Repository navigation
cim.ps1 改走标准输入,客体守护进程不压缩嵌入 - #108
Merged
Merged
Conversation
接着降低杀毒软件机器学习规则的误报,去掉 exe 里两处最像恶意程序的特征: - 问题信息、配置信息查 WMI 时,不再用隐藏窗口加 -EncodedCommand(base64 命令行)启动 Windows PowerShell,改为 -Command - 从标准输入读 cim.ps1。两种方式在本机逐项比对,8 个部分和 出错时的输出都一致;report-config 实跑正常。新增单测:cim.ps1 只含 ASCII、LF(标准输入按控制台 代码页读),并真跑一次 cs 部分。 - 按应用走代理的客体守护进程 modavd-proxyd 不再 gzip 后嵌入(1.4 MB 的压缩块像投放器的载荷), 改为原样嵌入 ELF(3.4 MB)。删掉只给它用的 internal/tools/gzipfile;build.ps1 先删旧版本留下的 modavd-proxyd.gz,单测核对嵌入目录里只有 README.md 和 modavd-proxyd。 运行 arm64 执行桥脚本那处的 -ExecutionPolicy Bypass 照留。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
接着降低杀毒软件机器学习规则的误报,去掉 exe 里两处最像恶意程序的特征:
Windows PowerShell,改为 -Command - 从标准输入读 cim.ps1。两种方式在本机逐项比对,8 个部分和
出错时的输出都一致;report-config 实跑正常。新增单测:cim.ps1 只含 ASCII、LF(标准输入按控制台
代码页读),并真跑一次 cs 部分。
改为原样嵌入 ELF(3.4 MB)。删掉只给它用的 internal/tools/gzipfile;build.ps1 先删旧版本留下的
modavd-proxyd.gz,单测核对嵌入目录里只有 README.md 和 modavd-proxyd。
运行 arm64 执行桥脚本那处的 -ExecutionPolicy Bypass 照留。
验证:build.ps1 -Test 全部通过;换目录、换新的编译缓存再编一次,两个 exe 逐字节相同;report-config 在测试根上实跑,系统、CPU、显卡、磁盘类型都读得到;exe 里不再有 EncodedCommand,也没有 gzip 块;隐私扫描 0 失败;Defender 本地扫描没报。按应用走代理没有上机测:守护进程本身的字节没变,只是嵌入时不再压缩。
大小(和 #107 合起来,对比 0.6.0):modavd.exe 从 11.5 MB 变成 17.6 MB,ModAVD.exe 从 12.3 MB 变成 18.5 MB。