Skip to content
This repository was archived by the owner on Jun 23, 2022. It is now read-only.

Commit cbd556a

Browse files
ccuser44ccuser44
committed
Added malicious group and user id detections. Updated to alpha 0.0.7
1 parent 68478ac commit cbd556a

4 files changed

Lines changed: 243 additions & 218 deletions

File tree

‎Titan-Protection/AV Main.server.lua‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -236,7 +236,7 @@ for _, v in ipairs(DB.SafeModelIds) do
236236
GlobalAssetCache[v] = {false, false, false, false, false}
237237
end
238238

239-
local DB_VirusNames, DB_StaticVirusNames, DB_malicious_code_snippets, DB_Obfuscation_Detection, DB_Bad_Require_Ids, DB_Adware_Detection_Formates = DB.VirusNames, DB.StaticVirusNames, DB.malicious_code_snippets, DB.Obfuscation_Detection, DB.Bad_Require_Ids, DB.Adware_Detection_Formates
239+
local DB_VirusNames, DB_StaticVirusNames, DB_malicious_code_snippets, DB_Obfuscation_Detection, DB_Bad_Require_Ids, DB_Adware_Detection_Formates, DB_MaliciousGroups, DB_MaliciousUsers = DB.VirusNames, DB.StaticVirusNames, DB.malicious_code_snippets, DB.Obfuscation_Detection, DB.Bad_Require_Ids, DB.Adware_Detection_Formates, DB.MaliciousGroups, DB.MaliciousUsers
240240

241241
--------------------
242242
--| UI functions |--
@@ -621,7 +621,7 @@ local function ScanObj(Obj, CheckSource, CheckObf, CheckSpace, CheckLen, CheckSn
621621
IsVirus = true
622622
end
623623
elseif string.len(Id) >= 3 and string.match(Id, "^%d+$") and GetLib("CheckModule") and GetLib("ScanObjectsGet") then -- // We scan the id for malicious content
624-
local IsVir, IsSus, IsObf, IsLar, IsAdw = GetLib("CheckModule")(Id, ScanObj, GetLib("ScanObjectsGet"), RepeatCount, CachedIds, IsDebug, SafeHashes, HashSource, SeperateMalIds, {CheckSource, CheckObf, CheckSpace, CheckLen, CheckSnippets, CheckStructure, CheckAdware})
624+
local IsVir, IsSus, IsObf, IsLar, IsAdw = GetLib("CheckModule")(Id, ScanObj, GetLib("ScanObjectsGet"), RepeatCount, CachedIds, IsDebug, SafeHashes, HashSource, SeperateMalIds, {CheckSource, CheckObf, CheckSpace, CheckLen, CheckSnippets, CheckStructure, CheckAdware}, DB_MaliciousGroups, DB_MaliciousUsers)
625625
local Detected = IsVir or IsSus or IsObf or IsLar or IsAdw
626626

627627
if Detected then
@@ -686,12 +686,8 @@ local function ScanAssets(Assets, Type, CachedIds, IsDebug)
686686
local CheckModule = GetLib("CheckModule")
687687
local CheckSource, CheckObf, CheckSpace, CheckLen, CheckSnippets, CheckStructure, CheckAdware = Settings.CheckScriptSource, Settings.CheckObfuscation, Settings.CheckWhiteSpace, Settings.CheckLarge, Settings.CheckSnippets, Settings.CheckStructure, Settings.CheckAdware
688688

689-
if Settings.IsDebug then
690-
print("Check Module function is :", CheckModule, "ScanObjectsGet function is", GetLib("ScanObjectsGet"))
691-
end
692-
693689
for _, v in ipairs(Assets) do
694-
local IsVir, IsSus, IsObf, IsLar, IsAdw = CheckModule(tostring(v), ScanObj, GetLib("ScanObjectsGet"), 0, CachedIds, IsDebug, SafeHashes, HashSource, Settings.CheckRequireIdsAllScripts, {CheckSource, CheckObf, CheckSpace, CheckLen, CheckSnippets, CheckStructure, CheckAdware})
690+
local IsVir, IsSus, IsObf, IsLar, IsAdw = CheckModule(tostring(v), ScanObj, GetLib("ScanObjectsGet"), 0, CachedIds, IsDebug, SafeHashes, HashSource, Settings.CheckRequireIdsAllScripts, {CheckSource, CheckObf, CheckSpace, CheckLen, CheckSnippets, CheckStructure, CheckAdware}, DB_MaliciousGroups, DB_MaliciousUsers)
695691
local Detected = IsVir or IsSus or IsObf or IsLar or IsAdw
696692
if Detected then
697693
table.insert(BadAssets, v)

‎Titan-Protection/CHANGELOG.lua‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
-- [[Version INSERT INSERT - INSERT]],
22
return {
3-
[[Version Alpha 0.0.6 - Made into rojo and maybe did some other changes]],
3+
[[Version Alpha 0.0.7 - Made malicious users and malicious groups detection list to ease detection.]],
4+
[[Version Alpha 0.0.6 - Made into rojo and maybe did some other changes.]],
45
[[Version Alpha 0.0.5 - Shared alpha testing version. Fixed bugs and changed some enhancements. No UI support I am too lazy.]],
56
[[Version Alpha 0.0.4 - Last version before shared alpha testing version released. Fixed & enhanced stuff and added basic UI support.]],
67
[[Version Alpha 0.0.3 - Added http integration and plugin scanning as well as some other improvements. Also reworked the debug output mode to make it look simpler.]],

‎Titan-Protection/Libs/CheckModule.Lua‎

Lines changed: 48 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ local StudioService = game:GetService("StudioService")
2121

2222
local StudioLocalId = StudioService:GetUserId()
2323

24-
return function(Id, ScanFunction, GetObjectsFunction, RepeatCount, IdIgnoreTable, IsDebug, SafeHashes, HashSource, SeperateMalIds, ScannerSettingsTable)
24+
return function(Id, ScanFunction, GetObjectsFunction, RepeatCount, IdIgnoreTable, IsDebug, SafeHashes, HashSource, SeperateMalIds, ScannerSettingsTable, BadGroups, BadUsers)
2525
if not IdIgnoreTable then
2626
warn("[Ti-Protection]: Cached table not found! , FunctionArgs: " .. string.format(
2727
"Id: %s, ScanFunction: %s, GetObjsFunction: %s, Repeatcount: %s, IdIgnoreTable: %s, IsDebug: %s, SafeHashes: %s, HashSource: %s, SeperateMalIds: %s, ScannerSettingsTable: %s, ScannerSTableLen: %s",
@@ -45,56 +45,61 @@ return function(Id, ScanFunction, GetObjectsFunction, RepeatCount, IdIgnoreTable
4545
end)
4646

4747
if Succ and info and type(info) == "table" and not((game.CreatorType == Enum.CreatorType.User and info.Creator.CreatorType == "User" or game.CreatorType == Enum.CreatorType.Group and info.Creator.CreatorType == "Group") and (game.CreatorId == info.Creator.CreatorTargetId or StudioLocalId == info.Creator.CreatorTargetId)) then -- // We check if the asset can be scanned.
48-
if IsDebug then
49-
print("[Ti-Protection]: Checking for viruses: rbxassetid://"..RealId)
50-
end
51-
if RepeatCount > 5 then -- // We check if the module is obfuscated with a require id chain.
52-
IsObf = true
48+
if info.Creator.CreatorType == "Group" and BadGroups[info.Creator.CreatorTargetId] or info.Creator.CreatorType == "User" and BadUsers[info.Creator.CreatorTargetId] then
49+
IsVir, IsSus, IsObf, IsLar, IsAdw = true, true, true, true, true
50+
IdIgnoreTable[RealId] = {IsVir, IsSus, IsObf, IsLar, IsAdw} -- // We cache our results
5351
else
54-
local Success, Error = pcall(function()
55-
local Objs = game:GetObjects("rbxassetid://"..tostring(RealId))
56-
for _, Obj in ipairs(GetObjectsFunction("Fast", Objs)) do
57-
if Obj then
58-
-- // We first set a dummy table for the cache so the script does not repeatedly scan the module.
59-
IdIgnoreTable[RealId] = {false, false, false, false, false}
60-
61-
-- // We scan the descendants of the asset.
62-
local CheckSource, CheckObf, CheckSpace, CheckLen, CheckSnippets, CheckStructure, CheckAdware = unpack(ScannerSettingsTable)
63-
IsVir, IsSus, IsObf, IsLar, IsAdw = ScanFunction(Obj, CheckSource, CheckObf, CheckSpace, CheckLen, CheckSnippets, CheckStructure, CheckAdware, RepeatCount, IdIgnoreTable, SeperateMalIds, IsDebug)
64-
65-
if IsVir or IsSus or IsObf or IsLar or IsAdw then
66-
if not(Obj:IsA("LuaSourceContainer") and (string.len(Obj.Source) < 400000 and SafeHashes[HashSource(Obj.Source)])) then
67-
if IsVir then
52+
if IsDebug then
53+
print("[Ti-Protection]: Checking for viruses: rbxassetid://"..RealId)
54+
end
55+
56+
if RepeatCount > 5 then -- // We check if the module is obfuscated with a require id chain.
57+
IsObf = true
58+
else
59+
local Success, Error = pcall(function()
60+
local Objs = game:GetObjects("rbxassetid://"..tostring(RealId))
61+
for _, Obj in ipairs(GetObjectsFunction("Fast", Objs)) do
62+
if Obj then
63+
-- // We first set a dummy table for the cache so the script does not repeatedly scan the module.
64+
IdIgnoreTable[RealId] = {false, false, false, false, false}
65+
66+
-- // We scan the descendants of the asset.
67+
local CheckSource, CheckObf, CheckSpace, CheckLen, CheckSnippets, CheckStructure, CheckAdware = unpack(ScannerSettingsTable)
68+
IsVir, IsSus, IsObf, IsLar, IsAdw = ScanFunction(Obj, CheckSource, CheckObf, CheckSpace, CheckLen, CheckSnippets, CheckStructure, CheckAdware, RepeatCount, IdIgnoreTable, SeperateMalIds, IsDebug)
69+
70+
if IsVir or IsSus or IsObf or IsLar or IsAdw then
71+
if not(Obj:IsA("LuaSourceContainer") and (string.len(Obj.Source) < 400000 and SafeHashes[HashSource(Obj.Source)])) then
72+
if IsVir then
73+
if IsDebug then
74+
print("[Ti-Protection]: Found viruses in module: rbxassetid://"..RealId)
75+
end
76+
break
77+
elseif IsDebug then
78+
print("[Ti-Protection]: Found suspicious activity in module: rbxassetid://"..RealId)
79+
end
80+
else
6881
if IsDebug then
69-
print("[Ti-Protection]: Found viruses in module: rbxassetid://"..RealId)
82+
print("[Ti-Protection]: ", Obj:GetFullName(), " was not scanned because it was whitelisted.")
7083
end
71-
break
72-
elseif IsDebug then
73-
print("[Ti-Protection]: Found suspicious activity in module: rbxassetid://"..RealId)
74-
end
75-
else
76-
if IsDebug then
77-
print("[Ti-Protection]: ", Obj:GetFullName(), " was not scanned because it was whitelisted.")
84+
IsVir, IsSus, IsObf, IsLar, IsAdw = false, false, false, false, false
7885
end
79-
IsVir, IsSus, IsObf, IsLar, IsAdw = false, false, false, false, false
8086
end
87+
88+
IdIgnoreTable[RealId] = {IsVir, IsSus, IsObf, IsLar, IsAdw} -- // We cache our results
8189
end
82-
83-
IdIgnoreTable[RealId] = {IsVir, IsSus, IsObf, IsLar, IsAdw} -- // We cache our results
8490
end
85-
end
86-
end, function(Error)
87-
if info.IsPublicDomain == false and Error:match("409") then -- // The asset is a private module
88-
IsObf = true
89-
elseif (Error:match("403") or Error:lower():match("bad request")) and info.Name:match("[Content Deleted]") then -- // Asset is terminated
90-
IsSus = true
91-
else
92-
warn("[Ti-Protection]: An error occured while trying to check rbxassetid://"..tostring(RealId).." for viruses. Reason "..tostring(Error))
93-
print("[Ti-Protection]: "..debug.traceback())
94-
end
95-
end)
91+
end, function(Error)
92+
if info.IsPublicDomain == false and Error:match("409") then -- // The asset is a private module
93+
IsObf = true
94+
elseif (Error:match("403") or Error:lower():match("bad request")) and info.Name:match("[Content Deleted]") then -- // Asset is terminated
95+
IsSus = true
96+
else
97+
warn("[Ti-Protection]: An error occured while trying to check rbxassetid://"..tostring(RealId).." for viruses. Reason "..tostring(Error))
98+
print("[Ti-Protection]: "..debug.traceback())
99+
end
100+
end)
101+
end
96102
end
97-
98103
end
99104
else -- // We have already cached the state of the module. We will us the cached values.
100105
if IsDebug then

0 commit comments

Comments
 (0)