BOO UI编辑器

AI Security Review

Evidence context: threat category none; evidence quality moderate.

boo-NGOM-editor is a GM toolkit for Legend of Mir style game servers: script intellisense, a UI editor, PAK and JPK archive reading, database and map viewers, and an M2 reload command. Every native-binary finding sits inside that job description. The DLLs flagged as OBFUSCATION-NATIVE_BINARY_ADDON are extension/tools/PakBridge/bin/python312.dll, vcruntime140.dll, msvcp140.dll, libssl-3-x64.dll, libcrypto-3-x64.dll and libffi-8.dll. That group is the standard payload of an embedded CPython runtime: the interpreter, the Visual C++ redistributable it links against, and the TLS and FFI libraries it loads. extension/tools/PakBridge/bin/lib/unicorn/lib/unicorn.dll is the Unicorn CPU emulator, which a PAK/JPK bridge would use to decode or emulate game client code. These are public libraries shipped in a bin/ folder, not custom artefacts. An entropy rule run against a compiled binary cannot tell a normal DLL from a packed one, which is why all of them fired.

Process and filesystem reach here is broad, and it is meant to be. PakBridge runs an embedded Python interpreter as a child process to parse archives and query game databases, so the extension can read and write game files outside the workspace and run code with the user's own privileges. For a tool whose stated purpose is editing server-side scripts and unpacking game archives, that reach is the feature.

Credential findings are absent. Nothing matched secret scanning, and nothing touches .env, .ssh, .git/config or cloud credential paths. The two network findings are both in extension/node_modules/sql.js/dist/sql-wasm.js at lines 97 and 100, the loader that pulls in sql.js's own .wasm binary from the extension package.

The malware signature to weigh is YARA--Emotet on extension/tools/PakBridge/bin/lib/unicorn/lib/unicorn.dll. Emotet rules are written against packed banking-trojan samples and routinely match emulator and crypto-heavy binaries. Unicorn is a widely used open-source emulation library, and its presence next to Python and OpenSSL in a game-data bridge is unremarkable.

The strongest counterargument is that bundling a full Python runtime, OpenSSL and a CPU emulator inside a VS Code extension hands a large amount of trusted code to the extension host, and any of those binaries could in principle be swapped for something hostile in a future release. That argument would carry weight if the binaries were custom, unidentifiable, or unique to this package, or if a finding showed them being written to disk, launched from a postinstall step, or contacting an external host. Nothing here shows that. There is no install-time execution, no credential read, and the external endpoints reported by IoC extraction are fragments such as act-ui-preview-panel.show, arc2.py and basehttprequesthandler.date, which are property chains and file extensions pulled out of library code.

Broad but expected capability, standard runtime libraries, and no evidence of payload execution, theft or exfiltration.

Key Reasons

• All OBFUSCATION-NATIVE_BINARY_ADDON hits are standard runtime DLLs under extension/tools/PakBridge/bin/ (python312.dll, msvcp140.dll, vcruntime140.dll, libssl-3-x64.dll, libcrypto-3-x64.dll, libffi-8.dll), the normal payload of an embedded CPython distribution.
• YARA--Emotet matched extension/tools/PakBridge/bin/lib/unicorn/lib/unicorn.dll, the public Unicorn CPU emulator, a well-documented source of false hits from Emotet rules.
• Both NET-FETCH findings are in extension/node_modules/sql.js/dist/sql-wasm.js at lines 97 and 100, the loader fetching sql.js's own .wasm asset, not an outbound channel.
• No credential, secret or postinstall findings; the reported network endpoints are extraction artefacts such as act-ui-preview-panel.show, arc2.py and basehttprequesthandler.date.
• Bundled Python plus PAK/JPK parsing explains the process and file access, which matches the extension's stated server-management purpose.

False Positive Considerations

• Native-binary entropy rule firing on unmodified MSVC, OpenSSL, libffi and Python runtime DLLs
• Broad Emotet YARA family rule matching the Unicorn emulator library
• NET-FETCH hits inside a minified bundled dependency loading its own WASM file
• Thousands of IoC entries that are property access chains, file extensions and library substrings rather than hosts

Reviewed 2026-09-26; recommended action: suppress false positive; model confidence 78%.