`p2bin.exe` keeps getting misidentified as a virus

[Breakout-X]

Edit: Scroll down to this comment.

---

My anti-virus installed by my admin, McAfee, keeps removing the p2bin.exe file saying it's a virus although it's been tested and is clearly not.

Since I am not currently the administrator of my computer, I cannot whitelist the file or unquarantine it.

---

If you could check the file to see what the issue is and why it causes anti-viruses to quarantine it, that would be very helpful. Thanks.

---

Only reason I am drawing attention to this is because I can't use the disassembly without this file. However I am testing a possible workaround soon.

[Breakout-X]

According to VirusTotal, literally the McAfee scanner doesn't flag it there, but the official product deleted it.

Tested Results.

This is proof that McAfee is a stupid ahh virus that I wish my admin didn't install on my computer.

Only four other programs flagged it.
However:

1. Arctic Wolf: Clearly a false positive due to being vague.
2. Rising: AI generated result of some random ID
3. SecureAge: Also vague
4. Trapmine: Literally suspicious only because it couldn't get enough information.

Engine	Result
Arctic Wolf	Unsafe
Rising	Trojan.Generic@AI.100 (RDML:yZOK1r83FDs0pfXzFj6pIQ)
SecureAge	Malicious
Trapmine	Suspicious.low.ml.score
Acronis (Static ML)	Undetected
AhnLab-V3	Undetected
Alibaba	Undetected
AliCloud	Undetected
Antiy-AVL	Undetected
Avira (no cloud)	Undetected
Baidu	Undetected
BitDefenderTheta	Undetected
Bkav Pro	Undetected
CMC	Undetected
Cynet	Undetected
Elastic	Undetected
eScan	Undetected
Fortinet	Undetected
Gridinsoft (no cloud)	Undetected
Ikarus	Undetected
Jiangmin	Undetected
K7AntiVirus	Undetected
K7GW	Undetected
Kingsoft	Undetected
Lionic	Undetected
Malwarebytes	Undetected
MaxSecure	Undetected
McAfee Scanner	Undetected
Microsoft	Undetected
NANO-Antivirus	Undetected
Palo Alto Networks	Undetected
Panda	Undetected
QuickHeal	Undetected
Sangfor Engine Zero	Undetected
SentinelOne (Static ML)	Undetected
Sophos	Undetected
SUPERAntiSpyware	Undetected
Symantec	Undetected
TACHYON	Undetected
TEHTRIS	Undetected
Tencent	Undetected
Trellix (ENS)	Undetected
TrendMicro-HouseCall	Undetected
Varist	Undetected
VBA32	Undetected
VIPRE	Undetected
VirIT	Undetected
ViRobot	Undetected
WithSecure	Undetected
Xcitium	Undetected
Yandex	Undetected
Zillya	Undetected
Zoner	Undetected
ALYac	Timeout
Arcabit	Timeout
Avast	Timeout
AVG	Timeout
BitDefender	Timeout
ClamAV	Timeout
Cybereason	Timeout
DrWeb	Timeout
Emsisoft	Timeout
ESET-NOD32	Timeout
GData	Timeout
Google	Timeout
Kaspersky	Timeout
MAX	Timeout
Skyhigh (SWG)	Timeout
Trellix (HX)	Timeout
TrendMicro	Timeout
ZoneAlarm by Check Point	Timeout
Avast-Mobile	Unable to process file type
BitDefenderFalx	Unable to process file type
Symantec Mobile Insight	Unable to process file type
Trustlook	Unable to process file type
DeepInstinct	—
Webroot	—

[Clownacy]

If I remember correctly, the p2bin EXE was compiled with MSYS2. It may be worth recompiling the EXE with MSVC instead, as it is the standard Windows compiler, and may produce more-trustworthy executables. p2bin's source code is ANSI C, so I could even compile it with MSVC 12.0 from 1998, for maximum compatibility.

[Clownacy]

Hopefully the new EXE has fixed this problem. This issue can be reopened if it hasn't.

[Breakout-X]

If I remember correctly, the p2bin EXE was compiled with MSYS2. It may be worth recompiling the EXE with MSVC instead, as it is the standard Windows compiler, and may produce more-trustworthy executables. p2bin's source code is ANSI C, so I could even compile it with MSVC 12.0 from 1998, for maximum compatibility.

Oh, cool. Hopefully it does fix everything as I really want to hack Sonic 3 and K. Also btw, I did study the source code of p2bin to attempt to understand why it gets flagged and to even consider recompiling it myself.

Hopefully the new EXE has fixed this problem. This issue can be reopened if it hasn't.

I'll run it through VirusTotal today, then test it on my computer whenever I have time (I'm on my phone rn).

[Breakout-X]

New VirusTotal results.

It only has one flag now, being a clearly vague false positive. I haven't tried it on my computer but I will as soon as I can after I reinstall SonLVL.

Engine	Result
Trapmine	Malicious.high.ml.score
Acronis (Static ML)	Undetected
AhnLab-V3	Undetected
Alibaba	Undetected
AliCloud	Undetected
ALYac	Undetected
Antiy-AVL	Undetected
Arcabit	Undetected
Arctic Wolf	Undetected
Avast	Undetected
AVG	Undetected
Avira (no cloud)	Undetected
Baidu	Undetected
BitDefender	Undetected
Bkav Pro	Undetected
ClamAV	Undetected
CMC	Undetected
CrowdStrike Falcon	Undetected
CTX	Undetected
Cynet	Undetected
DeepInstinct	Undetected
DrWeb	Undetected
Elastic	Undetected
Emsisoft	Undetected
eScan	Undetected
ESET-NOD32	Undetected
Fortinet	Undetected
GData	Undetected
Google	Undetected
Gridinsoft (no cloud)	Undetected
Huorong	Undetected
Ikarus	Undetected
Jiangmin	Undetected
K7AntiVirus	Undetected
K7GW	Undetected
Kaspersky	Undetected
Kingsoft	Undetected
Lionic	Undetected
Malwarebytes	Undetected
MaxSecure	Undetected
McAfee Scanner	Undetected
Microsoft	Undetected
NANO-Antivirus	Undetected
Palo Alto Networks	Undetected
Panda	Undetected
QuickHeal	Undetected
Rising	Undetected
Sangfor Engine Zero	Undetected
SecureAge	Undetected
SentinelOne (Static ML)	Undetected
Skyhigh (SWG)	Undetected
Sophos	Undetected
SUPERAntiSpyware	Undetected
Symantec	Undetected
TACHYON	Undetected
TEHTRIS	Undetected
Tencent	Undetected
Trellix ENS	Undetected
TrendMicro	Undetected
TrendMicro-HouseCall	Undetected
Varist	Undetected
VBA32	Undetected
VIPRE	Undetected
VirIT	Undetected
ViRobot	Undetected
Webroot	Undetected
WithSecure	Undetected
Xcitium	Undetected
Yandex	Undetected
Zillya	Undetected
ZoneAlarm by Check Point	Undetected
Zoner	Undetected
Avast-Mobile	Unable to process file type
BitDefenderFalx	Unable to process file type
Symantec Mobile Insight	Unable to process file type
Trustlook	Unable to process file type

[Breakout-X]

Hopefully the new EXE has fixed this problem. This issue can be reopened if it hasn't.

It worked @Clownacy. I also see that the repo works with SonED if I use git clone. That's nice. SonLVL can't install on my computer due to McAfee, probably for the same reason p2bin.exe didn't work until now. But hey, at least it works now. Thanks for addressing my issue and fixing it :).

Edit: Yeah it didn't work

[Breakout-X]

Hopefully the new EXE has fixed this problem. This issue can be reopened if it hasn't.

@Clownacy Okay. Freaking McAfee decided to flag it literally 4 days later. Alright I'mma see what happens if I recompile p2bin myself via TinyCC to see if that fixes the issue on my end. Also, I'm unable to reopen the issue.

[Clownacy]

Unfortunately, fixing the issue permissions is out of my control, as I don't have admin rights to these repositories.

If it isn't the compiler that's to blame, then maybe p2bin's behaviour is what's tripping McAfee. I'm not sure what it could be though; all it does is read and write a couple of files.

[Breakout-X]

Unfortunately, fixing the issue permissions is out of my control, as I don't have admin rights to these repositories.

Oh. That makes sense.

If it isn't the compiler that's to blame, then maybe p2bin's behaviour is what's tripping McAfee. I'm not sure what it could be though; all it does is read and write a couple of files.

It's probably because it's an unsigned cli meant to build files. However, I tried compiling it with TinyCC after downloading a portable release of CMake and now it works.

Strange, isn't it?

[Breakout-X]

I'll put the file here in case other people who are having issues with freaky anti-viruses can try the TinyCC version I made.

• zip with 7z inside
• zip only
• zip with zip and 7z inside

The reason I attached three versions is because generally in modern-day, people are probably using Edge or Chrome. Edge and Chrome hate it when you download zip files with an executable in them. However, they are perfectly chill with a 7z for some reason. Firefox and Brave on the other hand will only hate files depending on your settings.

Edit: Thanks for your help @Clownacy.