Wall Worm Forums

It has come to our attention that a number of Anti-Virus solutions out there are picking up WallWorm.Stubs.dll as malware. I wish to assure all users that this is a false-positive due to overly generic signatures. The stubs DLL is tiny, and is needed for one and exactly one function, as it has to get around the fact that you cannot create a pointer to a managed class in C#. I need to be able to create that pointer in order to work around a bug in the C# interface for 3ds Max that makes it impossible to get an IGameMesh. For this reason, I wrote a tiny stub function in MSIL (which is what C# compiles to) to do an upcast to an arbitrary class, and that is the function that is put in WallWorm.Stubs.dll.

We are currently contacting the AV companies effected, but this will take time.

To help ease any other suspicions, I present to you the entire 80 lines of code that make up WallWorm.Stubs.dll:


.assembly extern mscorlib
{
.publickeytoken = (B7 7A 5C 56 19 34 E0 89 )
.hash = (CD 95 65 AD 55 34 B6 AD 72 9D 3F BB 80 DA 0A 6C 49 E5 F2 5B)
.ver 4:0:0:0
}
.assembly extern Autodesk.Max
{
.hash = (2F 54 6D B7 43 34 A0 B6 DB 14 BA 8D AD 40 23 DF 4C 11 B0 09)
.ver 16:3:0:0
}

.assembly WallWorm.Stubs
{
    .ver 1:0:5419:28332
    .hash algorithm 0x00008004
    .custom instance void [mscorlib]System.Security.SecurityRulesAttribute::.ctor(valuetype [mscorlib]System.Security.SecurityRuleSet) = { uint8(1) }
    .custom instance void [mscorlib]System.Runtime.Versioning.TargetFrameworkAttribute::.ctor(string) = { string('.NETFramework,Version=v4.0') property string 'FrameworkDisplayName' = string('.NET Framework 4') }
    .custom instance void [mscorlib]System.Reflection.AssemblyProductAttribute::.ctor(string) = { string('WallWorm Stubs') }
    .custom instance void [mscorlib]System.CLSCompliantAttribute::.ctor(bool) = { bool(true) }
    .custom instance void [mscorlib]System.Runtime.InteropServices.ComVisibleAttribute::.ctor(bool) = { bool(false) }
    .custom instance void [mscorlib]System.Reflection.AssemblyTrademarkAttribute::.ctor(string) = { string('') }
    .custom instance void [mscorlib]System.Reflection.AssemblyCopyrightAttribute::.ctor(string) = { string('Copyright (c) WallWorm.com 2014') }
    .custom instance void [mscorlib]System.Reflection.AssemblyTitleAttribute::.ctor(string) = { string('WallWorm Stubs') }
    .custom instance void [mscorlib]System.Reflection.AssemblyCompanyAttribute::.ctor(string) = { string('WallWorm.com') }
    .custom instance void [mscorlib]System.Reflection.AssemblyConfigurationAttribute::.ctor(string) = { string('') }
    .custom instance void [mscorlib]System.Reflection.AssemblyDescriptionAttribute::.ctor(string) = { string('') }

.permissionset reqmin = {
[mscorlib]System.Security.Permissions.SecurityPermissionAttribute = { property bool 'SkipVerification' = bool(true) },
[mscorlib]System.Security.Permissions.SecurityPermissionAttribute = { property bool 'UnmanagedCode' = bool(true) }
}
}

.class public abstract sealed auto ansi beforefieldinit WallWorm.Stubs.Activator extends [mscorlib]System.Object
{
.method public hidebysig static !!T  Upclass<([Autodesk.Max]Autodesk.Max.INativeObject) T>(class [Autodesk.Max]Autodesk.Max.INativeObject val) cil managed
{
ldtoken    !!T
call       class [mscorlib]System.Type [mscorlib]System.Type::GetTypeFromHandle(valuetype [mscorlib]System.RuntimeTypeHandle)
callvirt   instance class [mscorlib]System.Reflection.ConstructorInfo[] [mscorlib]System.Type::GetConstructors()
ldc.i4.0
ldelem.ref

ldc.i4.2
newarr     [mscorlib]System.Object
dup
dup

ldc.i4.0
// Unfortunately, the API changed between 2014 and 2015 and we can't use this directly.
ldtoken [Autodesk.Max]Autodesk.Max.INativeObject
call class [mscorlib]System.Type [mscorlib]System.Type::GetTypeFromHandle(valuetype [mscorlib]System.RuntimeTypeHandle)
ldstr "Handle"
call instance class [mscorlib]System.Reflection.PropertyInfo [mscorlib]System.Type::GetProperty(string)
dup
brtrue.s Pre2015
pop
ldtoken [Autodesk.Max]Autodesk.Max.INativeObject
call class [mscorlib]System.Type [mscorlib]System.Type::GetTypeFromHandle(valuetype [mscorlib]System.RuntimeTypeHandle)
ldstr "NativePointer"
call instance class [mscorlib]System.Reflection.PropertyInfo [mscorlib]System.Type::GetProperty(string)
Pre2015:
ldarg.0
ldnull
callvirt instance object [mscorlib]System.Reflection.PropertyInfo::GetValue(object, object[])
stelem.ref

ldc.i4.1
ldc.i4.0
box        [mscorlib]System.Boolean
stelem.ref

call       instance object [mscorlib]System.Reflection.ConstructorInfo::Invoke(object[])
unbox.any  !!T
ret
}
}


The first thing to understand when using the Pro implementation of the VMT importer is that it does actually parse the VMT files, which the original doesn't do. This means that the Pro version has to deal with a lot of absurdity that makes it into the VMT files that valve produces. If you find a VMT in a Source game that doesn't parse due to a syntax error, then post it here, so that a work around can be hard-coded. We will only do this for the main Source games themselves; we won't (except in special cases, or if you ask nicely) add support for syntax errors that are located in the materials for custom maps produced by users. If that map is then integrated into the game however, we will support it.

The VMT parser in Source itself simply ignores values that fail to parse, but for various reasons, the Pro implementation is not designed that way.

And on a bit of a proud note, the Pro parser parses the combined TF2 and CS:GO materials, totalling 361,492 lines across 26132 VMTs in 3.2 seconds. Unfortunately, the vast majority of the time the VMT importer spends is in creating the actual materials in 3ds Max, which it isn't possible to get much faster than it already is.

So, to give you an idea of the sort of messes that the Pro parser has to deal with, here are a few of the things that has to be handled specially by Pro for some games.


Counter-Strike: Global Offensive:

materials\asphalt\4wb_asphalt_b1.vmt:
$detailscale is officially documented to be a Scale, and makes sense as a Vec2, but this provides a Vec3 value. The Vec2 parsing was modified to ignore the 3rd value if provided.

materials\de_cbble\grass_alt\grass_b_blend.vmt:
This file has an extra closing curly brace at the end. The root node file parser was updated to try to consume all closing curly braces before expecting the EOF.

materials\models\effects\urban_puddle01a.vmt:
$envmapcontrast is documented to be a Normal. A Vec3 value, not enclosed in square brackets is instead provided. The $envmapcontrast parsing was updated to forward this value to $envmaptint instead, which I believe is what was originally intended.

materials\models\props\de_aztec\aztec_door_no_sign.vmt:
$phongexponent is set to "11:26 AM 3/4/20115", which is definitely not the Float that's expected. $phongexponent parsing was updated to specifically ignore this value.

materials\models\props\de_train\hr_t\train_car_a\train_a_numbers.vmt:
$AlphaTestReference is expected to be a Normal value, but instead contains the value "4". Normal parsing was updated to clamp values to within the 0 to 1 range.

materials\models\props_c17\pottery01a_09a.vmt:
$basealphaenvmapmask is expected to be a Bool, but is instead used as a texture reference. Bool parsing was updated to assume that the presence of a value means that the flag is set.

materials\models\props_unique\subwaycardoors.vmt:
$EnvMapTint is expected to be a Vec3, and one is provided, the only problem though is that there are no spaces separating the decimal components. Vec3 parsing was updated to assume that there is a space before each dot in this particular case.

I have a model that I'm trying to get imported properly into source, and I believe I have WWMT configured correctly, but every time I try to compile the smd files into mdl files, I get an access violation when studiomdl goes to process the skeleton section. (specifically it's trying to multiply 2 matrix's, but the first matrix is at an invalid point in memory) Because of this, I'm wondering if there is any specific requirements for bones in animated models? I originally had no bones and had the pieces animated via basic transforms, but then, after I figured out where studiomdl didn't like in the smd, I tried adding a couple of bones and skinning the entire model to be attached to them, but it still gives me the same error at the same part. Any suggestions?