Steam 社群 :: 討論區

Left 4 Dead 2

Your own custom apocalypse

Discover and download new maps, Add-ons, Mutations and more! Want to try your hand at modding or want to upload your mod to Steam?
深入了解

首頁

討論區

關於

工作坊> Left 4 Dead 2> 所有討論

Beros

5 月 29 日上午 3:35

Sus mod

I subscribed to this nondescript mod earlier, and i still don't know what it is. For that reason, i kept it disabled while i was playing, but afterward, opened it in GCFScape to see what was in there, and it returned an error message with the following details:

See the end of this message for details on invoking just-in-time (JIT) debugging instead of this dialog box. ************** Exception Text ************** System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt. at HLLib.CDirectoryFile.GetExtractable(CDirectoryFile* ) at GCFScape.CPackageTreeNode..ctor(CPackage* pPackage, CDirectoryItem* pDirectoryItem, CDirectoryItemInfoManager pDirectoryItemInfoManager, CPackageInfo pPackageInfo, Boolean bBuild) at GCFScape.CPackageTreeNode.BuildNode() at GCFScape.CGCFScape.trePackage_AfterExpand(Object sender, TreeViewEventArgs e) at System.Windows.Forms.TreeView.TvnExpanded(NMTREEVIEW* nmtv) at System.Windows.Forms.TreeView.WmNotify(Message& m) at System.Windows.Forms.TreeView.WndProc(Message& m) at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m) at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam) ************** Loaded Assemblies ************** mscorlib Assembly Version: 2.0.0.0 Win32 Version: 2.0.50727.8806 (QFE.050727-8800) CodeBase: file:/C:/Windows/Microsoft.NET/Framework64/v2.0.50727/mscorlib.dll ---------------------------------------- GCFScape Assembly Version: 1.8.5.0 Win32 Version: 1.8.5 CodeBase: file:///F:/Program%20Files/Nem's%20Tools/GCFScape/GCFScape.exe ---------------------------------------- msvcm90 Assembly Version: 9.0.30729.6161 Win32 Version: 9.00.30729.6161 CodeBase: file:///C:/Windows/WinSxS/amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251/msvcm90.dll ---------------------------------------- System.Windows.Forms Assembly Version: 2.0.0.0 Win32 Version: 2.0.50727.5491 (Win7SP1GDR.050727-5400) CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Windows.Forms/2.0.0.0__b77a5c561934e089/System.Windows.Forms.dll ---------------------------------------- System Assembly Version: 2.0.0.0 Win32 Version: 2.0.50727.8806 (QFE.050727-8800) CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System/2.0.0.0__b77a5c561934e089/System.dll ---------------------------------------- System.Drawing Assembly Version: 2.0.0.0 Win32 Version: 2.0.50727.5495 (Win7SP1GDR.050727-5400) CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Drawing/2.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll ---------------------------------------- System.Xml Assembly Version: 2.0.0.0 Win32 Version: 2.0.50727.8773 (QFE.050727-8700) CodeBase: file:/C:/Windows/assembly/GAC_MSIL/System.Xml/2.0.0.0__b77a5c561934e089/System.Xml.dll ---------------------------------------- ************** JIT Debugging ************** To enable just-in-time (JIT) debugging, the .config file for this application or computer (machine.config) must have the jitDebugging value set in the system.windows.forms section. The application must also be compiled with debugging enabled. For example: <configuration> <system.windows.forms jitDebugging="true" /> </configuration> When JIT debugging is enabled, any unhandled exception will be sent to the JIT debugger registered on the computer rather than be handled by this dialog box.

After this, I saw that it lacked a root folder, and contained the following folders: maps, materials, models, particles, resource, and scripts, but they were empty. I uploaded the VPK to Nord and Kaspersky for scanning, and it didn't appear to be malware, however the error message has me thinking about the possibility of fileless malware, but i have no expertise in that area. The Kaspersky scan actually lists more file contents, showing things like gestures_biker, models\deadbodies, building_brick_destroyed01, gasstationpart_4, models\props_docks, pipeset32d_corner128d_001a, generator, paper towels, cleat_small_01. There are about 100 things like this in the list. And yet the file is under a half megabyte. How can this be a real mod? Maybe it's a collection of low-poly assets? But why does the vpk not function like normal?
https://steamhost.cn/steamcommunity_com/sharedfiles/filedetails/?id=3489115850
ETA: Sorry, i posted the above after staying up late, but if it needs to be said, proceed with caution. The fact that it needs L4D2 to be ran to even acquire the file seems like a risk to me, but i'm speaking from near-ignorance on the matter.

最後修改者：Beros; 5 月 29 日下午 12:16

< >

目前顯示第 1-2 則留言，共 2 則

348

5 月 29 日上午 6:13

tried extracting it with python vpk and it seemed to extract properly
although i do admit, this really is amogussy tier sus

how the hell did it manage to extract what seems to be 553M worth of content from a 417K vpk?

i also tried to make a 7z archive out of it and lo and behold, it managed to all fit into a 535K 7z archive

did i just stumble upon a weird archive bomb perhaps? a majority of the files seems to be fake

what was the point of this vpk?

最後修改者：Jo; 5 月 29 日上午 6:22

kurochama

151

5 月 29 日上午 6:15

It's a corrupted vpk file & broken mod. My GCFScape also didn't work. The size itself that's less than 500 kb is already suspicious, like, if it's a skin mod, it should have few mb of file size. If it's a script mod, there's no explanation at all on the mod description.

So, probably it's better if you avoid mods with less to no description & image preview, especially if the file size is also suspicious enough.

最後修改者：kurochama; 5 月 29 日上午 6:15

< >

目前顯示第 1-2 則留言，共 2 則

每頁顯示： 1530 50

張貼日期： 5 月 29 日上午 3:35

回覆： 2

開始新的討論串