Any scripter here able to solve this, Strange Code?

Help and Feedback Scripting Support
#1

So recently most of my/friends animation got leaked from games that I contributed to

And I found a game using some kinda free model with using, obfuscated script, if you could help me to solve behind this stealer, it would be really mean soo much to us

Here’s the file code, that got obfuscated:
decrypted.lua (46.9 KB)

Ikr it’s feldtzgril, but if you scroll to the bottom you will find the Obfuscated code, that might be where the Real owner hiding the Api.

If y need anymore info for further investigation, let me know :+1:

Here’s the full obfuscated code, if y don’t wanna to look into the script:

return v15("LOL!173Q00028Q00026Q00084003073Q004368616E67656403073Q00436F2Q6E656374034Q00026Q00F03F030C3Q0057616974466F724368696C6403083Q0048756D616E6F6964027Q004003043Q0067616D6503073Q00506C6179657273030B3Q004C6F63616C506C6179657203093Q00436861726163746572030E3Q00436861726163746572412Q64656403043Q005761697403063Q00736372697074030A3Q00416E696D6174696F6E73030B3Q004765744368696C6472656E030A3Q00416E696D42752Q746F6E03063Q00506172656E7403063Q0053656172636803053Q007461626C6503043Q00736F7274005E3Q00120A3Q00014Q0014000100083Q0026323Q0013000100020004293Q0013000100060500083Q000100042Q001C3Q00014Q001C3Q00064Q001C3Q00024Q001C3Q00073Q00202100090003000300200E000900090004000605000B0001000100022Q001C3Q00084Q001C3Q00034Q00260009000B00014Q000900083Q00122Q000A00056Q00090002000100044Q005C00010026323Q002C000100060004293Q002C000100120A000900013Q0026320009001E000100060004293Q001E000100200E000A00050007001224000C00086Q000A000C00024Q0006000A3Q00124Q00093Q00044Q002C000100263200090016000100010004293Q0016000100122E000A000A3Q002021000A000A000B0020210004000A000C002021000A0004000D0006090005002A0001000A0004293Q002A0001002021000A0004000E00200E000A000A000F2Q0033000A000200022Q001C0005000A3Q00120A000900063Q0004293Q001600010026323Q0049000100010004293Q0049000100120A000900013Q000E030001003E000100090004293Q003E000100122E000A00103Q002008000A000A000700122Q000C00116Q000A000C000200202Q000A000A00124Q000A000200024Q0001000A3Q00122Q000A00103Q00202Q000A000A000700122Q000C00136Q000A000C00022Q001C0002000A3Q00120A000900063Q0026320009002F000100060004293Q002F000100122E000A00103Q00202F000A000A001400202Q000A000A000700122Q000C00156Q000A000C00024Q0003000A3Q00124Q00063Q00044Q004900010004293Q002F00010026323Q0002000100090004293Q0002000100120A000900013Q00263200090051000100060004293Q005100012Q0014000800083Q00120A3Q00023Q0004293Q000200010026320009004C000100010004293Q004C00012Q0014000700073Q00122E000A00163Q002021000A000A00172Q001C000B00013Q00022A000C00024Q0001000A000C000100120A000900063Q0004293Q004C00010004293Q000200012Q00128Q00233Q00013Q00033Q001C3Q00028Q0003053Q00706169727303063Q0073637269707403063Q00506172656E7403103Q00416E696D6174696F6E735363726F2Q6C030B3Q004765744368696C6472656E2Q033Q00497341030A3Q005465787442752Q746F6E03073Q0044657374726F7903093Q00416E696D6174696F6E03043Q004E616D6503053Q006C6F77657203043Q0066696E6403053Q007063612Q6C03063Q004C2Q6F7065642Q0103083Q005072696F7269747903043Q00456E756D03113Q00416E696D6174696F6E5072696F7269747903063Q00416374696F6E026Q00F03F03053Q00436C6F6E6503043Q0054657874027Q004003113Q004D6F75736542752Q746F6E31436C69636B03073Q00436F2Q6E65637403053Q007072696E7403193Q00452Q726F72206C6F6164696E6720616E696D6174696F6E3A2001693Q00120A000100014Q0014000200023Q00263200010002000100010004293Q0002000100120A000200013Q00263200020005000100010004293Q0005000100122E000300023Q001228000400033Q00202Q00040004000400202Q00040004000500202Q0004000400064Q000400056Q00033Q000500044Q0016000100200E00080007000700120A000A00084Q00250008000A00020006100008001600013Q0004293Q0016000100200E0008000700092Q00180008000200010006070003000F000100020004293Q000F000100122E000300024Q001F00046Q00270003000200050004293Q0062000100200E00080007000700120A000A000A4Q00250008000A00020006100008006100013Q0004293Q0061000100202100080007000B00201600080008000C4Q00080002000200202Q00080008000D00202Q000A3Q000C4Q000A000B6Q00083Q000200062Q0008006100013Q0004293Q0061000100120A000800014Q00140009000A3Q0026320008002C000100010004293Q002C000100122E000B000E3Q000605000C3Q000100022Q001F3Q00014Q001C3Q00074Q0027000B0002000C2Q001C000A000C4Q001C0009000B3Q0006100009005900013Q0004293Q0059000100120A000B00014Q0014000C000C3Q002632000B0041000100010004293Q00410001003004000A000F0010001213000D00123Q00202Q000D000D001300202Q000D000D001400102Q000A0011000D00122Q000B00153Q002632000B004A000100150004293Q004A00012Q001F000D00023Q00201D000D000D00164Q000D000200024Q000C000D3Q00202Q000D0007000B00102Q000C0017000D00122Q000B00183Q002632000B0039000100180004293Q0039000100122E000D00033Q00201A000D000D000400202Q000D000D000500102Q000C0004000D00202Q000D000C001900202Q000D000D001A000605000F0001000100022Q001F3Q00034Q001C3Q000A4Q0001000D000F00010004293Q006000010004293Q003900010004293Q0060000100122E000B001B3Q00120B000C001C3Q00202Q000D0007000B4Q000C000C000D4Q000B0002000100044Q006000010004293Q002C00012Q001200086Q001200065Q0006070003001C000100020004293Q001C00010004293Q006800010004293Q000500010004293Q006800010004293Q000200012Q00233Q00013Q00023Q00013Q00030D3Q004C6F6164416E696D6174696F6E00064Q00157Q00206Q00014Q000200018Q00029Q008Q00017Q00043Q00028Q0003043Q0053746F70026Q00F03F03043Q00506C617900354Q001F8Q001F000100013Q0006113Q0020000100010004293Q0020000100120A3Q00013Q0026323Q0018000100010004293Q0018000100120A000100013Q00263200010013000100010004293Q001300012Q001F00025Q0006100002001000013Q0004293Q001000012Q001F00025Q00200E0002000200022Q00180002000200012Q001F000200014Q001B00025Q00120A000100033Q00263200010008000100030004293Q0008000100120A3Q00033Q0004293Q001800010004293Q000800010026323Q0005000100030004293Q000500012Q001F00015Q00200E0001000100042Q00180001000200010004293Q003400010004293Q000500010004293Q003400012Q001F8Q001F000100013Q0006313Q0034000100010004293Q0034000100120A3Q00014Q0014000100013Q0026323Q0026000100010004293Q0026000100120A000100013Q00263200010029000100010004293Q002900012Q001F00025Q00200D0002000200024Q0002000200014Q000200026Q00025Q00044Q003400010004293Q002900010004293Q003400010004293Q002600012Q00233Q00017Q00013Q0003043Q005465787400054Q00069Q00000100013Q00202Q0001000100016Q000200016Q00017Q00053Q00028Q002Q033Q0049734103093Q00416E696D6174696F6E03043Q004E616D6503053Q006C6F77657202223Q00120A000200014Q0014000300033Q00263200020002000100010004293Q0002000100120A000300013Q00263200030005000100010004293Q0005000100200E00043Q000200120A000600034Q00250004000600020006100004001C00013Q0004293Q001C000100200E00040001000200120A000600034Q00250004000600020006100004001C00013Q0004293Q001C000100202100043Q00040020170004000400054Q00040002000200202Q00050001000400202Q0005000500054Q00050002000200062Q0004001A000100050004293Q001A00012Q001E00048Q000400014Q002C000400026Q00046Q002C000400023Q0004293Q000500010004293Q002100010004293Q000200012Q00233Q00017Q00",v9(),...)
3 Likes
#2

ok so basically this is rpobably like a virus nad it probably mines bitcoin pls delete that lololololololololololololololol

#3

I believe it’s not a bitcoin virus, other dev tought me that it’s some kinda lua script and need some deobfuscate to lua to be able to read it

1 Like
#4

either way nobody encodes their code like this, this is just something designed to harm

#5

your ip got leaked lolol but what even is this bro💔

#6

Please remain a little professional, even if optional.

I suggest read the post again, I’m not really educated on “obfuscation”. But I believe OP wants to deobfuscate the code to solve the stealing assets problem.

1 Like
#7

Heres the Full free model, incase anyone needed it for future Investigation!

(beware it could lead to anything)
AnimationGUI.rbxm (33.3 KB)

#8

Don’t share that… :person_facepalming:

It’s a virus script that loads an external ModuleScript and does whatever the creator of the virus wants it to. You should always assume obfuscated code is malicious until you can prove otherwise. And no, we cannot deobfuscate it.

1 Like
#9

Hi! I dumped all the constants in the obfuscated script, so far i see no malicious code (no external asset fetching/remote event creation/fetching of any sort).

After some analysis, it just looks like they stole your script aswell, and then obfuscated it to try and hide the fact they took your script. But good job on identifying that, as it is very common for obfuscated scripts to contain malicious code.

But just because this one might not be malicious does not mean it should be used, as its too hard to make changes to and interact with, and its still always possible.

But anyways, here are the constants of the obfuscated script:

{D92CF134-A419-409F-9114-5E2F4110881A}
{D92CF134-A419-409F-9114-5E2F4110881A}523×939 64.3 KB

3 Likes
#10

Here is an attempt at reverse engineering the code provided. The provided code will most likely not be the same as the original:

local script = game.Players.LocalPlayer.Character:WaitForChild("Humanoid")

-- Wait for the character to load
if not game.Players.LocalPlayer.Character then
    game.Players.LocalPlayer.CharacterAdded:Wait()
end

-- Setup animation handling
local function LoadAnimation(animation)
    local success, err = pcall(function()
        -- Get the animations scroll UI element
        local animationsScroll = script.Parent:FindFirstChild("AnimationsScroll")
        
        -- Process animation buttons
        for _, button in pairs(animationsScroll:GetChildren()) do
            if button:IsA("TextButton") then
                button:Destroy()
            end
        end
        
        -- Clone and set up animation buttons
        for _, anim in pairs(animation:GetChildren()) do
            if anim:IsA("Animation") then
                local animName = anim.Name:lower()
                
                -- Create a new button for the animation
                local clone = script.Parent.TextButton:Clone()
                clone.Parent = animationsScroll
                clone.Text = anim.Name
                clone.Visible = true
                
                -- Connect the click event to play the animation
                clone.MouseButton1Click:Connect(function()
                    local humanoid = game.Players.LocalPlayer.Character:FindFirstChild("Humanoid")
                    if humanoid then
                        local loadedAnim = humanoid:LoadAnimation(anim)
                        loadedAnim.Priority = Enum.AnimationPriority.Action
                        loadedAnim:Play()
                    end
                end)
            end
        end
    end)
    
    -- Error handling
    if not success then
        print("Error loading animation: " .. err)
    end
end

-- Animation control functions
local function Stop()
    local humanoid = game.Players.LocalPlayer.Character:FindFirstChild("Humanoid")
    if humanoid then
        humanoid:Stop()
    end
end

local function Play(animation)
    local humanoid = game.Players.LocalPlayer.Character:FindFirstChild("Humanoid")
    if humanoid then
        local loadedAnim = humanoid:LoadAnimation(animation)
        loadedAnim:Play()
    end
end

-- Initialize the animations when the script runs
wait(1) -- Wait for everything to load
LoadAnimation(script.Parent.Animations)
1 Like