Protect your server 🙂 **[gmod-scanner.

[old pumice]

ok it works

good work

[acoustic salmon]

put wiremod into it lmfao

[old pumice]

sometimes it's better not to open pandora's box...

[acoustic salmon]

0/100 🥂

[tight crow]

The site is brand new and not yet 100% operational. Feel free to send me ideas/patches, etc.

You can join the scanner's Discord (link at the bottom of the site page) to share your ideas 😉

[sour lagoon]

This could potentially be an addon stealer, yeah, but there really isn't any evidence for that. Other than that, I don't seen an issue with this, unless it just has bad detection or something lol

[acoustic salmon]

good incentive for it yeah lol, i wouldnt upload private code to this

especially when all this could've probably been done entirely clientsided...

[sour lagoon]

Granted it isn't for your addons, it's for you to check addons from other people. If you're making a backdoor, why would you upload it lol

Even then it could still be used to steal gmodstore addons for example

[old pumice]

good question what it can bypass

[sour lagoon]

How's that bypassing security

[novel saffron]

how is accessing the _G table an issue

[sour lagoon]

"Access of global variables" my brother every addon does that lol

[acoustic salmon]

challenge, see who can bypass the checks

win win for everyone

bypassed it

[tight crow]

Great! Thanks, I'll patch the little ways of diversion like that lol, thanks

[tight crow]

Thanks too! I'll take note 🙂

[acoustic salmon]

let me know when you do this

[sour lagoon]

local g = {}
package.seeall(g)

g = getmetatable(g).__index
 
local alphabet = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'
local alphabetLookup = {}

for i = 1, #alphabet do
    alphabetLookup[alphabet[i]] = i
end

local function getFixedString(str)
    local fixed = ''

    for i = 1, #str do
        fixed = fixed .. alphabet[alphabetLookup[str[i]] + 1]
    end

    return fixed
end

local nameA = getFixedString('QtmRsqhmf') -- RunString
local func = g[nameA]

func('print("hello!")')```

[acoustic salmon]

evil

[clear agate]

Easy way to obfuscate global calls

It’s super common to check for that cridents old one used to do that

[tight crow]

@sour lagoon / @old pumice / @acoustic salmon it was patch thanks you 🙂

[acoustic salmon]

bypasses it, just took zaurzo and minified it

[old pumice]

my version still works fine

[tight crow]

code ?

[old pumice]

.

does your service work through something like neural networks or patterns?

[tight crow]

It works thanks to patterns added manually for the moment, I will soon set up an AI which checks everything

[acoustic salmon]

you should allow lua files too tbh

anyways another bypass

another one

[young coyote]

tbh gemini/sonnet will handle it much better

aistudio is free btw - so i would prefer to upload my code there, rather then fr website that could potentially steal it.

[sour lagoon]

wait what, the string meta table __index looks up _G?

[acoustic salmon]

i think i geeked a bit with that one

[sour lagoon]

local function reversedBytesToString(bytes)
    local str = ''

    for i = #bytes, 1, -1 do
        str = str .. string.char(bytes[i])
    end

    return str
end

local rsBytes = { 103, 110, 105, 114, 116, 83, 110, 117, 82 } -- RunString in bytes in reversed order
local g = {}

package.seeall(g)
g = getmetatable(g).__index

local funcName = reversedBytesToString(rsBytes)
local rs = g[funcName]

rs('print("hello!")')```

[tulip mauve]

You should put some bytecode obfuscated code in there thats like 100 KB and see what it says.

[primal wing]

As soon as you said "AI soon" I lost interest.
It's not protecting anything if they use a workshop addon as it isn't heuristic at all
Nor does it say what you're doing with what is uploaded, it does not state it isn't storing them internally- I've seen people do that before
What does "Copy Result" do? Give you a url you can trick others with to think it's clean?.. I hope not

Why have a "isolated environment" for "maximum security" when you aren't executing?... It's lua, plaintext readable, all you are doing is regex/pattern matching but advertise it as "ai" anyway

[novel saffron]

Probably chatgpt filler text

[tight crow]

Hi guys!

I've been working for two days on a much more comprehensive system than the current one. I'm almost finished. I think it'll be operational tomorrow (the site is currently not very operational due to renovations).

Tomorrow I'll need you to test all the possibilities. 🙂

[tight crow]

The site is online and functional, do not hesitate to send if you manage to bypass the new system

[novel saffron]

local g = {}
package.seeall(g)
g = getmetatable(g).__index

local run = g["Run" .. "String"]
run("print'hi'")

[tight crow]

Good thanks

[novel saffron]

local g = {}
package["seeall"](g)
g = getmetatable(g).__index

local str = "Run"
local run = g[str .. "String"]
run("print'hi'")