Detecting for stuff such as number * 1, number + 0 in patterns

Help and Feedback Scripting Support
#1
repost since the other one didnt get any replys

So I’m making an antivirus plugin, and I want it to not search for when the code is requiring a modulescript. It’s working all fine, also the way I’m doing this is string.match and patterns.

But the only issue is that people can do id+0 , id-0 , id*1 , id+1-1 and more.
How would I fix this?

(sorry for not too much detail)

#2

Can anybody help me with this?

#3

Hi there! To be honest, I don’t understand the problem at all without details.

1 Like
#4

Try this

local nums = "1+2/45+2"

if nums:match("[%d*/+-]+") then
    print('matched')
end
1 Like
#5

They never said they were looking for viruses …?

#6

Ah sorry I was just assuming that they were, anyway. My solution would still work you just need to remove the require part

#7

To be honest I don’t understand the problem at all, so you may be right! :grinning_face_with_smiling_eyes:

#8

Bothering with this is useless. You could just do something like:
local x = numbers
require(x)

local byte = string.byte(number)
require(string.char(byte))

local print = require
print(numbers)

Or even yet, use getfenv or the like to make it even more dynamic and unpredictable.

3 Likes
#9

Good point. But like said above, not sure that that’s what he’s even trying to do.

#10

Let me try to explain it more clearly:

I’m creating an antivirus plugin. And I only want it to search for viruses that are passing a number with require, so far it’s working completely fine.

The only issue is that it can easily be bypassed by using this:

id-0,
id*1,
id-0+0,
id/1
#11

Oh, I get it now! My bad. :sweat_smile:

#12

I’ve already listed getfenv, but thanks for the suggestions.

#13

Also, alot of virus scripts are obfuscated. So unless you constant dump them, doing any string matching would be useless.

Edit: Well, I guess you could just check if the script is obfuscated and if so, just delete it.

#14

On the toolbox there are some models that have pretty simple code like:
*insert random spaces here * pcall(function() require(id) end)

Well most of them are like that for some reason.

#15

In that case, my reply with code above should work.

#16

It’d probably be best to create a sandboxed environment with a custom require function.
If you want to be lazy, you could just add something like to the top of the code

require = function() end

or like

allowedRequires = {
  [123] = true,
  [0xc0ff3bad] = true,
  [789] = true
}

realRequire = require

require = function(id)
  if allowedRequires[id] then
    return realRequire(id)
  end
end

-- code continues...

There might be ways around this though, so running your code in a properly sandboxed environment would probably be best

#17

Might try that out later.

Pretty off topic question, but what is that?

#18

Glad you asked.
It’s my easy-to-load, simple, and non-malicious admin system.