[BUG] Misdiagnosing CMI as a virus

[QianMoo0121]

Description

QuickShop shuts down my server when I start it, the log shows that my server has no digital signature, and MCAintimalware shows that the CMI plugin is infected with a virus, but the plugin actually does not have a virus.

Steps to reproduce

1. Start the server, Quickshop reports missing signature
2. Follow the instructions to use MCAntiMalware to check for viruses
3. Displays that the CMI plug-in is infected

Expected Behaviour

Fix this bug

Screenshots

No screenshots

/qs paste URL

Server log:https://pastebin.com/ArC3Wuh6 | MCAntiMalware log:https://pastebin.com/1g883LWv

Additional Context

Ubuntu 20.04LTS ZuluJDK-22 Quickshop5.1.2.5 CMI9.7.3.2 Paper1.20.4#137

[YuanYuanOwO]

You are running a 1.20.6 Paper Server from logs but this is normal
Please check this fork if you are running 1.20.6 Paper Server
https://github.com/Tianji-Server/QuickShop-Reremake

[dagobertdu94]

I have a similiar problem with my 1.20.6 Purpur server but QuickShop wasn't marked as infected by anything, but the AntiMalware program is still running with the information that there are no remaining files.
Do you know why the problem with the missing signature is happening?

[YuanYuanOwO]

I have a similiar problem with my 1.20.6 Purpur server but QuickShop wasn't marked as infected by anything, but the AntiMalware program is still running with the information that there are no remaining files. Do you know why the problem with the missing signature is happening?

it's a bug with QuickShop-Reremake
please check this fork
https://github.com/Tianji-Server/QuickShop-Reremake

[dagobertdu94]

I have a similiar problem with my 1.20.6 Purpur server but QuickShop wasn't marked as infected by anything, but the AntiMalware program is still running with the information that there are no remaining files. Do you know why the problem with the missing signature is happening?

it's a bug with QuickShop-Reremake please check this fork https://github.com/Tianji-Server/QuickShop-Reremake

Do you know yet if that bug can be fixed?
And the description of the fork mentions that it should only be used to migrate to QuickShop-Hikari...

[YuanYuanOwO]

I have a similiar problem with my 1.20.6 Purpur server but QuickShop wasn't marked as infected by anything, but the AntiMalware program is still running with the information that there are no remaining files. Do you know why the problem with the missing signature is happening?

it's a bug with QuickShop-Reremake please check this fork https://github.com/Tianji-Server/QuickShop-Reremake

Do you know yet if that bug can be fixed?
And the description of the fork mentions that it should only be used to migrate to QuickShop-Hikari...

I have no idea about this
Please also read Discord Channel announcements

[dagobertdu94]

I have a similiar problem with my 1.20.6 Purpur server but QuickShop wasn't marked as infected by anything, but the AntiMalware program is still running with the information that there are no remaining files. Do you know why the problem with the missing signature is happening?

it's a bug with QuickShop-Reremake please check this fork https://github.com/Tianji-Server/QuickShop-Reremake

Do you know yet if that bug can be fixed?
And the description of the fork mentions that it should only be used to migrate to QuickShop-Hikari...

I have no idea about this Please also read Discord Channel announcements

I have read the logs of my server again and I think it could be the PluginRemapper feature which might invalidate the existing signatures of the classes in the QuickShop plugin.
But I don't know what the PluginRemapper feature does exactly and why we need it.
Maybe there is a way to verify the integrity of the plugin even with the PluginRemapper feature, but I don't know any solution yet...

EDIT: I don't know if the Remapper is only present in Purpur, or if it's even present in other forks...

EDIT 2: I think it's very likely that this problem is caused by the PluginRemapper feature because of this report in the Paper issues: PaperMC/Paper#10676

[YuanYuanOwO]

I have a similiar problem with my 1.20.6 Purpur server but QuickShop wasn't marked as infected by anything, but the AntiMalware program is still running with the information that there are no remaining files. Do you know why the problem with the missing signature is happening?

it's a bug with QuickShop-Reremake please check this fork https://github.com/Tianji-Server/QuickShop-Reremake

Do you know yet if that bug can be fixed?
And the description of the fork mentions that it should only be used to migrate to QuickShop-Hikari...

I have no idea about this Please also read Discord Channel announcements

I have read the logs of my server again and I think it could be the PluginRemapper feature which might invalidate the existing signatures of the classes in the QuickShop plugin. But I don't know what the PluginRemapper feature does exactly and why we need it. Maybe there is a way to verify the integrity of the plugin even with the PluginRemapper feature, but I don't know any solution yet...

EDIT: I don't know if the Remapper is only present in Purpur, or if it's even present in other forks...

EDIT 2: I think it's very likely that this problem is caused by the PluginRemapper feature because of this report in the Paper issues: PaperMC/Paper#10676

Fork version doesn't have malware checker,but in 1.20.5+ Server have some broken features(left click the potion shop sign, the effect preview is broken/command alias/display item/etc...)
also:

[sandtechnology]

Remapper is translating nms related staff in our plugin to correct mapping, which result the modified class in memory then detected by plugin, in 1.20.5+ paper seems want to remove the nms stuff from spigot, and caused by many breaking changes from mojang in this new 1.20.x version, those features impl by nms all broken. Currently I do not have enough time to maintaining this plugin due to busy work in my job and life, if you are looking forward to modern minecraft version, maybe the Ghost_chu's version is a better choice: https://www.spigotmc.org/resources/quickshop-hikari-a-powerful-user-friendly-and-relieable-chestshop-plugin-1-18-2-1-20-6.100125/ Get Outlook for Android<https://aka.ms/AAb9ysg>

…

________________________________ From: YuanYuanOwO ***@***.***> Sent: Friday, June 14, 2024 7:12:38 PM To: PotatoCraft-Studio/QuickShop-Reremake ***@***.***> Cc: Subscribed ***@***.***> Subject: Re: [PotatoCraft-Studio/QuickShop-Reremake] [BUG] Misdiagnosing CMI as a virus (Issue #468) I have a similiar problem with my 1.20.6 Purpur server but QuickShop wasn't marked as infected by anything, but the AntiMalware program is still running with the information that there are no remaining files. Do you know why the problem with the missing signature is happening? it's a bug with QuickShop-Reremake please check this fork https://github.com/Tianji-Server/QuickShop-Reremake Do you know yet if that bug can be fixed? And the description of the fork mentions that it should only be used to migrate to QuickShop-Hikari... I have no idea about this Please also read Discord Channel announcements I have read the logs of my server again and I think it could be the PluginRemapper feature which might invalidate the existing signatures of the classes in the QuickShop plugin. But I don't know what the PluginRemapper feature does exactly and why we need it. Maybe there is a way to verify the integrity of the plugin even with the PluginRemapper feature, but I don't know any solution yet... EDIT: I don't know if the Remapper is only present in Purpur, or if it's even present in other forks... EDIT 2: I think it's very likely that this problem is caused by the PluginRemapper feature because of this report in the Paper issues: PaperMC/Paper#10676<PaperMC/Paper#10676> Fork version doesn't have malware checker,but in 1.20.5+ Server have some broken features(left click the potion shop sign, the effect preview is broken/command alias/display item/etc...) also: 03a6887d-b521-4396-a2ce-fa1c3403400a.png (view on web)<https://github.com/PotatoCraft-Studio/QuickShop-Reremake/assets/81153017/a27fecf5-e7a3-41c7-a3d7-81523acef284> — Reply to this email directly, view it on GitHub<#468 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AE3YYC3RK65YFPWLS723YTTZHLF2NAVCNFSM6AAAAABJAVRQJKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCNRXHAYDANBRGI>. You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[MoNoLidThZ]

Can confirm this PluginRemapper breaks the integrity check in paper

server is running Paper version 1.21-38-master@1f5db50 (2024-06-27T20:15:58Z) (Implementing API version 1.21-R0.1-SNAPSHOT)

[11:10:08 INFO]: [PluginRemapper] Remapping plugin 'plugins\Vault.jar'...
[11:10:08 INFO]: [PluginRemapper] Remapping plugin 'plugins\QuickShop-5.1.2.5.jar'...
[11:10:09 INFO]: [PluginRemapper] Done remapping plugin 'plugins\Vault.jar' in 852ms.
[11:10:12 INFO]: [PluginRemapper] Done remapping plugin 'plugins\QuickShop-5.1.2.5.jar' in 4195ms.

later on:

[11:10:48 INFO]: [EssentialsChat] Loading server plugin EssentialsChat v2.21.0-dev+93-3a6fdd9
[11:10:48 INFO]: [QuickShop] Loading server plugin QuickShop v5.1.2.5

[11:10:48 INFO]: [QuickShop] QuickShop Reremake - Early boot step - Booting up
[11:10:48 WARN]: [QuickShop] The signature could not be found! The QuickShop jar has been modified or you're running a custom build.
[11:10:48 WARN]: [QuickShop] [FATAL] Signature Verify: Security risk detected, QuickShop jar has been modified.
[11:10:48 ERROR]: [QuickShop] [Security Risk Detected] QuickShop forcing crash the server for security, contact the developer for details.
[11:10:48 WARN]: [QuickShop] [Security Risk Detected] To get more details, please check: file:/C:/MinePanel/Servers/2_V121/plugins/QuickShop/52ebf580-6813-42c2-aab1-d599856c0b43.security.letter.txt
[11:10:48 ERROR]: [QuickShop] =============================
  QuickShop Security Report
=============================
Description:
    QuickShop detected self jar has been modified.

For any Internet users out there looking for solutions for Paper 1.21 Servers, use the fork or QuickShop-Hikari for the time being

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.