search

dartraiden / NVIDIA-patcher

Adds 3D acceleration support for P106-090 / P106-100 / P104-100 / P104-101 / P102-100 / CMP 30HX / CMP 40HX / CMP 50HX mining cards.
194 stars 25 forks source link

Is it safe to ignore the Trojan.Heur!.00252033 report? #24

Closed link89 closed 10 months ago

link89 commented 10 months ago

The report show that the following file contain trojan? Is it safe to use this patch?

https://www.virustotal.com/gui/file/9b10b58a01761837911d11ee5370d4b6cad693096cf19b42d2638a940b0d274d?nocache=1

dartraiden commented 10 months ago

You can take the original nvlddmkm.sys and compare it byte by byte with the patched one. As you will see only some bytes were replaced by FF Such a replacement cannot contain malicious code

set "NewPatternP=\x07\x1B\x07\x00\x87\x1B\x07\x00\xC7\x1B\x07\x00\x07\x1C\x07\x00\x09\x1C\x07"
set "NewPatchP=\xFF\xFF\x07\x00\xFF\xFF\x07\x00\xFF\xFF\x07\x00\xFF\xFF\x07\x00\xFF\xFF\x07"
set "PatternCmp=\x09\x1E\x07\x00\x49\x1E\x07\x00\xBC\x1E\x07\x00\xFC\x1E\x07\x00\x0B\x1F\x07\x00\x81\x20\x07\x00\x82\x20\x07\x00\x83\x20\x07\x00\xC2\x20\x07\x00\x89\x21\x07\x00\x0D\x22\x07\x00\x4D\x22\x07\x00\x8A\x24\x07"
set "PatchCmp=\xFF\xFF\x07\x00\xFF\xFF\x07\x00\xFF\xFF\x07\x00\xFF\xFF\x07\x00\xFF\xFF\x07\x00\xFF\xFF\x07\x00\xFF\xFF\x07\x00\xFF\xFF\x07\x00\xFF\xFF\x07\x00\xFF\xFF\x07\x00\xFF\xFF\x07\x00\xFF\xFF\x07\x00\xFF\xFF\x07"