PZ-ModGuard v2.6.0 - Intelligent Framework Classification & Continuous Deep Scanning

PZ-ModGuard v2.6.0 - Intelligent Framework Classification, Continuous Deep Scanning & Linux / SteamOS Support

ℹ️ Disclaimer: This project was developed and coded with the assistance of Google Gemini.

What is New in v2.6.0:

1. 🐧 Official Linux & SteamOS / Steam Deck Support:

   • Zero Dependencies: Native Python 3 scanner (pz_modguard.py) + POSIX shell launcher (pz-modguard.sh). Uses only standard library modules—no pip or administrative privileges required.
   • Pre-Installed Out-of-the-Box: Runs on standard Linux distributions (Ubuntu, Debian, Arch, Fedora) and SteamOS without disabling Steam Deck write protection.
   • Auto-Discovery: Automatically queries Native Steam (~/.local/share/Steam), Flatpak Steam (~/.var/app/com.valvesoftware.Steam), MicroSD card library mounts (/run/media/...), and Heroic/Lutris GOG folders.
   • Full Feature Parity: Includes all 5 scan profiles, real-time ANSI colored progress bars, and identical high-speed JVM stream parsing.

2. Intelligent 3rd-Party Framework Classification:

   • PZ3D Framework Support: Recognizes pz3dLoader.dll / libpz3dLoader.so as a Known Native Framework (PZ3D 3D Camera Engine Hook) and pz3dLoader.jar (ByteBuddy / Dynamic ClassLoader / SelfUpdater). Instead of raising alarming false positives (Unauthorized Native Binary Detected), ModGuard reports them transparently as elevated engine hooks in Cyan.
   • ZombieBuddy Native Agent: Fully recognized as a known Build 42 native hook framework (zbNative.dll / libzbNative.so).
   • Discord Rich Presence (RPC): ZomboidRichPresence.jar opening local IPC sockets (LinuxIPC -> Socket) to the Discord desktop client is pre-audited and recognized as clean.

3. Continuous Deep Malware Auditing (Zero Blind Bypasses):

   • Crucial Security Guarantee: Pre-audited frameworks are never given a blind pass. Every single compiled .class file is decompiled in-memory and audited against all Tier 1 hostile malware signatures (Discord webhook stealers, token grabbers, remote shell payloads, C2 domains).
   • If a known framework is ever tampered with or contains malicious payloads, ModGuard will immediately flag it as [CRITICAL THREAT] and halt game launch.

4. Developer Script Artifact Handling:

   • Accidental developer automation scripts left behind in mod source directories (such as CarPhysicsImproved\...\media\src\build.ps1 and test.ps1) are classified as non-executing dev notices rather than halting the user from launching the game.

5. Full Deep Scan Fix for Installed Loose Classes (PZ_Optimization / pzopt):

   • Fixed a false alarm where Restart.class and Uninstall.class were flagged when installed into the main game root (\ProjectZomboid\pzopt\) during Profile [2] Full Deep Scan.
   • Added zombie|GameWindow.class|java/lang/ProcessBuilder matching official game window management code.
   • All 1,620 loose class overrides and 23,800+ core engine classes now scan 100% clean.

6. Discord Community:

   • Join our community: https://discord.gg/5rmsnwMPez