r/R36S • u/NHzSupremeLord • 1d ago
Discussion DarkosEn windows trojan installed instead of batch device selector.
Yesterday I tried the latest image from this repo https://github.com/djparentx/dArkOSen-R36S/releases
It contains an executable for device selection instead of the original Darkos batch file. Windows defender blocks it and marks it as a trojan. There are no traces of the exe in the sources, just in the image commit message.
So, to everyone, just keep your eyes open. To me, this is really a virus and I dunno if the only author in the repo is reapomsible for this.
11
u/djparent 1d ago
It's a false positive because I won't pay Micro$oft for a publishing license.
It's just a batch file wrapped in an exe so it can have an icon. But apparently to Windows Defender it looks like a virus.
I had it on my computer for weeks with no issues, used it many times. Then about 5 days after release it started triggering in my anti-virus, having been identified as a 'threat' on other systems.
This version was built using an app, but I've since rebuilt it the hard way with Powershell and it triggers the exact same warning. Once an app signature is in their database good luck getting it out. The only workaround is paying for a license, which makes no difference at all on how the app was built or functions.
It's been removed and replaced with the old batch file in the next update. No fancy icons, Micro$oft sucks.
-2
u/NHzSupremeLord 1d ago
Thanks, anyways, if you want a file to be excuted on every windows flavour, batch are inspectable, ubuquitous and do not need any runtime. A batch to exe just adds complexity and exposes the user to potenti al harmful content. My two cents. M$ sucks, bit defender does its job.
5
u/Focus_Significant 1d ago
I run two different malware scanners in real-time, one is enterprise grade, they didn't pick up anything.
-2
8
u/Electrical-Pace4092 1d ago
It’s a false positive.
-4
-4
u/NHzSupremeLord 1d ago
Why an exe should trigger a false positive just for a device selector wrapper? Programmer here, I dunno have time for further investigation, but no, it should not trigger any warning, nor being a complex binary. Edit: typo
7
u/djparent 1d ago
There's always a slim possibility there's actually a virus, but the bat to exe app I used came recommended and was downloaded from GitHub. The fact that building it manually still triggers the AV gives me some confidence.
That being said, I'm not a gambler. Don't use it. Either grab an older release and update or wait 3 days for the fix.
2
u/Appropriate_Soft_31 20h ago
Windows cannot read what is inside a .exe directly.
As a "programmer", you seen rather inexperienced.0
0
u/NHzSupremeLord 17h ago
Aha. Are you serious? The point here is that the iso file contains something that is not in the github repo.
2
u/Electrical-Pace4092 1d ago
“Programmer here”
https://giphy.com/gifs/fXy3Bc6HAtlsFIlHqA
Big dummy here, so I’ll let the devs of dArkOSen handle this one.u/Jason_2X
4
u/Zekka_Space_Karate 1d ago
Game hacks can also trigger a false positive. AV/anti-malware programs can be a bit overzealous because most of them don't look for an exact malware/virus match, they use heuristic & behavioral analysis that can mistake harmless packages for malware.
I was more annoyed at BitDefender for auto-deleting the DTB/Model selector as it never happened before, it even wouldn't accept it if I made an exception on the AV program. I just inserted the flashed SD card in my Android phone instead and ran the alternative apk there.
-4
u/NHzSupremeLord 1d ago
I don't see the humour here. Open source solitions should be clear and reproducible. This is not. And inserting an exe where a script is enough is a code smell. No verifiable sources nor virus checks in the repo itself.
3
u/Wivi2013 23h ago
It is a false positive and microslop can suck my big one for that. We don't known what triggered their system to flag the .bat script as a potential threat tbh.
-2
u/NHzSupremeLord 22h ago
It's not a bat. It is an exe only in the ISO, not present in the repo.
5
u/Wivi2013 20h ago
All I see is you pointing fingers without presenting proof.
What are you trying to accomplish? Cause if you where trying to tarnish the reputation of dArkOSen, you failed and is only making yourself look like a fool.
-1
u/NHzSupremeLord 17h ago
Nah, read the original post.
3
u/Wivi2013 17h ago
Oh? Wheres PHOTOGRAPHIC PROOF of such .exe existing? The only thing you showed to us is an empty accusation and that you tried to stirr drama for no reason making you look like a dork to anyone looking at this thread.
-1
u/NHzSupremeLord 15h ago
Just use rufus and write the image on a SD card!! It's there. Look at it... If you cannot find it, your AV deleted it for ya
3
u/Appropriate_Soft_31 20h ago
"To me, this is really a virus" funny enough, Windows Defender marks many unknown files and execs as potential trojans... So you're just naive.
-2
u/NHzSupremeLord 17h ago
No, I'm not. It's 2026 and defender looks inside every exe for known patterns, explot methods and techniques.
6
u/Focus_Significant 15h ago
It pattern matches and uses heuristics, which is absolutely prone to misidentification. It happens constantly. I had a student's 21 byte C++ program once compiled trip a signature in Defender for a trojan who's basic code could never fit in 21 bytes. I had the source code, compiled it myself, and could easily trigger it. False positives are common because it operates on the "better safe than sorry" model so it is more likely to signal something is dangerous that is benign than miss something that is truly dangerous for something benign. You really do seem incredibly naive and don't understand the basics of how this type of detection works.
•
u/AutoModerator 1d ago
⚠️ Ditch that R3XS SD card—STAT! Those pre-loaded cards are ticking time bombs! ⏰❌ Don’t let glitchy saves, vanishing settings, and other retro nightmares ruin your gaming. Swap it out ASAP for a smoother experience!
New to the R36S? Start with the ➡️Beginner's Guide—it’s your first step to mastering the device.
Need more? The R36S has a full WIKI packed with info, plus a dedicated ⚙️ troubleshooting section to solve common headaches.
Before asking, try searching! Your issue has likely been answered already—check the subreddit, use the search bar, or browse flairs like "game recommendation."
Pro Tip: The subreddit’s sidebar is a goldmine of FAQs, guides, tutorials, and curated lists—don’t sleep on it!
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.