Hiya,
I recently was looking through some free models and found this backdoor in it that I cannot seem to crack. It has a bunch of random game ids and some other stuff.
I just need help with the last part where it says ‘string.unpack’. I can’t seem to find that function in the docs too.
Original Script: MainModule(original).lua (447 Bytes)
Script with removed bytecode: MainModule(bytecode_removed).lua (377 Bytes)
unpack is used to pass multiple arguments to a single function from a table.
local tb = {"Hello", "World","and","UltraBloxer108"}
print(unpack(tb)) -- prints "Hello", "World", "and", "UltraBloxer108
more generically it actually just passes each element of the table to whatever you’re unpacking to.
so something like this:
local tb = {1,2,3,4}
local a,b,c = unpack(tb)
print(a) -- prints "1"
print(b) -- prints "2"
print(c) -- prints "3"
-- the 4 isn't assigned to anything here, so it's just ignored."̶s̶t̶r̶i̶n̶g̶.̶u̶n̶p̶a̶c̶k̶"̶ ̶c̶a̶n̶ ̶b̶e̶ ̶f̶o̶u̶n̶d̶ ̶h̶e̶r̶e̶:̶ https://developer.roblox.com/en-us/api-reference/lua-docs/string
Although, it works the same way as tables: https://developer.roblox.com/en-us/api-reference/lua-docs/table
From the research I’ve done, all this script does is give people a protest sign if they purchase a gamepass (the sign). I’m not really sure what you are trying to get from that free model script but I recommend just deleting that whole section.
The link you supplied has no mention of “string.unpack”
In fact the word “unpack” doesn’t appear on the page a single time.
Edit: I should add that string.unpack does what I mentioned of unpack above but for specially formatted strings that are created using string.pack.
More information can be found here: Lua 5.3 Reference Manual
And here: Lua 5.3 Reference Manual
Your removed bytecode simplifies to this code:
-- Do not run
require(tonumber(string.char(unpack({52,57,57,53,57,55,56,55,49,57}))))
Printing the result of string.char(unpack({52,57,57,53,57,55,56,55,49,57})) output 4995978719, which led me to a module. The owner of the module has others in their inventory.
A script under the module redirected me to this model, which seems to spam purchase prompts to everyone except the owner of the game. I see this too often in games using free models.
This is malicious code, and it would be wise to use the report abuse feature if and when you come across scripts like this.
Oh, that’s my bad, I think I was looking at the wrong thing (tables), but it works the same way as you mentioned.