i compare Ryzen111 (left), Shine (middle), Otokonoko (right), and it seems the cryptbase.dll & d3dcompiler_64.dll was still on middle & right which i think was the virus dll before?
the only other difference is the resources.pak. the size on Shine & Otokonoko was 40753879 as for Ryzen111 was...
regarding RJ01617050, probably ryuugames/f95 source was from https://www.tokyotosho.info/search.php?username=Reeffress / https://www.anirena.com/?q=user%3A%22Lian%22 the guy upload new game there always obfuscate files.
i checked shine, otokonoko & ryzen111 posted here, the json files was fine...
not sure if there is a hidden malware on it or not, the one i check RJ01588706
libEGL.dll & libGLESv2.dll has only extra zero bytes at the end of it.
rmmz_managers.js contain the decryption to the json files. and that's it i think.
and another new game that was posted here RJ01464379 same style...
...Anti-debuggerNonesetInterval(debugger) every 50ms
DLL integritylibGLESv2 + libEGLSame (identical expected hashes)
Data Format
Every data/*.json is replaced with:
{
"uid": "<8 hex chars>", // per-file identifier, NOT used in decryption
"bid": "1.x.x", // tool version...
new things i notice from Reeffress (https://www.tokyotosho.info/search.php?username=Reeffress) new files releases starting (2026-02-04 16:14)
The files now have much larger size differences.
RJ01546134 = HameDocu.exe (5909920 bytes) size is much larger than trial (666624 bytes)
=using DIE...
from otokonoko = libEGL.dll 537600
from shine = libEGL.dll 386560
from ryzen111 = libEGL.dll 386560
it seems the file from otokonoko was the old version because the modified date was also different.
all game starting from 2026-01-20 (for rpgmaker games only), i found the size difference mostly on libGLESv2.dll, when i check on hex editor they were extra 0x00 padding. if the game have trial on dlsite you can compare the js folder, they were little different but seems fine i think except for...