LyScript contains malicious code? about lyscript HOT 4 CLOSED

I believe labeless has a similar RPC architecture and from your documentation and a few blog posts it seems to work nicely. I'm happy people are developing an alternative to the horrible 'scripting' in x64dbg! Currently x64dbg already has too many features and adding additional networking functionality would increase the attack/bug surface even more, so this isn't something I want to incorporate into x64dbg directly.

When it comes to this issue I think the suspicion is warranted. You are essentially asking people in the security industry to blindly trust your binaries. If you release the full source code and automatically generate the release binaries with GitHub Actions it will be easier for people to trust that nothing malicious is being executed on their (sensitive) environment.

If you release the source code for the LyScript.dp64, I am happy to help you set up automatic pipelines for building/releasing the plugin!

from lyscript.

@mrexodia Hello, thank you very much for your patient answer., but as a technician who has shared security technology for 6 years, I will never implant a backdoor in the plugin. My plugin has been reviewed by relevant national departments and has been certified as absolutely secure。

The original intention of developing this plugin is also to address the complaints of some people in China caused by the inconvenience of x64dbgpy. My plugin has solved this problem, and I am also committed to popularizing and promoting x64dbg and my plugin. Please rest assured that given me some time, I will definitely open source all the code and strengthen the security of the plugin in the future, and carefully complete the subsequent parts.

I also hope to receive support from x64dbg, thank you very much.

Let's work together to contribute to the reverse industry.

Perhaps my expression is not clear, please understand

from lyscript.

Unpacked and decompiled it, everything seems legit:

lyscript-unpacked.zip

I would strongly suggest to open source everything though, that way people can check for themselves and all the code looks like boilerplate forwarding to the x64dbg API anyway...

from lyscript.

@mrexodia Hello x64dbg author, this plugin can be open source and I feel it's easy to use in my daily life. Many people have also reported using it very well. In order to promote the development of the plugin, I hope to incorporate it into the x64dbg project and allow everyone to develop together. I would like to ask if it is feasible.

The official x64dbgpy, although more direct, is not practical, making it very cumbersome to configure and requires a separate installation of Python 2 environment, which makes it difficult for most people to use it better.

The problem solved by this plugin is that it can simply write some practical scripts using Python 3, which is essentially a secondary encapsulation of the x64dbg API and adds network communication functionality. This is similar to encapsulating TitanEngine with x64dbg. The goal of both is to make the software easier to use.

from lyscript.