GameTree - Malicious script/backdoor scanning tool

Resources Community Resources
#1

Hello Roblox developers! Due to a lot of posts relating to backdoors I’ve created a tool to scan for these backdoors. It offers a few “detections” which may be useful when looking for backdoors or malicious scripts. Here is a list of configurable detections:

local detectRequiresNonNumeric = false -- Should non-numeric required be detected?
local detectIsStudio = true -- Should IsStudio calls be detected?
local detectLoadstring = false -- Should loadstring references be detected?
local detectStoreRequire = true -- Should storing require in a variable be detected?

Other detections include numeric requires, fenv usage (especially useful for finding obfuscated code!), and HttpService usage.

This script by default does not scan ModuleScripts (it also does not scan CoreScripts but these are not usable by developers and also cannot be scanned), but there is an option to scan these.

You can find this script here: GitHub - Hexcede/GameTree: A Roblox instance & script scanning tool
To use it, simply configure it in a text editor and paste it into the command bar.

Any detected scripts will be displayed as a path starting with the script’s name. Each segment in the path contains the Instance name and the ClassName. Warnings are displayed below scripts preceded by a tab and [!].

I hope that developers will find this useful.

16 Likes
HELP Exploiters targeting my new game
There seems to be a backdoor in my studio
Clearing your game of malicious scripts, plugins, and backdoors
[Urgent] Memory leak coming from nowhere?
Stop local character manipulation
#2

What’s this?

Have it scan for all require, getfenv, setfenv words in scripts, because scripts can be sneaky. For example, would your scanner detect this?

local a = require
local b = script.Thing.Value
a(b)
#3

It will detect that under detectStoreRequire, but numeric requires won’t be detected this way. It also does not detect getfenv/setfenv this way since getfenv/setfenv are globally detected (any references to them will be detected). Numeric requires, when detected, will also supply the detected id. Non-numeric requires will not do this currently.

1 Like