Warning: Suspicious Code Found in ExileApi-Compiled Released by instantsc

[abevol]

Since his repository has disabled Issues, I have to post it here.

Repository: https://github.com/exApiTools/ExileApi-Compiled Problem Versions: 3.25.1.0 3.25.1.1 Safe Versions: 3.25.0.5 3.25.0.3.2 3.25

Symptoms: High CPU usage, even when idle and without any plugins, it maintains a relatively high CPU usage (around 20%), where as in safe versions, it was usually 0%.

Suspicious code: New code blocks of BackgroundTask and StatCollector have been added, which did not exist in previous versions, and this code has been obfuscated.

[instantsc]

High CPU usage, even when idle and without any plugins

Indeed. This should be fixed with the latest release, thank you for the report.

[abevol]

In the latest version 3.25.1.2, this obfuscated suspicious code still exists. Until instantsc provides a clear explanation, it is recommended that everyone use the previous secure versions.

[instantsc]

obfuscated suspicious code

Why are you blaming me for your inability to reverse engineer compiled code? If the whole thing was c++ or something, would you be mad as well?

If you must know what it does, it sends some game data that otherwise is very painful to collect to a central server. It is not related to your ingame actions and sends no personal data whatsoever. If you (as in, anyone reading this) would like to opt out, you can figure out your OS's permission system or contact me for instructions on using a built in opt out mechanism. Though, given the issue author's tendency to throw accusations around, they're on their own.

[alekswoje]

Interesting how the author has overwolf on their computer which is actual malware.

[flosso]

Why are you blaming me for your inability to reverse engineer compiled code? If the whole thing was c++ or something, would you be mad as well?

If you must know what it does, it sends some game data that otherwise is very painful to collect to a central server. It is not related to your ingame actions and sends no personal data whatsoever. If you (as in, anyone reading this) would like to opt out, you can figure out your OS's permission system or contact me for instructions on using a built in opt out mechanism. Though, given the issue author's tendency to throw accusations around, they're on their own.

He's not making baseless accusations. Both the high CPU usage and the sudden appearance of suspicious code are objective problems, and the thread call stack points to this suspicious code as the cause of the high CPU usage. Moreover, this suspicious code was obfuscated and encrypted by you. With so many coincidences, any reasonable person would be cautious after seeing this. He just happened to be the first one to discover and report it, and when you gave no explanation, he reminded everyone to stay alert. He didn’t make any inappropriate remarks. Instead, you’ve been shirking responsibility all along. In your first response, you avoided explaining this suspicious code, and then you started slandering him, even blaming him for your refusal to provide a switch to disable data collection, and trying to make everyone blame him for this. Please get it straight, only you have the ability and the responsibility to provide this switch, and no one can change your mind, it’s clearly you who doesn’t want to offer it! If you publicly release your software on GitHub, you should at least comply with basic privacy protection laws. Of course, if you're Russian, then forget I said anything. ¯_(ツ)_/¯

[instantsc]

I'm going to indulge this one last time even though I know I shouldn't.

suspicious code

Suspicious by whose standards? It's perfectly clear to me what it does, there is nothing malicious about it and anything beyond that is in your imagination, i.e. a you problem.

code was obfuscated

Um, no? Again, your inability to read compiled code is not my problem. This is not open source software, if you want an open source alternative you can code your own or something.

and encrypted

Lmao. Now this is getting into "I know these words are vaguely related so I'm gonna throw everything at the wall and hope something sticks" territory.

he reminded everyone

Please use your personal blog or something for "reminding" people to do things. This is not it.

refusal to provide a switch to disable data collection

But I have. Precisely 0 people have contacted me about it though.

you should at least comply with basic privacy protection laws

But I am. Like I said, no personal data is processed or collected.

publicly release your software on GitHub

Going to repeat myself here, this is not open source software. I'm not sure I will continue to provide it though given the repeated attacks here. Honestly, I've always been a supporter of people trying to get things out of OSS maintainers even through annoying them, but I get how the other side feels now.