Skip to content

Scan Reports

Jump to bottom
ifBars edited this page Jan 4, 2026 · 2 revisions

Understanding Scan Reports

When MLVScan detects suspicious patterns in a mod, it generates detailed reports to help you understand the threat and make informed decisions.

Where Reports Are Stored

Reports are saved in:

YourGame/UserData/MLVScan/Reports/
├── ModName_20231215_123456.report.txt      # Main report
├── Prompts/
│   └── ModName.prompt.md                   # LLM analysis prompt
└── IL/
    └── ModName_20231215_123456.il.txt      # Full IL dump (optional)

Report Structure

Console Output

When a suspicious mod is detected, you'll see:

[MLVScan] ======= DETAILED SCAN REPORT =======
[MLVScan] SUSPICIOUS MOD: SuspiciousMod.dll
[MLVScan] SHA256 Hash: abc123def456...
[MLVScan] -------------------------------
[MLVScan] Total suspicious patterns found: 8
[MLVScan] Severity breakdown:
[MLVScan]   CRITICAL: 2 issue(s)
[MLVScan]   HIGH: 3 issue(s)
[MLVScan]   MEDIUM: 3 issue(s)
[MLVScan] -------------------------------
[MLVScan] Suspicious patterns found:
[MLVScan] [CRITICAL] Process execution detected (2 instances)
[MLVScan]   * At: SuspiciousClass::MaliciousMethod
[MLVScan]     Code Snippet (IL):
[MLVScan]       IL_0001: ldstr "cmd.exe"
[MLVScan]       IL_0006: call System.Diagnostics.Process::Start

Report File Contents

The generated .report.txt file contains:

  1. Header Information

    • Timestamp
    • Mod filename
    • SHA256 hash
    • File paths
    • Total findings count

  2. Severity Breakdown

    • Count of Critical findings
    • Count of High findings
    • Count of Medium findings
    • Count of Low findings

  3. Detailed Findings

    • Grouped by pattern type
    • Severity level for each pattern
    • Number of instances
    • Specific locations in code
    • IL code snippets

  4. Security Notice

    • Guidance on next steps
    • Community resources
    • Malware removal tools

Severity Levels Explained

Critical (Red Flag 🚨)

What it means: Highly dangerous activities that are rarely legitimate in mods.

Examples:

  • Executing Windows shell commands
  • Loading assemblies from encrypted streams
  • Sending data to external servers
  • Creating auto-run mechanisms

Action: DO NOT WHITELIST without extensive community verification.

High (Serious Concern ⚠️)

What it means: Dangerous behaviors that might be legitimate in some contexts.

Examples:

  • Starting external processes
  • Using reflection to invoke hidden methods
  • Modifying Windows registry
  • Numeric-encoded strings

Action: Investigate thoroughly before whitelisting.

Medium (Suspicious 👀)

What it means: Patterns that could be benign or malicious depending on context.

Examples:

  • Base64 encoding/decoding
  • Hex string manipulation
  • Byte array operations
  • P/Invoke to native DLLs

Action: Review the specific usage. Often false positives for legitimate features.

Low (Minor Flag 📝)

What it means: Minor patterns with low risk.

Examples:

  • Accessing environment variables
  • Reading system paths

Action: Usually safe to whitelist if from trusted source.

Reading IL Code Snippets

Reports include IL (Intermediate Language) code snippets. Here's how to read them:

Example IL Snippet

IL_0000: ldstr "cmd.exe"              # Load string "cmd.exe"
IL_0005: ldstr "/c del /f *.*"        # Load string "/c del /f *.*"
IL_000a: call Process::Start          # Call Process.Start method

Common IL Instructions

  • ldstr - Load string
  • call - Call method
  • callvirt - Call virtual method
  • newobj - Create new object
  • stloc - Store to local variable
  • ldloc - Load from local variable
  • ldc.i4 - Load integer constant

What to Look For

Red Flags:

  • Suspicious strings (URLs, commands, passwords)
  • Unusual method calls (Process.Start, Registry.SetValue)
  • Obfuscated patterns (numeric-encoded strings)

Legitimate Use:

  • Game API calls
  • Standard .NET operations
  • UI operations

Common False Positives

Unity Explorer / Debugging Tools

Why flagged: Uses extensive reflection and dynamic invocation

Pattern: High severity - Reflection, DllImport, Process operations

Safe to whitelist?: Yes, if from official source

Hash: Check MLVScan's default whitelist

Custom Asset Loaders

Why flagged: Loads data from streams, uses Base64

Pattern: Medium severity - Base64, LoadFromStream, byte arrays

Safe to whitelist?: Yes, if from trusted mod author

Verification: Review what assets are being loaded

Network-Enabled Mods

Why flagged: Makes HTTP requests, sends data

Pattern: Critical severity - DataExfiltration, network calls

Safe to whitelist?: Maybe - investigate what data is sent where

Verification: Ask mod author about network usage

Interpreting Findings

Multiple Instances vs Single Instance

Single instance: Might be false positive

[HIGH] Reflection usage detected (1 instance)

Multiple instances: More concerning

[HIGH] Reflection usage detected (12 instances)

Multiple instances suggest the mod heavily relies on suspicious patterns.

Pattern Combinations

High Risk Combination:

[CRITICAL] Shell execution (1 instance)
[HIGH] Obfuscated strings (5 instances)
[MEDIUM] Base64 decoding (3 instances)

This suggests encoded commands being executed.

Lower Risk Combination:

[MEDIUM] Base64 decoding (2 instances)
[LOW] Environment path access (1 instance)

Might be loading configuration or assets.

Using the LLM Analysis Prompt

MLVScan generates a prompt file you can use with ChatGPT or other LLMs:

Location

UserData/MLVScan/Reports/Prompts/ModName.prompt.md

How to Use

  1. Open the .prompt.md file
  2. Copy the entire contents
  3. Paste into ChatGPT/Claude/Gemini
  4. Ask: "Is this malware or a false positive?"

What the Prompt Contains

  • Complete IL dump of the assembly
  • List of suspicious findings
  • Context about detection rules
  • Questions to help analyze intent

⚠️ Important

  • LLMs are NOT perfect at detecting malware
  • Use as a supplementary tool
  • Always verify with the community
  • Don't trust AI blindly

Full IL Dumps (Advanced)

Enable in MelonPreferences.cfg:

[MLVScan]
DumpFullIlReports = true

What It Does

Generates complete IL disassembly of flagged mods:

UserData/MLVScan/Reports/IL/ModName_timestamp.il.txt

When to Use

  • Deep analysis of suspicious code
  • Sharing with security researchers
  • Understanding complex malware
  • Contributing to improved detection rules

Reading Full IL Dumps

Full IL dumps show the entire assembly structure:

.assembly ModName
{
  .ver 1:0:0:0
}

.class public SuspiciousClass
{
  .method public static void MaliciousMethod()
  {
    IL_0000: ldstr "http://malicious.com"
    IL_0005: call WebClient::DownloadString
    ...
  }
}

Decision Tree

Use this flowchart to decide what to do:

Mod flagged by MLVScan
    │
    ├─► Critical severity?
    │   ├─► Yes → DO NOT WHITELIST
    │   │           Ask community first
    │   └─► No → Continue
    │
    ├─► From trusted source?
    │   ├─► No → DO NOT WHITELIST
    │   └─► Yes → Continue
    │
    ├─► Multiple users confirm safe?
    │   ├─► No → Wait for verification
    │   └─► Yes → Continue
    │
    ├─► Patterns make sense for mod purpose?
    │   ├─► No → DO NOT WHITELIST
    │   └─► Yes → Continue
    │
    └─► Safe to whitelist
        Add SHA256 hash to whitelist

Getting Help with Reports

Community Resources

  1. Modding Discord: discord.gg/UD4K4chKak

    • Post in #mod-releases MLVScan thread
    • Share SHA256 hash (not the file!)
    • Ask if others have verified it

  2. GitHub Issues: For confirmed false positives

    • Include hash
    • Include report file
    • Explain mod's legitimate purpose

  3. Mod Author: Contact directly

    • Ask about flagged patterns
    • Request explanation
    • Verify it's the official version

Best Practices

✅ Do:

  • Read the entire report carefully
  • Check severity levels
  • Ask the community
  • Verify the mod source
  • Keep reports for reference

❌ Don't:

  • Ignore Critical findings
  • Whitelist without understanding
  • Share mod files publicly
  • Trust unknown sources
  • Disable MLVScan entirely

Example Real-World Reports

Example 1: Legitimate Debug Tool

[HIGH] Reflection usage detected (15 instances)
[HIGH] DllImport usage detected (8 instances)
[MEDIUM] Base64 rule triggered (3 instances)

Verdict: UnityExplorer - debugging tool
Action: Safe to whitelist (in default whitelist)

Example 2: Malware

[CRITICAL] Shell execution detected (1 instance)
[CRITICAL] Data exfiltration detected (2 instances)
[HIGH] Obfuscated strings detected (12 instances)

Verdict: Malicious mod
Action: DELETE AND SCAN SYSTEM

Example 3: False Positive

[MEDIUM] Base64 rule triggered (2 instances)
[LOW] Environment path access (1 instance)

Verdict: Custom asset loader
Action: Review code, likely safe if from trusted source

Developer CLI Reports

When using MLVScan.DevCLI for development scanning, the output format differs from the runtime plugin:

Console Output Format

MLVScan Developer Report
========================
Assembly: MyMod.dll
Findings: 2

[High] Detected executable write near persistence-prone directory
  Rule: PersistenceRule
  Occurrences: 1

  Developer Guidance:
  For mod settings, use MelonPreferences. For save data, use the game's
  save system or Application.persistentDataPath with .json extension.
  📚 https://melonwiki.xyz/#/modders/preferences
  Suggested APIs: MelonPreferences.CreateEntry<T>

  Locations:
    • MyMod.SaveManager.SaveSettings:42

────────────────────────────────────────

Key Differences

  • Developer Guidance: Each finding includes specific remediation advice
  • Documentation Links: Direct links to relevant MelonLoader documentation
  • Alternative APIs: Suggests safe alternatives to suspicious patterns
  • IsRemediable: Indicates whether a safe alternative exists

JSON Output

For CI/CD integration, use the --json flag:

{
  "assemblyName": "MyMod.dll",
  "totalFindings": 2,
  "findings": [
    {
      "ruleId": "PersistenceRule",
      "description": "Detected executable write near persistence-prone directory",
      "severity": "High",
      "location": "MyMod.SaveManager.SaveSettings:42",
      "guidance": {
        "remediation": "For mod settings, use MelonPreferences...",
        "documentationUrl": "https://melonwiki.xyz/#/modders/preferences",
        "alternativeApis": ["MelonPreferences.CreateEntry<T>"],
        "isRemediable": true
      }
    }
  ]
}

For more information on the Developer CLI, see Developer CLI Guide.

Related Pages

Clone this wiki locally