|
So I made a source protector that protects all the scripts in your place.
You just need to copy/paste the source of all your scripts in the script (following a format that is described in the script). I will later add support for an ObjectValue and StringValue system so it doesn't fill up the script with the source of all the scripts in your place.
You also need to edit the source of all your scripts to change it to something like this:
wait(1)
_G.RunScript()
SCP (Source Code Protector) will then detect what script called it and will execute the source of that script.
I need some reviews and suggestions so I can release it after, perhaps, doing some edits.
The source code is available at:
Pastebin: fmU5K6in |
|
|
Added fancy ASCII title. ;) |
|
|
irelyaJoin Date: 2009-05-22
Post Count: 21748 |
@Quenty
"The source code is available at:
Pastebin: fmU5K6in"
|
|
|
NXTBoyJoin Date: 2008-08-25
Post Count: 4533 |
@Quenty: Looks awesome. People with forum enhancer, push "toggle markdown" to see his ascii art. |
|
OysiJoin Date: 2009-07-06
Post Count: 9058 |
[ Content Deleted ] |
|
|
"Also, would this protect the script? Wouldn't it still lie in memory?"
Since the script was destroyed, no, it wouldn't still lie in the memory.
However, you can find a version of the bytecode in the server's memory, so if you manage to go to the ROBLOX HQ, plug a monitor in the right server and open Cheat Engine from there, then you might be able to steal the bytecode of one of the functions.
""id = id == nil and getfenv(0) or id"
I lol'd
id = id or getfenv(0)"
Sorry, you fail. What if the id is "false"? I still want to accept it.
"Oh, thanks.
.::::::. .,-::::: ...
;;;` ` ,;;;'````' .;;;;;;;.
'[==/[[[[,[[[ ,[[ \[[,
''' $$$$ $$$, $$$
88b dP`88bo,__,o,"888,_ _,88P
"YMmMY" "YUMMMMMP" "YMMMMMP"
^ I made you a new logo. May not work too well with ROBLOX forums."
Hum, I looked at the logo in Notepad++, Notepad, SciTE (with both monospaced and non-monospaced font) and it still only looked ugly, so I'm sorry, but I can't use it. :/
According to what NXTBoy said, it is awesome, so I'm sad that I can't use it. :/
I used an online ASCII thingy generator, I think. |
|
|
Ok, so the _ONLY_ way to get a source somewhat similar to the source of your scripts is to follow these steps:
1. Go to the ROBLOX HQ.
2. Somehow get in.
3. Get in the place where the servers are.
4. Somehow find which server is the one executing a server of your game.
5. Plug a monitor on that server.
6. Download Cheat Engine on the server.
7. Run Cheat Engine.
8. Somehow find the bytecode of the script.
9. Go back home with the bytecode on an USB key.
10. Use a Lua decompiler to get a similar source.
11. Realize you forgot to get the source of the other scripts.
12. Repeat steps 1 to 10.
13. ???
14. No profit because now, you're in jail for breaking in the ROBLOX HQ. |
|
|
The reason this method is so awesome is simple: neither the source, neither the bytecode of your script is replicated to any client. In fact, the source is destroyed, all that is kept is the bytecode. And the only thing that can access the bytecode is the Lua VM. So.. yeah, I think this method is secure. :) |
|
|
|
Does anyone here feel like making a plugin that automatically puts the source of all your scripts in this one and changes their source to '_G.RunScript()'?
I might make one. :p
Just so you guys know, this system really works and it is actually better than obfuscating your scripts. The exploiter can't even get the bytecode of the script. He can't get anything.
It's like if you ran the script then removed it and it was still running. The source isn't there anymore, neither is the bytecode, but the script is still running. |
|
|
would not this only work in normal scripts... not local?
because my local scripts is where all the good stuff is, my normal scripts are basicly round changers |
|
OysiJoin Date: 2009-07-06
Post Count: 9058 |
[ Content Deleted ] |
|
|
I'm with xSIXx. How does this work with localscripts? |
|
OysiJoin Date: 2009-07-06
Post Count: 9058 |
[ Content Deleted ] |
|
|
That's why we need to put them into the table in this script:
do
local sources = {}
blarg = setmetatable({sources}, {__mode = "I vant to encode the source."})
end
collectgarbage()
Now try to get it out of memory >=D
Oh wait... My scripts don't work D: |
|
kaboom1Join Date: 2008-11-13
Post Count: 363 |
How about putting them in a data transfer system in workspace? (Values)
Let the scripts communicate through them......
I might release my version when I fix the bugs.
Yeah. :> |
|
OysiJoin Date: 2009-07-06
Post Count: 9058 |
[ Content Deleted ] |
|
|
"would not this only work in normal scripts... not local?
because my local scripts is where all the good stuff is, my normal scripts are basicly round changers"
You are right, it only works with normal scripts, it is completely useless for local scripts.
"But the table of the scripts still exists, right?
In which case, it would still lie in memory."
Yes, it is still in the memory. In the server's memory. And only the bytecode is there, because the source wasn't even there in the first place.
I'm doing [Workspace.Script] = function() [source here] end, not [Workspace.Script] = "[source here]", so the source isn't even in the environment in the first place, it is only in the script's source, which is destroyed when the script gets destroyed.
You are right, the bytecode is in the memory, in the server's memory. That's the reason I say that if you go to the ROBLOX HQ and open Cheat Engine there, you can get the bytecode of the script. But, I don't think breaking in the ROBLOX HQ is really an option...
"I'm with xSIXx. How does this work with localscripts?"
It doesn't. If you want to protect your local scripts, find another way.
"I used this script, and did everything as instructed. But then I went online to see if I could get the source, and in a matter of seconds it was lying there in plain text. This fails more than anything. It doesn't increase security at all, it just forces you to put all your script in one little table. - _ -"
You didn't use it correctly, then. Tell me, how exactly did you find the source?
Even if you're in ROBLOX studio, getting the source is impossible and getting the bytecode is extremly hard. The script destroys itself, so the Source property and all the rest are gone, garbage collected.
However, you CAN (since the server is on your computer, in this case) get the bytecode by using Cheat Engine and somehow finding it in the memory, since the Lua VM still has it.
But, otherwise, in a real ROBLOX server, it's impossible because the only way to get the bytecode is to scan the ROBLOX server's RAM, which requires you to be in the ROBLOX HQ in the first place..
"Making scripts communicate will change nothing. Read my post. It DOESN'T WORK at all, Julien didn't even bother testing it. - _ - And EVERY script is in the memory, even global scripts (yeah)."
Sorry, Oysi, but you fail completely. Neither the bytecode, neither the source is replicated. So how in the world can the player get the source from the memory?
As for it just being there in plain text, that's nonsense. The script destroyed itself. Even if it didn't get garbage collected, it still doesn't get replicated, and therefore only exists in the server's memory. That is, IF it doesn't get garbage collected, but actually, it does, since there is no reference to it (unless you put one). |
|
|
I tested it again just now to make sure, and it works perfectly. |
|
OysiJoin Date: 2009-07-06
Post Count: 9058 |
[ Content Deleted ] |
|
|
|
"THE SCRIPT CANNOT FREAKIN' GET OUT OF MEMORY 'CAUSE IT'S FREAKIN' RUNNING!!! And unless you haven't realized, server scripts ON THE SERVER replicate to the client. EVEN the source."
Oh, really, so objects outside of the DataModel replicate to clients?
Sure.
Also, no, the script isn't "FREAKIN' RUNNING!!!". It did everything it had to do and then destroyed itself. If it destroyed itself, that's because it had finished to do everything it had to do, since the line that destroys it is the last line.
I guess that a script that did everything it had to do can't be considered as "running". Look, if you don't believe me, I can just add 'error()' at the end of the script, and then, you'll be 100% certain that it isn't running anymore, since using "error()" stops the thread. |
|
OysiJoin Date: 2009-07-06
Post Count: 9058 |
[ Content Deleted ] |
|