i compare Ryzen111 (left), Shine (middle), Otokonoko (right), and it seems the cryptbase.dll & d3dcompiler_64.dll was still on middle & right which i think was the virus dll before?
the only other difference is the resources.pak. the size on Shine & Otokonoko was 40753879 as for Ryzen111 was...
regarding RJ01617050, probably ryuugames/f95 source was from https://www.tokyotosho.info/search.php?username=Reeffress / https://www.anirena.com/?q=user%3A%22Lian%22 the guy upload new game there always obfuscate files.
i checked shine, otokonoko & ryzen111 posted here, the json files was fine...
not sure if there is a hidden malware on it or not, the one i check RJ01588706
libEGL.dll & libGLESv2.dll has only extra zero bytes at the end of it.
rmmz_managers.js contain the decryption to the json files. and that's it i think.
and another new game that was posted here RJ01464379 same style...
new game that was posted here, same info as above RJ01596306 but newer version?
MZDataCrypt — v1.6.0 vs v1.10.0 Reverse Engineering Notes
Two RPG Maker MZ doujin games analyzed, both protected by MZDataCrypt. Same tool, significant encryption upgrade between versions.
Overview...
regarding "RJ01588706" that was posted here (only checked this one), i think the original source of that is from https://www.tokyotosho.info/search.php?username=Reeffress because all new game that this user posted has heavily obfuscated the json files and other files. no idea if it just...
new things i notice from Reeffress (https://www.tokyotosho.info/search.php?username=Reeffress) new files releases starting (2026-02-04 16:14)
The files now have much larger size differences.
RJ01546134 = HameDocu.exe (5909920 bytes) size is much larger than trial (666624 bytes)
=using DIE...
from otokonoko = libEGL.dll 537600
from shine = libEGL.dll 386560
from ryzen111 = libEGL.dll 386560
it seems the file from otokonoko was the old version because the modified date was also different.
all game starting from 2026-01-20 (for rpgmaker games only), i found the size difference mostly on libGLESv2.dll, when i check on hex editor they were extra 0x00 padding. if the game have trial on dlsite you can compare the js folder, they were little different but seems fine i think except for...