Is Hookshot safe to run?
HookshotBuilder.exe is an open-source bootstrapper from NotRexed/Hookshot, not malware. Because it is unsigned, downloads a compiler toolchain and compiles a local executable, Windows SmartScreen and antivirus heuristics often flag it: always verify its SHA-256 digest before running it.
- Hookshot v2.1.0
- 185,856 bytes
- GPL-3.0 open source
- WebCrypto SHA-256 check
Why Windows flags HookshotBuilder.exe
Players searching for hookshotbuilder.exe or seeing a Windows SmartScreen / antivirus alert (“Windows protected your PC” or a generic Trojan/dropper warning) are running into four predictable heuristics triggered by how static recompilation builders work:
- No commercial EV code-signing certificate:
HookshotBuilder.exe(185,856 bytes / 186 KB inv2.1.0) is built by open-source contributors inNotRexed/HookshotunderGPL-3.0-or-laterwithout a paid Authenticode certificate. Every new release tag produces a fresh binary hash, resetting SmartScreen’s download-reputation counter until enough Windows users run that exact build. - Small bootstrapper fetching toolchain archives: Instead of forcing users to re-download hundreds of megabytes on every patch,
HookshotBuilder.exeacts as a lightweight bootstrapper. On first run it readshookshot-setup.txtand downloads ~460 MB of compiler and library parts (llvm-mingw, Python,a64emit,lld-link,zbic) from GitHub’sbuilder-partsrelease into%LOCALAPPDATA%\HookshotBuilder. An unsigned executable downloading archives over HTTPS closely resembles generic “downloader” heuristics. - Local C compilation producing a brand-new
.exe: During the ~40-minute build, Hookshot translates ARM64 game code into C (nx2/lift.py) and spawns parallelclangandlld-linkprocesses to emitbin\hookshot.exeand copySDL3.dll. Behavioral antivirus shields often flag or quarantine unsigned executables created on the fly; if an antivirus deletes part of the compiler, Hookshot Builder names the issue and provides a Repair button to fetch and verify the missing tool again. - Upstream checksums & security hardening: Every part fetched by
HookshotBuilder.exeis verified against its expected SHA-256 digest inhookshot-setup.txtbefore extraction, andv2.0.12added two rounds of host/guest boundary and download validation hardening (#1398, #1422) plus strict HTTPS-only updater transport (#1470).
Verify Hookshot SHA-256
Before bypassing any SmartScreen prompt, confirm that your file came unmodified from github.com/NotRexed/Hookshot/releases. Drop HookshotBuilder.exe or Hookshot-v2.1.0-x86_64.AppImage below: your browser computes its SHA-256 locally via the WebCrypto API (nothing is uploaded) and compares it against all 742 release digests tracked across the repositories.
Drop the .zip, .exe, .AppImage or .flatpak you downloaded. Your browser calculates its SHA-256 with WebCrypto and compares it with all 742 files published in the three projects’ GitHub releases. The file never leaves your computer.
Windows: certutil -hashfile FILE SHA256 · Linux: sha256sum FILE · macOS: shasum -a 256 FILE
Exact files, byte counts and SHA-256 digests recorded by GitHub for Hookshot v2.1.0 (published November 11, 2026, 02:29 UTC):
| File | Platform | Size | Bytes | SHA-256 | GitHub |
|---|---|---|---|---|---|
hookshot-linux.txt | Checksum list | 1 KB | 1,376 | 584b7f82ad8bde7161b7090f7a87aaf23dd6ed8b95917b9a751059cc1133fc51 | Download |
hookshot-setup.txt | Checksum list | 2 KB | 1,658 | 21a0263b44443ebeff7768bbc4b720709c3245f7340a579dc85bd219cce0df74 | Download |
Hookshot-v2.1.0-Windows-x64.zip | Windows x64 | 115 KB | 115,338 | fdfa49be0d7ead29398ef08c4f489ca79215dbf51f90d7b7c179f8cf02b12bcd | Download |
Hookshot-v2.1.0-x86_64.AppImage | Linux x86_64 | 242.1 MB | 242,149,880 | c0b2e958ae00dc560072154f890b9be422724abd9bb522d6afd9922788b86e02 | Download |
Hookshot-v2.1.0-x86_64.AppImage.zsync | Updater delta | 414 KB | 414,067 | 9ba1c55ee159199a0d32d4cf13514faf2f155dd92db4e5ece91edf52ef7c5170 | Download |
HookshotBuilder.exe | Windows x64 | 186 KB | 185,856 | 552a24c4c210a87dd3d6494a88a1a707cbedf6e50ddd2604caa5719c5c63a05e | Download |
SHA256SUMS | 556 bytes | 556 | 0c87b2f94630ead026515670f8e873ede1e0a33eb07e06cb59a78e7db18eeeb0 | Download |
For normal installs, Windows users only need HookshotBuilder.exe and Linux / Steam Deck users only need Hookshot-v2.1.0-x86_64.AppImage. The hookshot-setup.txt, hookshot-linux.txt, .zsync and Windows-x64.zip files are manifest/updater assets read automatically during updates.
Command-line SHA-256 verification
You can also verify the exact cryptographic digest using built-in OS tools or the GitHub CLI without opening a browser:
- Windows Command Prompt:
CertUtil -hashfile HookshotBuilder.exe SHA256 - Windows PowerShell:
Get-FileHash .\HookshotBuilder.exe -Algorithm SHA256 - Linux & SteamOS terminal:
sha256sum Hookshot-v2.1.0-x86_64.AppImage - macOS terminal:
shasum -a 256 HookshotBuilder.exe - GitHub CLI build provenance attestation:
gh attestation verify HookshotBuilder.exe -R NotRexed/Hookshot
Compare the 64-character hex result against 552a24c4c210a87dd3d6494a88a1a707cbedf6e50ddd2604caa5719c5c63a05e (for v2.1.0 HookshotBuilder.exe, 185,856 bytes). Only choose SmartScreen’s More info → Run anyway when both the byte size and SHA-256 match.
Fake sites and malware red flags
Popular recompilation projects routinely attract search-ad clones and counterfeit download pages. Delete a file immediately if you spot any of these warning signs:
- Any host other than GitHub Releases: Hookshot distributes builds exclusively at
github.com/NotRexed/Hookshot/releases. There is no separate Hookshot download domain, Discord DM hotfix binary, or Mega/MediaFire mirror. - Password-protected
.raror.7zarchives: Malware distributors wrap fake builders inside encrypted archives (with passwords like1234orzelda) specifically so browser and OS scanners cannot inspect the payload. Real Hookshot releases attach bareHookshotBuilder.exeand.AppImagefiles. - “Pre-built”
hookshot.exeor bundled game packs: A legitimate release never containshookshot.exeready to play, game data, firmware, or keys. - Android APKs, iOS profiles, or survey gates: Hookshot runs only on 64-bit Windows 10/11 and x86_64 Linux (Steam Deck guide). Mobile ports under the Hookshot name do not exist (3DS owners looking for Android builds should check Ocarina ReTuned instead).
Game files and legal compliance
Bring your own legally obtained game files. Neither NotRexed/Hookshot nor ocarinarecomp.wiki hosts or distributes game ROMs, .nup packages, romfs/exefs folders, console keys, firmware, or compiled game executables, and this site provides zero instructions or links for dumping or obtaining them.
Users supply their own legally obtained Nintendo Switch 2 edition copy of Ocarina of Time (program 0400486024DEC000, update v131072, build e0f3ccfa). Everything HookshotBuilder.exe creates on your machine (bin\hookshot.exe, translated C code, shader caches, and optional DLSS/FSR SDK libraries) is derived from your copy for personal local play and must never be shared. Ready to build? Follow the Hookshot setup guide, compare Hookshot vs NX2navi, or check all five projects on the downloads page.
Recommended controllers for PC & Deck
All four Ocarina of Time PC ports use SDL3/SDL2 controller input. A gamepad with 6-axis gyro or drift-free TMR sticks gives the best experience for bow/slingshot aiming, Ocarina notes and Z-targeting:
| Controller | Best For | Why It Fits Ocarina on PC | Link |
|---|---|---|---|
| 8BitDo Ultimate 2 Bluetooth | Switch A/B/X/Y layout + charging dock | Matches Nintendo C-button / action layout, TMR sticks, Bluetooth & 2.4 GHz | View on Amazon → |
| Sony DualSense | Bow & slingshot gyro aiming | Native SDL3 6-axis gyro + rumble on Windows & Linux (Hookshot & ReTuned) | View on Amazon → |
| GameSir Cyclone 2 | Zero-drift 60+ fps PC play | TMR electromagnetic sticks, Hall triggers, 1000 Hz wireless dongle + gyro | View on Amazon → |
| Xbox Wireless Controller | Plug-and-play Windows XInput | Works immediately in Ocarina Recomp, Hookshot (`bin\SDL3.dll`) & TriAevum | View on Amazon → |
As an Amazon Associate, this site earns from qualifying purchases. Full button mappings and dead-zone tips: Controller setup guide.
Frequently asked questions
Is HookshotBuilder.exe a virus or Trojan?
No, provided you downloaded it from github.com/NotRexed/Hookshot/releases and its SHA-256 matches the release digest (552a24c4c210a87d… for v2.1.0). Hookshot is open-source software under GPL-3.0-or-later, and its source code is public on GitHub. Antivirus alerts are false-positive heuristic detections triggered because the ~186 KB executable is unsigned, downloads a ~460 MB compiler toolchain, and compiles a new local bin\hookshot.exe binary.
Why is HookshotBuilder.exe only around 180 KB?
Starting with the new-installer release, Hookshot replaced its monolithic ZIP archive with a small bootstrapper (currently 185,856 bytes in v2.1.0). When launched, HookshotBuilder.exe reads hookshot-setup.txt, downloads the compiler and helper archives (~460 MB once, hosted in the repository’s builder-parts release), verifies every part’s SHA-256 checksum before unpacking to %LOCALAPPDATA%\HookshotBuilder, and reuses unchanged parts on future updates.
How do I verify HookshotBuilder.exe before clicking Run anyway in SmartScreen?
Drop HookshotBuilder.exe into the WebCrypto SHA-256 checker on this page (your file stays inside your browser and is never uploaded), or run CertUtil -hashfile HookshotBuilder.exe SHA256 in Windows Command Prompt (Get-FileHash .\HookshotBuilder.exe -Algorithm SHA256 in PowerShell). If the 64-character hex output matches the SHA-256 table below, the binary is byte-for-byte identical to the GitHub release.
Why did my antivirus delete clang or cause a missing tools error mid-build?
Real-time antivirus shields sometimes quarantine llvm-mingw compiler binaries or newly compiled object files when dozens of parallel clang workers run at once. Earlier builds misreported that removal as “Windows SDK was not found”; current builders detect missing toolchain files directly and show a Repair button that re-downloads and re-verifies the quarantined component.
Where does Hookshot write files on Windows and Linux, and how do I remove it?
Hookshot never modifies your input game file and installs no kernel drivers or background services. On Windows it writes only to the game folder you pick (default Games\Hookshot in your user profile) and %LOCALAPPDATA%\HookshotBuilder; since v2.0.8, ~4–6 GB of temporary build files are cleaned up automatically once compilation finishes. On Linux it uses your chosen game folder, ~/.cache/hookshot-builder, and ~/.local/share/hookshot. Deleting those folders removes it completely.
Are repacked RAR archives or “pre-built” hookshot.exe downloads safe?
No. Genuine Hookshot releases are published only at github.com/NotRexed/Hookshot/releases as bare HookshotBuilder.exe and Hookshot-*-x86_64.AppImage files. Never run password-protected .rar or .7z archives (passwords hide malware from scanners) or any “ready-to-play” archive claiming to bundle hookshot.exe with game files or keys.