Okay.
In this lecture, I would like to show you how you can avoid malicious scripts in your game that come
from free models.
Now, free models can include scripts that can introduce backdoors into your game, and a backdoor is
simply a vulnerability that allows a third party to execute commands and have total control of your
game, which is something you don't want.
The most common way people introduce backdoors into your game are by using scripts that have the require
function and they require an asset that is outside of your game.
These assets could have scripts in them that could be executed or do malicious things that you don't
want.
So let's go ahead and look for some malicious scripts.
We can open up the toolbox from the home tab, or you can also do it from the view tab.
And we're just going to try and find a model that is poorly rated and it includes scripts.
Usually if you see a poorly rated model that includes scripts, it could be that the model is broken
and produces some error, or maybe it's just poorly made or it could be malicious.
So we're just going to see if we can find one.
So I'll just look up something generic, like maybe there's some malicious scripts hidden in benches.
Now, usually if you see benches that are highly rated like this and they have scripts, you probably
don't have to worry about them.
So I'm going to find a bench that has scripts and is poorly rated, or I'm going to try and find a bench
that has scripts and it isn't rated at all.
All right.
It looks like I'm not having much luck finding malicious scripts here, so let's try to look for something
else.
Maybe we can find, like, a crate that has a script in it for some reason.
Just kind of look around here.
Anything.
You.
A weapon giver crate.
It might be having scripts just because it's given us weapons.
Nine scripts.
Nine scripts in this crate.
It could be because yeah we're including some tools in here to.
We have a script in here.
Looks like it's just cloning a tool and giving it to a player.
Let's check out these tools here.
That is very ugly.
What the heck?
Looks like this is just making some welds.
Now we can find the keywords in our scripts by using a neat little tool that can search for keywords
in all the scripts in your game, and you can open it up using control shift and f.
And now I can search for some keywords like require.
Good thing no results found.
Maybe I'll look for git for nothing.
Maybe I'll look for some asset IDs using rbc's asset.
And it does look like we have some assets, but it looks like it's just for changing the mouse cursor.
So nothing out of the ordinary here.
We have a lot of math operations going on for the gun.
But from what I can see so far.
Nothing I would say, jumps out at me as malicious.
So actually it's just test this thing out, see what this thing does.
Check.
The script isn't even working.
So, yeah, a little strange.
Whatever.
We don't need this create anyways.
Goodbye.
All right.
So I had a poor time trying to find any malicious scripts in those crates, but I am looking for a zombie
NPC.
And, oh, here we go.
25% rating and it has scripts.
Perfect.
14.
Oh, goodness.
OC This is the type of thing we want to look for malicious scripts in.
So let's open up this model and see.
Oh my goodness.
What the heck is this formatting?
Why are we looking for a player that doesn't exist?
No idea.
Whereas this do.
Same thing.
So somebody just copied and pasted a bunch of these scripts.
So let's look for that.
See if there's any requires in here.
None.
Get fed.
Nothing.
How about a string dot reverse function?
And sometimes people use string dot reverse to try and call a function.
But having the name for the function being reversed and they use string dot reverse to reverse it back.
So you can't really search for a specific function, but it looks like this model isn't using these
string dot reverse function.
So we're clear in that regard.
And I'm also going to look to see if any of these scripts are obfuscated.
And that basically means they made the script in a way that is unreadable to our eyes.
Like it's not English.
It's all a bunch of weird jibber jabber, but the computer can still read it.
And if you see any scripts that are obfuscated, be very wary because if they want to obfuscate it,
there's obviously something they want to hide.
So I would avoid any models that have obfuscated code in them.
Looks like our zombie here doesn't have anything suspicious other than, like, some weird stuff going
on in our game.
It could be that it's just broken.
And it kills me.
But it's not even chasing me.
So I would just say that this thing is poorly rated because it's broken.
Unfortunate.
So goodbye, boss Zombie.
I guess we'll just keep looking.
So I actually had a very difficult time trying to find a free model with a malicious script in it.
So I just decided to make my own.
So let's say I got this bench right here, this nice little bench from the toolbox, and I put it into
my game and I saw that it included one script and it didn't have any ratings.
So I guess the first procedure would be, okay, let's see if I have any required functions being used.
Good.
No results.
How about get fence?
Nothing.
Maybe a string dot reverse.
Okay.
Nothing suspicious so far.
So let's go ahead and find the script in our bench.
Must be a child of this union.
So we have this well here, it's got a child, some guy, whatever.
It's just called Q Perfection Weld, which is a pretty commonly used script for welding stuff, as you
can see, created by Quint.
So I'm not thinking much of it filled with a standard stuff.
I don't see anything strange in here.
Seems fine.
However, if I go to play my game.
Should see here.
Oh, no, I am hacked.
I cannot see anything.
What is going on?
Well, if I go to the server and I try to delete this guy out of my player and there player, guy,
here it is.
Let's delete this guy called Bench.
That's in here.
Must be coming from our bench.
Just delete it.
Uh oh.
I'm deleting it, but it's not going away.
It keeps duplicating itself.
Something's going on.
So let's go back to our script here.
Let's look in here for any suspicious activity.
Like what is what is this bench DUI being used for?
So we see we have a reference to it right here.
It's called SW one.
So let's use control F to search in the script and see where this SX one variable is being used.
And it looks like it's being used right here.
Ooh.
So we have a player added event being connected to.
And it's getting the player and it's having a loop where it keeps adding this guy into the player's
player guy over and over and over again.
So we have found our malicious activity, our malicious script right here.
So we can actually delete this.
Get rid of that.
Let's get rid of TSS.
One, two.
And in fact, maybe we don't even need this benched UI here anymore since it was just used for malicious
purposes.
So now if I go and play my game.
Perfect.
We don't have that guy stuck on our screen anymore.
Now, sometimes scripts will include malicious activity within other scripts that are actually needed
to make the model work.
But in this case, if I don't believe that this script has any use or purpose to making this model work,
then I can just delete it and test to see if it broke any functionality.
And of course it didn't.
My bench should still be able to work just fine.
So yeah, here's my awesome bench.
So the whole idea here is that if you find a model that you want to use and it includes scripts, ensure
that you just quickly go over the scripts using the find all window and look for any places where the
require function or the get found function is used.
And you always want to pay attention to the rating of a free model as well.
If you ever encounter a free model that causes issues in your game or is performing some malicious activity,
then simply just delete it.
If you find any models with scripts that are obfuscated, meaning that you can't read them, then that's
a little suspicious because they're trying to hide something from you.
So I wouldn't use those models either.
At the end of the day, it really just comes down to common sense.
Don't use models that are poorly rated.
Always try to look out for strange behaviors and strike down any malicious code in them.
So that was just kind of the basic overview of how you can avoid or find malicious scripts in your games.