v0.3.1 — custom Core map masks, and a straight answer about Defender

⚠️ Superseded by v0.3.2 — and Windows Defender may quarantine this build

Since publishing, Defender has flagged this exact build as Program:Win32/Contebrew.A!ml
on at least one machine. It is a false positive.

This note originally said the next patch would ship code-signed. It is not signed yet —
the certificate is not in place — so rather than leave a promise standing that the next
release did not keep, it is corrected here. Signing is still the fix and is still coming;
the release that carries it is the one to wait for.

Use v0.3.2 instead of this build. It supersedes v0.3.1 and repeats the detection details
and the recovery step below.

What that detection name means: the !ml suffix is a machine-learning verdict — no analyst
looked at the file — and Microsoft's own page for that name carries a generic template with
"Technical details are currently not available."

Why it hits this release and not the previous one, measured on one machine with the same
engine and the same definition version (1.457.447.0) within the same hour:

build	offline scan result
v0.2.0	no threats found
an older development build, flagged earlier the same day	no threats found — that earlier verdict had already reverted on its own
v0.3.1	flagged

No definitions changed between those scans. The verdict is cloud-delivered and it moves:
Windows judges every brand-new, rarely-seen, unsigned file on its own, and a fresh release
is exactly that. An older build having been cleared once does not carry over to a new one —
Microsoft documents that unsigned files start from zero reputation on every version.

What you can do: verify the hashes below against your download before trusting it. If
Defender quarantines it anyway and the hash matches, restoring it from quarantine is your
call to make with that information — this project is not going to tell you to switch your
antivirus off, add an exclusion, or ignore a warning. If you would rather wait, the signed
build is the release to wait for.

Reporting it to Microsoft yourself is also an option, at
https://www.microsoft.com/en-us/wdsi/filesubmission — choose "incorrectly detected" and set
the priority to Medium.

---

Named custom masks on the Core map, and a straight answer about Windows Defender.

Custom masks

The Core map page gains Add mask… and Remove mask beside Reset to detected.

• A new mask starts as a copy of the mask you are editing, under a name you choose. An empty mask is not a useful starting point, and an empty CPU Set id list is how this app clears an assignment rather than applying one.
• Remove mask refuses while a profile still uses the mask, and tells you which profiles. Point them somewhere else first.
• Emptying a mask on the map is rejected at edit time, for the same reason: a mask must keep at least one processor.
• Custom masks now survive a topology change. The re-derive that runs when your CPU layout changes merges instead of overwriting, and the message box tells you how many of your masks were kept — their processor numbers may mean different cores afterwards, so check them.
• Names the app derives on its own — All, Cache, Freq, CCD0 and so on, P-cores, E-cores, and the no SMT form of each — are reserved on every machine, not just one that happens to have that hardware today. A config you carry to a new CPU cannot collide with a freshly detected mask.

Existing configurations are untouched: the rule applies when you create a mask, never when one is loaded.

If Windows Defender flags it

Some machines have shown a "Threat blocked" toast for a Game Optimizer build. The README now has a section explaining it, and it is worth reading before you decide what to do.

Short version: the exe is unsigned, it is new, few machines have seen it, and it does things a scanner scores — it enumerates processes, opens the game's process to set its CPU Sets, controls one AMD service when you ask, writes a Start-with-Windows entry when you ask, and briefly elevates a copy of itself for the one action that needs administrator rights. All of that is in this repository.

Verify what you downloaded. Both hashes below are of the files in this release. If you unpacked the zip and kept only the exe, hash the exe:

certutil -hashfile GameOptimizer-v0.3.1-x64.zip SHA256
certutil -hashfile GameOptimizer.exe SHA256

file	SHA256
GameOptimizer-v0.3.1-x64.zip	A3B177F0091C6B4EFB1B066D6C37E95F7A2EB6D01E55A3E06D9AD15F34F15985
GameOptimizer.exe (inside the zip)	899BC12A96D25E662DD096118B84322A24BCFAA195FEE34A300FE9499CC23BE2

If the hash matches and Defender still quarantines it, that is a false positive on this build. You can report it at https://www.microsoft.com/en-us/wdsi/filesubmission — choose "incorrectly detected" and set the priority to Medium; expect a few days, and note a review is not a promise. Please also open an issue here with the detection name and date.

Defender's clean-up also deletes the Start-with-Windows entry it finds, so switch it back on in Settings afterwards.

Nothing here asks you to add an exclusion or turn Defender off.

Notes

• This build is not code-signed, so SmartScreen will still say the publisher is unknown, and reputation starts from zero for every unsigned release. Signing has been chosen - SignPath Foundation, free for open-source projects - and is being set up. It is the real fix for the detection above and it is not in place yet.
• Building from source gives you a binary you compiled yourself; it will not be byte-identical to this one.
• Requires Windows 10/11 x64. Unzip and keep WebView2Loader.dll beside GameOptimizer.exe.