MLVScan

Security-focused mod scanner that protects modded games from malicious DLLs

🌐 Try the Web Scanner

⚡ What is MLVScan?

MLVScan scans mod assemblies before they execute, detecting malicious patterns commonly found in malware. Created in response to the rise of malware mods, it provides automated protection for modded environments.

✨ Key Features

• []Pre-Execution Scanning: Catches threats before they can run[/]

  []17+ Detection Rules: Identifies process execution, shell commands, data exfiltration, and more[/]

  []SHA256 Hash Whitelisting: Cryptographically secure mod verification (tamper-proof)[/]

  []Automatic Protection: Suspicious assemblies are blocked automatically[/]

  []Detailed Reports: Comprehensive findings with IL snippets and severity levels[/]

  []Cross-Platform Engine: Powered by MLVScan. Core, also available as a web scanner[/]

  📦 Installation (Nexus Package)

  This package ships all loader builds in one archive, and uses FOMOD to install to the correct location when using Vortex (mod manager).

  • []Use Download (or pick a specific file from Files)[/]

    []In Vortex, choose exactly one loader build[/]

    []Finish installation and verify destination:[/]

    • []MelonLoader -> Plugins/MLVScan. MelonLoader.dll[/]

      []BepInEx 5.x -> BepInEx/patchers/MLVScan. BepInEx5.dll[/]

      []BepInEx 6.x Mono -> BepInEx/patchers/MLVScan. BepInEx6. Mono.dll[/]

      []BepInEx 6.x IL2CPP -> BepInEx/patchers/MLVScan. BepInEx6. IL2CPP.dll[/]

      🛡️ How It Works

      MLVScan uses static analysis (via Mono. Cecil) to inspect assemblies without executing them. When a threat is detected:

      • []The assembly is prevented from loading[/]

        []A security report is generated in UserData/MLVScan/Reports/ (MelonLoader) or BepInEx/MLVScan/Reports/ (BepInEx)[/]

        []The assembly's SHA256 hash is logged for whitelist verification[/]

        []Security guidance is provided (antivirus scan recommendations, etc.)[/]

        ⚠️ Important Safety Note

        MLVScan can only block malware it sees before execution. If a malicious DLL runs first, it can bypass any scanner.

        • []Treat plugin/patcher folders as high trust[/]

          []Before installing plugins/patchers, pre-scan DLLs with Web Scanner[/]

        MLVScan always runs at the earliest point possible during mod loading, but using the web scanner ensures a safer environment.

        📚 Full Documentation

        • []Getting Started Guide[/]

          []SHA256 Whitelisting Guide[/]

          []Understanding Security Reports[/]

          []FAQ & Troubleshooting[/]

          📄 License

          GNU GPL v3 - View License

          GitHub Repository • Documentation • Discord • Original Post

          If MLVScan helps keep you safe, consider supporting continued development ❤️