Hi! I always wanted to know what’s inside of a malicious script with a require, is there any way to decode it? Same goes to loadstrings.
I mean something like this
require(356236236236236)
not something like this
require(game.ReplicatedStorage.ModuleScript)
Thank you!
Maybe use the ID in google with the Roblox Key to find the modulescript in the inventory of the creator? This only works if the creator allow strangers to see its inventory. If the creator has some malicious scripts, then i’m in doubt about it. Else you can import the ModuleScript using this little Code here:
--Using Luau
local ID:number = YourId
local URL:string = "rbxassetid://"..ID
local MaliciousScript = game:GetObjects(URL)[1]
Source:
https://developer.roblox.com/en-us/api-reference/function/DataModel/GetObjects
This is for ModuleScripts, for the loadstrings function you need to look the function self, you can TRY to use breakpoints if the loadstrings argumeter is stored in a variable, else idk.
Hope this helps
One question. What do you mean with “Using Luau”? Is that the new thing that Roblox has invented for the type-checking thing?
Luau is how the Lua is really named in Roblox. By the way, what are your plans, download a private module?
No.
I just wanted to know what some malicious requires do, like do they have a while true do loop inside of them that crashes the game, …
I mean, is it possible to check for that? I have never tried that. I think plugins’ code are privates.
Google is a wonderfull machine, luaau is a superset of lua, used by roblox.
https://roblox.github.io/luau/syntax.html
I think there is a way to get the plugin’s code (I’ve read a thread about it) but I don’t really know how, anymore.
Can someone try this code and see if the Module gets downloaded please. I am starting to worry about something.
local MaliciousScript = game:GetObjects("rbxassetid://4561958673")[1]
MaliciousScript.Parent = workspace
Tell me if the module got download it with the code in it please.
Doesn’t work. Error: 20:22:04.114 - HTTP 409 (Conflict)
I have HTTPService enabled in the settings, don’t worry.
Thank you for letting me know if it worked, by the way: You can actually download a plugin, this is ridiculous…
Yeah, I agree. I think you should at least have the access in case you can download your plugin or not. Otherwise there are cost plugins that could be robbed in 3 seconds.
