MLVScan

Security-focused MelonLoader plugin that protects your system from malicious mods

Try the Web Scanner

What is MLVScan?

MLVScan scans mods before they execute, detecting malicious patterns commonly found in malware. Created in response to the rise of malware mods, it provides automated protection for your PC.

Key Features

• []Pre-Execution Scanning: Catches threats before they can run[/]

  []17+ Detection Rules: Identifies process execution, shell commands, data exfiltration, and more[/]

  []SHA256 Hash Whitelisting: Cryptographically secure mod verification (tamper-proof)[/]

  []Automatic Protection: Suspicious mods are disabled automatically[/]

  []Detailed Reports: Comprehensive findings with IL snippets and severity levels[/]

  []Cross-Platform Engine: Powered by MLVScan. Core, also available as a web scanner[/]

  Installation (Schedule 1 Package)

  This Schedule 1 package is MelonLoader-only.

  • []Click Download[/]

    []Install with Vortex/FOMOD (or manually place the DLL)[/]

    []Verify final path: Plugins/MLVScan. MelonLoader.dll[/]

    Need BepInEx builds? MLVScan also supports BepInEx 5.x/6.x. You can get those builds from the GitHub page or the modding tools section post.

    How It Works

    MLVScan uses static analysis (via Mono. Cecil) to examine mod assemblies without executing them. When a threat is detected:

    • []The mod is prevented from loading[/]

      []A detailed security report is generated in UserData/MLVScan/Reports/[/]

      []The mod's SHA256 hash is logged for whitelist verification[/]

      []Security guidance is provided (antivirus scan recommendations, etc.)[/]

      ⚠️ Important Safety Note

      MLVScan can only block what it sees before execution. If another malicious plugin executes first, it can bypass any scanner.

      • []Keep regular mods in Mods[/]

        []Treat Plugins as high trust only[/]

        []Before installing unknown plugin DLLs, pre-scan with Web Scanner[/]

        []Avoid random DLL installs outside normal mod/plugin folders[/]

        SHA256 Hash-Based Whitelisting

        MLVScan uses cryptographic hashes instead of filenames for superior security:

        • []Tamper Detection: Any modification changes the hash[/]

          []Rename Protection: Malware cannot bypass checks by changing filenames[/]

          []Authenticity Verification: Confirm exact file matches[/]

          To Whitelist a Trusted Mod:

          • []Check the scan report or MelonLoader log for the mod's SHA256 hash[/]

            []Verify with the community (Discord: discord.gg/UD4K4chKak) that it is safe[/]

            []Edit MelonPreferences.cfg and add the hash to WhitelistedHashes[/]

            Example:

            WhitelistedHashes = ["3918e1454e05de4dd3ace100d8f4d53936c9b93694dbff5bcc0293d689cb0ab7", "8e6dd1943c80e2d1472a9dc2c6722226d961027a7ec20aab9ad8f1184702d138"]

            ⚠️ Warning: Only whitelist mods from trusted sources. Verify hashes with the community first.

            Severity Levels

            • []Critical: Shell execution, assembly loading from streams, process execution [/]

              []High: Data exfiltration, reflection abuse, registry manipulation[/]

              []Medium: Base64 encoding, hex strings, byte array operations[/]

              []Low: Environment variable access[/]

              Full Documentation

              Comprehensive guides available on the MLVScan Wiki:

              [*][url=https://github.com/ifBars/MLV