saw in #409 that the standalone exe (not the setup file) is the one getting false flagged and that it's unclear why. i diffed 1.5.2 against 1.6.1+ to see what actually changed inside the binary, and the delta turned out to be small. not claiming this is the answer, but one thing stands out
first, the stuff that did not change, so probably not worth chasing: the release profile is identical (codegen-units = 1, lto = true, opt-level = "z", strip = true), dll-syringe and the whole PROCESS_ALL_ACCESS + EnumProcessModulesEx vorbis wait loop were already in 1.5.2, actix-web was already a dependency, and the deeplink registration already existed. so the injection code itself isn't new, which probably explains why looking at it hasn't led anywhere
what is new is ipc.rs, that file didn't exist in 1.5.2 at all. since 77f556c the launcher binds a listening tcp socket at startup:
let listener = match TcpListener::bind(format!("127.0.0.1:{}", IPC_PORT)) {src-tauri/src/ipc.rs#L45-L53, called from src-tauri/src/main.rs#L217 inside setup_tauri_app, so it runs on every launch even if you never join a server
that's what i'd look at first. a gui app that opens a listening socket at startup, parses text commands off it, creates windows in response (src-tauri/src/ipc.rs#L107-L113) and separately does CreateRemoteThread injection into another process is roughly the shape behavioral engines are trained to score as a backdoor. 1.5.2 had the injection but no listener, so it's the combination that's new, not either half. that would also fit the fact that the setup file and the standalone exe get flagged for different reasons
smaller second thing, the game exe target became configurable in src-tauri/src/injector.rs#L39-L51 where 1.5.2 had gta_sa.exe hardcoded. an injector whose target comes from config reads worse than one pinned to a known game, though i'd expect this to matter a lot less than the socket
if it's worth testing, cheapest experiment is one build with the listen_for_ipc call commented out and nothing else touched, then put both through virustotal. that isolates it in a single build instead of guessing. IPC_PORT is 45791, in src-tauri/src/constants.rs#L1
to be upfront, i haven't reproduced the detection myself, no windows machine here, so this is from reading the diff rather than testing. could easily be wrong, but the listener seemed worth flagging since it's the only genuinely new capability the exe gained in that range
saw in #409 that the standalone exe (not the setup file) is the one getting false flagged and that it's unclear why. i diffed 1.5.2 against 1.6.1+ to see what actually changed inside the binary, and the delta turned out to be small. not claiming this is the answer, but one thing stands out
first, the stuff that did not change, so probably not worth chasing: the release profile is identical (
codegen-units = 1,lto = true,opt-level = "z",strip = true),dll-syringeand the wholePROCESS_ALL_ACCESS+EnumProcessModulesExvorbis wait loop were already in 1.5.2,actix-webwas already a dependency, and the deeplink registration already existed. so the injection code itself isn't new, which probably explains why looking at it hasn't led anywherewhat is new is
ipc.rs, that file didn't exist in 1.5.2 at all. since 77f556c the launcher binds a listening tcp socket at startup:src-tauri/src/ipc.rs#L45-L53, called from src-tauri/src/main.rs#L217 inside
setup_tauri_app, so it runs on every launch even if you never join a serverthat's what i'd look at first. a gui app that opens a listening socket at startup, parses text commands off it, creates windows in response (src-tauri/src/ipc.rs#L107-L113) and separately does
CreateRemoteThreadinjection into another process is roughly the shape behavioral engines are trained to score as a backdoor. 1.5.2 had the injection but no listener, so it's the combination that's new, not either half. that would also fit the fact that the setup file and the standalone exe get flagged for different reasonssmaller second thing, the game exe target became configurable in src-tauri/src/injector.rs#L39-L51 where 1.5.2 had
gta_sa.exehardcoded. an injector whose target comes from config reads worse than one pinned to a known game, though i'd expect this to matter a lot less than the socketif it's worth testing, cheapest experiment is one build with the
listen_for_ipccall commented out and nothing else touched, then put both through virustotal. that isolates it in a single build instead of guessing.IPC_PORTis 45791, in src-tauri/src/constants.rs#L1to be upfront, i haven't reproduced the detection myself, no windows machine here, so this is from reading the diff rather than testing. could easily be wrong, but the listener seemed worth flagging since it's the only genuinely new capability the exe gained in that range