whitelist. The best example I can give you is Poiyomi.

Poiyomi uses many scripts that write to files/directories. This is where I check if that script exists in the official project, extract a unique hash (the file signature), and add it to a whitelist. This way, when an avatar's project is scanned and a Poiyomi file is found within it, I verify that the same file exists in the official project. If it does, it's skipped.

BUT, this doesn't mean the scanner says, "Ah, this file exists, I'll skip it." It verifies that the content is the same as in the official project using the file's hash.

Currently, many flags were created by an AI that thoroughly investigated all possible scenarios, such as HTTP injection, file writing, out-of-the-box code, disguised files, etc. However, over time, the criteria for what is considered critical or high, and their corresponding scores, are being updated.

[PanConChancho]

New version v0.8.0

I've fixed the false positives that were generating audio files; for example, a project that had 126 warnings now only has 1. We're still working on reducing false positives so that eventually only real warnings will appear lol

https://github.com/vicentefelipechile/vrchat-scanner/releases

---

Web Version

I've also worked on a web version of this scanner for those who don't want to download a file. The web version includes a scan history, making it easier to share results. It also supports Discord embeds.

https://scanner.vrcstorage.lat/

Again, ty!! @anonberry for all ideas :3

[anonberry]

0.8.0 already?? i've missed a lot

[PanConChancho]

Working on the version 0.9.0

Currently, the scan only has the bare minimum to function, but not everyone knows how to use a terminal, so I'm preparing a new version that includes an easy-to-use interface and runs everything locally.

This is my first time making a desktop application (without using a frontend), so you can expect to find some bugs.

---

Preview

[anonberry]

@SummerTYT beautiful

[PanConChancho]

@anonberry tyyy!!!

[PanConChancho]

Version 0.9.0

I finished to build a desktop version for the scanner, now you can easily scan unitypackages, see their score, file tree and even export the content inside as ZIP or folder.

You can use it by downloading the installer from the releases
https://github.com/vicentefelipechile/vrchat-scanner/releases

---

Preview

[PanConChancho]

It comes with their own icon btw

[Rat-z]

@SummerTYT This is amazing seriously, thanks for helping keep us safe!

[PanConChancho]

@Rat-z tysm!!

[anonberry]

Bumping this thread to give this guy some love

[Nicenick]

Bump for love

[Msiprism]

Love the work

[Remu335]

bump because good job

[Reym]

this tools is ABSOLUTE CINEMA
great job!!

[GoatonicReal]

heyyyy, ive using this for awhile but im rn checking out stuff ive got from someone on gumroad called irongut, ive used his models before but they are reading critical- i hope its not a mistake,

[GoatonicReal]