Here’s a technical write-up on sideloading in BoneLab, aimed at users familiar with VR modding or Quest advanced features.

Step 3: Extract and Install

1. Locate your downloaded mod file (usually in your Downloads folder).
2. Right-click the file and select Extract Here (using WinRAR/7Zip) or Extract Files.
3. You will typically get a .dll file or a folder.
4. Drag and drop the extracted file(s) directly into the Mods folder you found in Step 2.

2. Locate Your Mods Folder

Once MelonLoader is installed, navigate to your Bonelab installation directory. You will now see several new folders.

• Look for a folder named Mods. This is where .dll files (the actual code for mods) go.
• Look for a folder named UserData. Some mods may require configuration files to be placed here.

3. Version Control & Downgrading

Sometimes a Bonelab patch breaks your favorite mods. When you sideload, you can keep a local archive of mod versions that work. The in-game downloader always grabs the latest version (which might be broken).

Part 7: Is Sideloading Safe? (Risks & Best Practices)

Sideloading involves running unsigned code on your device. While the Bonelab community is generally safe, you must exercise caution.

• The Risk of Malware: On PCVR, a malicious .dll (code mod) could theoretically access your files. Never download from random Google Drive links. Stick to Thunderstore or Discord with verification roles.
• The Quest Ban Myth: Many users fear that sideloading mods will get their Meta account banned. False. Sideloading via SideQuest uses standard ADB (Android Debug Bridge). Meta allows this; they only ban for pirating paid games. However, cheating in online VR games using mods can lead to bans. Bonelab is single-player, so you are safe.
• Save Game Corruption: Always back up your save.sav file (located in AppData/LocalLow/Stress Level Zero/BONELAB on PC) before installing massive scripted mods.

7. Forensic Detection (for developers or anti-cheat)

To detect sideloaded mods:

1. Check file hashes of all .marrowmod files against mod.io’s manifest.
2. Enumerate files in Mods/ – any file not listed in the game’s internal mod_manifest.json is sideloaded.
3. Monitor code patches – mods that inject into libil2cpp.so can be detected via integrity checks.