Run it
Copy the script and paste it into your executor.
CFG = {
MAX_DEPTH = ,
VERIFY = ,
RF_TIMEOUT = ,
VERIFY_RF = ,
VERIFY_RF_MAX = ,
VERIFY_RV_PAIR = ,
SAMPLE_VALUES = ,
SAMPLE_INTERVAL = ,
SAMPLE_COUNT = ,
SAMPLE_SERVICES = {, },
}
OUTPUT = {}
REGISTRY = {}
VALUE_TARGETS = {}
VULN_GROUPS = {
WRITABLE_VALUE = {label=, items={}, detail=, threshold=},
CALLABLE_RF = {label=, items={}, detail=, threshold=},
API_SURFACE = {label=, items={}, detail=, threshold=},
NAKED_REMOTE = {label=, items={}, detail=, threshold=},
REMOTE_VALUE_PAIR = {label=, items={}, detail=, threshold=},
READABLE_MODULE = {label=, items={}, detail=, threshold=},
ANTICHEAT = {label=, items={}, detail=, threshold=},
SURFACE_SUMMARY = {label=, items={}, detail=, threshold=},
}
VULN_ORDER = {
,,,
,,
,,,
}
SERVICES = {
,,,,
,,,
,,,,,,
}
(s)
n, i = ,
i <= #s
b = s:(i)
b >= i = i +
b >= i = i +
b >= i = i +
i = i +
n = n +
n
B =
() ..string.(,B)..
() ..string.(,B)..
() ..string.(,B)..
(text)
s = ..(text )
pad = .(, B - (s))
..s..string.(,pad)..
() ..string.(,B)..
(line) .(OUTPUT, line )
()
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
(())
()
(obj)
parts = {}
cls = obj.ClassName
cls == .(parts, )
cls == .(parts, )
cls == .(parts, )
cls == .(parts, )
obj:() obj:() obj:()
.(parts, cls)
obj:()
p = obj.Position
.(parts, .(, p.X, p.Y, p.Z))
obj:() obj:()
obj:() obj:()
ok, v = (() obj.Value )
ok
vs = (v)
#vs > vs = vs:(,)..
.(parts, ..vs)
obj:()
pp = obj.PrimaryPart
.(parts, ..(pp pp.Name ))
#parts ==
..table.(parts, )..
(obj, attrPfx)
ok, attrs = (() obj:() )
ok
list = {}
k, v (attrs) .(list, {k, v, (v)})
#list ==
.(list, (a,b) a[] < b[] )
_, t (list)
vs = (t[])
#vs > vs = vs:(,)..
(attrPfx....t[]....vs....t[]..)
BORING_VALUES = {
idle=,walk=,run=,jump=,climb=,
fall=,sit=,toolnone=,Weight=,
ScaleDampeningPercent=,AvatarPartScaleType=,
Animation1=,Animation2=,
}
(obj, depth, prefix, isLast, path, service)
depth > CFG.MAX_DEPTH
(prefix..)
connector = isLast
childPfx = prefix..(isLast )
attrPfx = prefix..(isLast )
fullPath = path....obj.Name
cls = obj.ClassName
(prefix..connector....cls....obj.Name..(obj))
lineIdx = #OUTPUT
CFG.SAMPLE_VALUES
svcSet = {}
_, s (CFG.SAMPLE_SERVICES) svcSet[s] =
svcSet[service]
(cls== cls==
cls== cls==)
BORING_VALUES[obj.Name]
obj.Parent
.(VALUE_TARGETS, {
lineIdx=lineIdx, obj=obj,
name=obj.Name, path=fullPath,
service=service, samples={},
})
(obj, attrPfx)
.(REGISTRY, {
name=obj.Name, class=cls, path=fullPath,
parent=path, service=service, depth=depth, obj=obj,
})
ok, children = (() obj:() )
ok
i, child (children)
(child, depth+, childPfx, i==#children, fullPath, service)
()
CFG.SAMPLE_VALUES #VALUE_TARGETS ==
(.(,
#VALUE_TARGETS, CFG.SAMPLE_COUNT, CFG.SAMPLE_INTERVAL))
i = , CFG.SAMPLE_COUNT
_, t (VALUE_TARGETS)
t.obj t.obj.Parent
ok, v = (() t.obj.Value )
ok .(t.samples, (v))
i < CFG.SAMPLE_COUNT
(.(, i, CFG.SAMPLE_COUNT))
.(CFG.SAMPLE_INTERVAL)
_, t (VALUE_TARGETS)
#t.samples >=
seen2, unique = {}, {}
_, s (t.samples)
seen2[s] seen2[s]=; .(unique,s)
first, last = t.samples[], t.samples[#t.samples]
tag =
#unique >
trend =
n1, n2 = (first), (last)
n1 n2
n2 > n1 trend =
n2 < n1 trend =
tag = .(, trend, first, last)
tag =
OUTPUT[t.lineIdx]
OUTPUT[t.lineIdx] = OUTPUT[t.lineIdx]..tag
(cls)
cls== cls== cls==
cls== cls==
cls== cls== cls==
(cls)
cls== cls==
cls== cls==
PLAYER_NAMES_CACHE =
()
PLAYER_NAMES_CACHE PLAYER_NAMES_CACHE
PLAYER_NAMES_CACHE = {}
ok, players = (()
:():()
)
ok
_, p (players) PLAYER_NAMES_CACHE[p.Name] =
PLAYER_NAMES_CACHE
(path, service)
service ~=
names = ()
root = path:()
root ~= names[root] ==
(a, b)
a = a:():(,)
b = b:():(,)
#a < #b <
a == b
a:(..b) b:(..a)
common =
i = , .(#a,#b)
a:(i,i) == b:(i,i)
common = common +
common >=
(groupId, item)
VULN_GROUPS[groupId]
.(VULN_GROUPS[groupId].items, item)
AC_NAME_PATTERNS = {
,,,,,
,,,,
,,,,
,,,
,,,,
,,,
,,,,
,,,
,,,,
,,,,
}
AC_CHILD_VALUE_PATTERNS = {
,,,,,,
,,,,,
,,,,
,,,,
,,,
}
AC_REMOTE_PATTERNS = {
,,,,,
,,,,
,,,
,,,,
,,,
,,,
}
AC_VALUE_PATTERNS = {
,,,,,
,,,,
,,,,,
,,,
}
AC_FOLDER_PATTERNS = {
,,,,,
,,,,
,,,
}
(name, patterns)
low = name:():(,)
_, p (patterns)
low == p low:(p, , ) , p
,
(rec, byParent)
name = rec.name
cls = rec.class
path = rec.path
svc = rec.service
cls== cls==
cls== cls== cls==
matched, pattern = (name, AC_NAME_PATTERNS)
matched
state =
rec.obj rec.obj.Parent
(cls== cls== cls==)
ok, dis = (() rec.obj.Disabled )
ok state = dis
(, {
subtype = ,
name=name, cls=cls, svc=svc, path=path,
detail = .(
,
pattern, state),
status=, note=
})
cls== cls== cls==
children = byParent[path] {}
acChildren = {}
_, child (children)
(child.class)
matched2, pattern2 = (child.name, AC_CHILD_VALUE_PATTERNS)
matched2
.(acChildren, child.name....pattern2..)
#acChildren >
(, {
subtype = ,
name=name, cls=cls, svc=svc, path=path,
detail = .(
,
.(acChildren, )),
status=,
note=
})
cls== cls== cls==
matched, pattern = (name, AC_REMOTE_PATTERNS)
matched
(, {
subtype = ,
name=name, cls=cls, svc=svc, path=path,
detail = .(, pattern),
status=,
note=
})
cls==
siblings = byParent[rec.parent] {}
remoteCount =
_, sib (siblings)
(sib.class)
remoteCount = remoteCount +
remoteCount == rec.depth >=
(, {
subtype = ,
name=name, cls=cls, svc=svc, path=path,
detail = ,
status=,
note=
})
(cls)
matched, pattern = (name, AC_VALUE_PATTERNS)
matched
ok, val = (() rec.obj.Value )
(, {
subtype = ,
name=name, cls=cls, svc=svc, path=path,
detail = .(
,
pattern, ok (val) ),
status=,
note=
})
cls== cls==
matched, pattern = (name, AC_FOLDER_PATTERNS)
matched
children = byParent[path] {}
scripts =
_, child (children)
child.class== child.class==
child.class==
scripts = scripts +
(, {
subtype = ,
name=name, cls=cls, svc=svc, path=path,
detail = .(
,
pattern, scripts),
status=,
note=
})
()
byParent = {}
stats = {re=, rf=, ls=, ss=, me=, ac=}
_, rec (REGISTRY)
byParent[rec.parent] byParent[rec.parent] = {}
.(byParent[rec.parent], rec)
seen = {}
(key)
seen[key]
seen[key] =
()
_, rec (REGISTRY)
cls = rec.class
svc = rec.service
path = rec.path
name = rec.name
obj = rec.obj
inChar = (path, svc)
(cls)
(svc== svc==)
rec.depth <=
inChar
obj obj.Parent
(..path)
(, {
name=name, cls=cls, path=path, obj=obj,
status=, note=
})
cls==
stats.rf = stats.rf +
(..path)
(, {
name=name, path=path, obj=obj,
status=, note=
})
(cls)
rec.depth ==
svc==
(..path)
(, {
name=name, cls=cls, path=path, obj=obj,
status=,
note=
})
cls==
svc==
rec.depth <=
(..path)
stats.me = stats.me +
(, {
name=name, path=path, obj=obj,
status=, note=
})
(..path)
(rec, byParent)
cls== stats.re = stats.re +
cls== stats.ss = stats.ss +
cls== stats.ls = stats.ls +
checkedFolders = {}
parentPath, children (byParent)
checkedFolders[parentPath]
checkedFolders[parentPath] =
inRS = parentPath:() ~=
inRS
total, remotes = #children,
names = {}
_, rec (children)
(rec.class)
remotes = remotes +
.(names, ..rec.class....rec.name)
remotes >= total > remotes/total >=
(..parentPath)
sample = .(names, )
(, {
path=parentPath, remotes=remotes, total=total,
sample=sample, status=,
note=
})
pairDone = {}
parentPath, children (byParent)
inRS = parentPath:() ~=
inRS
remotes, values = {}, {}
_, rec (children)
rec.class== rec.class==
.(remotes, rec)
(rec.class)
.(values, rec)
_, rem (remotes)
_, val (values)
key = rem.path....val.path
pairDone[key] (rem.name, val.name)
pairDone[key] =
(, {
path=parentPath,
remCls=rem.class, remName=rem.name, remObj=rem.obj,
valCls=val.class, valName=val.name, valObj=val.obj,
status=,
note=
})
ratio = stats.ss >
.(, stats.ls/stats.ss)
risk =
stats.re + stats.rf > risk =
stats.re + stats.rf > risk =
stats.me > risk =
acByType = {NAME=, CHILDREN=, REMOTE=, ISOLATED=, VALUE=, FOLDER=}
_, item (VULN_GROUPS[].items)
t = item.subtype:(,)
acByType[t] acByType[t] = acByType[t] +
(, {
path = ,
text = .(
..
..
..
..
..
..
..
..
..
..
..
..
..
..
,
stats.re, stats.rf, stats.me, stats.ls, stats.ss, ratio, risk,
acByType.NAME, acByType.CHILDREN, acByType.REMOTE,
acByType.ISOLATED, acByType.VALUE, acByType.FOLDER),
status=, note=
})
(rf, timeout)
done, callOk, result = , ,
.(()
callOk, result = (() rf:() )
done =
)
t =
done t < timeout .(); t = t +
done ,
callOk , (result ):(,)
()
total =
_, g (VULN_GROUPS) total = total + #g.items
(.(, total))
done =
rfCnt =
_, id (VULN_ORDER)
g = VULN_GROUPS[id]
g
_, item (g.items)
id ==
obj = item.obj
obj obj.Parent
ok, original = (() obj.Value )
ok
item.status =
item.note =
testVal
n = (original)
n
testVal = n +
(original) ==
testVal = original
testVal = (original)..
writeOk = (() obj.Value = testVal )
writeOk
item.status =
item.note =
.()
_, afterWait = (() obj.Value )
afterStr = (afterWait)
testStr = (testVal)
originStr = (original)
(() obj.Value = original )
afterStr == testStr
item.status =
item.note = .(
,
originStr, testStr)
afterStr == originStr
item.status =
item.note = .(
,
originStr, testStr, originStr)
item.status =
item.note = .(
,
originStr, testStr, afterStr)
item.status =
item.note =
id ==
obj = item.obj
obj obj.Parent
rfCnt >= CFG.VERIFY_RF_MAX
item.status =
item.note = ..CFG.VERIFY_RF_MAX..
CFG.VERIFY_RF
rfCnt = rfCnt +
state, res = (obj, CFG.RF_TIMEOUT)
state ==
item.status =
item.note = ..(res)
state ==
res:() res:()
res:() res:()
item.status =
item.note = ..res
res:() res:()
res:() res:()
item.status =
item.note = ..res
item.status =
item.note = ..res
item.status =
item.note = ..CFG.RF_TIMEOUT..
item.status =
item.note =
item.status =
item.note =
id ==
obj = item.obj
obj obj.Parent
done2, callOk2, result2 = , ,
.(()
callOk2, result2 = (, obj)
done2 =
)
t2 =
done2 t2 <
.(); t2 = t2 +
done2
item.status =
item.note =
callOk2
item.status =
item.note = ..(result2)
err = (result2 ):(,)
err:() err:()
item.status =
item.note = ..err
item.status =
item.note = ..err
item.status =
item.note =
id ==
CFG.VERIFY_RV_PAIR
remObj = item.remObj
valObj = item.valObj
remObj remObj.Parent valObj valObj.Parent
_, before = (() valObj.Value )
(()
remObj.ClassName ==
remObj:()
.(()
(() remObj:() )
)
)
.()
_, after = (() valObj.Value )
(after) ~= (before)
item.status =
item.note = .(,
(before):(,), (after):(,))
item.status =
item.note =
item.status =
item.note =
done = done +
done % ==
(.(, done, total))
(status)
status ==
status ==
status ==
()
sc = {CRITICAL=, LIKELY=, POSSIBLE=, []=}
total =
_, g (VULN_GROUPS)
_, item (g.items)
total = total +
sc[item.status] sc[item.status] = sc[item.status] +
()
(())
(())
((.(
,
sc.CRITICAL, sc.LIKELY, sc.POSSIBLE, sc[], total)))
(())
()
()
()
()
()
()
()
()
()
()
()
()
()
(.(, ))
()
_, id (VULN_ORDER)
g = VULN_GROUPS[id]
g
real, fp = {}, {}
_, item (g.items)
item.status ==
.(fp, item)
.(real, item)
(..g.label
....#real..
..(#fp > ..#fp.. )..)
#real ==
()
useDetail = g.detail (#real <= g.threshold)
useDetail
_, item (real)
()
id ==
(..(item.status)....item.path)
(.(,
item.remotes, item.total,
item.remotes/item.total*))
()
line (item.sample..):()
line ~= (..line)
id ==
(..(item.status)....item.path)
(..item.remCls....item.remName)
(..item.valCls....item.valName)
id ==
(..(item.status))
(item.text)
id ==
(..(item.status)
....item.subtype..
..item.name....item.cls..
....item.svc)
(..item.detail)
(..item.path)
(..(item.status)
....(item.name ))
(..item.path)
item.note item.note ~=
(..item.note)
order = {CRITICAL=, LIKELY=, POSSIBLE=}
.(real, (a,b)
(order[a.status] ) < (order[b.status] )
)
()
_, item (real)
tag = item.status==
item.status==
(.(,
tag, item.name , item.path))
item.note item.note ~=
(..item.note)
#fp >
()
(..#fp..)
_, item (fp)
(..(item.name )....item.path)
()
()
(())
((.(,
(.PlaceId), (.GameId))))
((..(.Name):(,)))
(())
()
_, svcName (SERVICES)
ok, svc = (() :(svcName) )
()
(..svcName)
()
ok svc
ok2, children = (() svc:() )
ok2
i, child (children)
(child, , , i==#children, svcName, svcName)
()
()
()
()
()
()
()
()
()
()
(.(, #OUTPUT, #REGISTRY))
content = ..table.(OUTPUT, )
saved =
writefile
fname = ..(.PlaceId)..
(()
(fname, content)
saved =
(..fname)
)
saved
setclipboard
(content)
()
i = , #content, (content:(i, i+))
(.(, #OUTPUT, #REGISTRY))its a simple script that saves the games full structure to a txt file and looks for possible vulnerabilities using a special algorithm. thats it. i think its useful if u an ai scripter