Detection of Neverfall Executor [PATCHED]

Resources Community Resources
, , ,
1

Hello, everyone!!!

I am providing a method for detecting Neverfall executor, a new Executor that is also paid. It collects a lot of data about the user that should not be collected. I think everyone understands why and for what purpose :slight_smile:

One way or another, people pay money for this Executor to be detected using crooked hooks :skull:

local f=table.clone
local normal={
	linedefined=-1,
	source="[C]", -- When injected, [C] becomes without brackets or without various symbols, what a shame...
	what="C",
	nparams=0,
	isvararg=true,
	func=tostring(f),
	name="clone"
}
local function gi(fn)
	local s=select(1,debug.info(fn,"s"))
	local n=select(1,debug.info(fn,"n"))
	local l=select(1,debug.info(fn,"l"))
	local p,v,u=debug.info(fn,"a")
	return {
		source=s,
		name=n,
		linedefined=l,
		nparams=p,
		isvararg=v,
		what=(s=="[C]" and "C" or s),
		func=tostring(fn)
	}
end

while true do
	task.wait(0.1)
	local cur=gi(f)
	for k,v in pairs(normal) do
		if tostring(cur[k])~=tostring(v) then
			game.Players.LocalPlayer:Kick("😭😭😭")
		end
	end
end

You can perform a simple debug.getinfo check on Info in general, but for the sake of clarity, I only used table.clear().

16 Likes
2

shouldn’t this only trigger in the case of an env leak?

3

Probably not. When Neverfall injected, something very interesting happens: absolutely all native existing global functions in ROBLOX become without brackets [C], and these are their crooked hooks. I also assume that their original source was not created by them, but from the open version of SWHE for their injection, so somehow, one way or another, it is still not fixed, even though they promise a global patch for September.