Mystery Code - Is this Free Model a VIRUS?

[@wallop560]

There's a 2nd require you didn't check out. It's almost definety giving players that are friends with that account server side acces to run code in your game

[@MrGenie151]

yep, this comment needs more attention because it is true. i did some snooping myself and i found a gui. also just noticed something at 1:10 there is a second require he didn't explain!

[@GnomeCode]

You're right, major oversight on my part. Thinking about it, I suspect those on the friends list may be getting access to commands they can execute.

[@MrGenie151]

@@GnomeCode what he means by serverside access is one of these: kzbin.info/www/bejne/Y6fMfaaombycfpY. they can be really destructive and have their own executor to run serverside code.

[@MrGenie151]

@@hektor7966 i see what you mean. also you said a baseplate game did it? those are like serversides but give everyone the ability to run code.

[@paws-at-you]

@@hektor7966 Do you not know how bad serverside is?

[@noahrepublic]

It is actually a back door, the second require is giving his friends access to it, the web hook is sending so the creator knows which games has his back door so he can target you.

[@sadoats3356]

which sections where the back door?

[@Wertyhappy27]

@@zxfeared where, there is only one

[@macizzyy]

@@Wertyhappy27 theres more

[@hxuey]

i knew it

[@cristianjuarez1086]

no response, no backdoor

[@viggo_k8656]

This was really fun to watch! You should do more of these.

[@mariuslade]

Agreed.

[@NotGoodAPerson]

Agree

[@TheBxzr]

^

[@DalmatianGeo]

v

[@MattlikestrainsOfficial]

Agre

[@deja_blue]

as a person who's made backdoors in the past (to test legally on my virtual machines) I can tell that really looks like one, ofc its not an actual backdoor that'd be kinda impossible for roblox but looks something alike

[@zxfeared]

Same, but it is a game backdoor, so exploiters can actually use require scripts and get serversided exploits on any game with that on.

[@keenico7730]

whoever made this backdoor is very novice though no checking for http which could cause errors, making a lot of the code exposed so people can easily find out its a backdoor, making it send a webhook each time someone joins the game rather then sending it once

[@xE92vD]

You mean using dark comet rat's backdoor builder? Lol

[@exxe.n]

it is, sends a webhook to a discord server saying the game is infected, players who are either in the group of friended with the user can then use scripts on the server

[@kiankhiaw6620]

@@keenico7730 dumbest shit I’ve heard “nO chEckIng foR hTtPs” maybe because they want the code to be less ominous ever thought of that? Adding an https getservice is the most obvious thing that can tell someone “oh shit it’s a back door”

[@Mizosu]

GnomeCode: Yep, this script is harmless. Every Serverside in existence:

[@nikolozgilles]

yeah, this is why it's really important to check free models, especially the description and name because lots of bad models come with repeated descriptions like "Tree Tree Tree Tree Tree" to bump them up to the top of search

[@XGplays]

i check every free model's script and so far i have not seen anything amogus imposter sus about them

[@pwwnzo]

Usualy old virus models also have "infected" as codes and etc, you should also look for "dont delete" Or "dont rea/look" They usaly contain virus

[@pwwnzo]

Some also come as ". "

[@fan0]

There is popular Noob model (no, not my pfp) that has a script called "Vaccine". You know what it does?

[@Scrufflord]

@@fan0 I think it's a backdoor, idk tho

[@LitrlyMeowtooth]

i never knew that free models have a much deeper and darker secrets

[@ryandabestkillme3471]

the fact the model is called Darker made this comment necessary

[@aux2970]

The ultimate troll gui one shots your account

[@Holden_..]

@@aux2970 it doesn’t hack you etc It bans you any script involved with ultimate troll GUI will give you a ban (Most likely termination

[@aux2970]

@@Holden_.. i never said that it hacks you

[@Holden_..]

@@aux2970 sorry didn’t know what you meant

[@davidgigglebottom5634]

The fact that you know all about this stuff shows that you are epic, if i were to look in the script i wouldn’t even know a thing

[@davidgigglebottom5634]

@@HarryDKH yessir

[@axiom3570]

No you just need to learn

[@winnyrblx2405]

Hey its a backdoor that is called exilium. It allows players that are in a duscord server see the game that got infected with the virus. Players can execute scripts for trolling players or killing players

[@Deezboyofficial]

thats the same thing as every other serverside

[@ven._._.]

nahh no way bro??

[@gabrielc7861]

Wait a minute... if it's sending a discord thing telling them a game is infected and they can exploit in it then what if I only remove the backdoor and not the notification? Is that a way to do a little trolling?

[@ErtywekPL]

@@gabrielc7861 Better if I would allow them to troll people in my game then find them using OSINT including their real address, full name, parents and post it on v3rm and other forums.

[@gabrielc7861]

@@ErtywekPL I mean just making them join a game and try to exploit only for it not to work

[@sirmagnum7]

This is very entertaining. You should do more of these!

[@mythicstudios5234]

True

[@mythicstudios5234]

Feels like he’s a detectiv

[@RoStopMotion]

@@mythicstudios5234 yeah XD

[@chanchowaton]

yeah

[@zacky_code]

I really like dangerous code breakdowns, if you can please do this again! Nice and easy to understand and also very interesting as you start to break it down limb by limb.

[@builderdude9488]

I replaced the require script with a troll script so when he tries to hack my game he's gonna get fucking trolled

[@OnlyKemal]

@@builderdude9488 I think discord blocked the requests from roblox

[@MistRQuestion]

@@builderdude9488 lmao

[@realscripter1]

@@OnlyKemal nope

[@androgynousblob4835]

I used to backdoor roblox games and such in my free time (i dont anymore dw). The only reason this specific info needs to be posted to a discord server is if you were infecting the game with a backdoor, as to alert other users of the serverside to the fact that the game was infected. so yes, it is actually malicious.

[@samast253]

I never knew you could use hexadecimals for IDs

[@kxtbit]

in Lua, hexadecimals are just a different way of writing numbers, so a hex number and a decimal number in Lua work exactly the same.

[@Chanakan-df6hn]

Hex is base 16 Usual number (decimal) is base 10 So no matter the language, it should be able to convert between these 2 as it's a very basic thing

[@BRY0402]

neither did i this makes coding a lot cooler and scarier at the same time

[@IkeVoodoo]

@@kxtbit thats in most languages actually

[@kxtbit]

@@IkeVoodoo yea ik

[@themuffinsquid]

He made another one. I wanted to see this script for myself, only to discover that it contains another script entirely. Its only one script this time. I've been trying to make since of it, but it would be very helpful if you could make a video on it.

[@dextynlabelle9326]

get this man a theory i wanna hear it

[@blocksource4192]

how did you fail to decompile fucking LUA

[@Jam_Axo]

its been a childhood dream to code, and the way you decode it makes it sound so easy

[@polarcat0156]

It’s pretty easy if you have like 3 months of experience in lua. Most don’t obfuscate their stuff this hard

[@RoStopMotion]

This is really interesting, the way you explain it is really entertaining and useful too!

[@voxii42]

when i saw the title and thumbnail i got very shooketh, but when i reached the end i felt relief all over my body.

[@GnomeCode]

*phew* quite the journey my fren

[@mrdashell6517]

@@GnomeCode didn't expect to see gnomecode reply to one of mah friends

[@vimic3]

it can hack ur game, the second require script

[@h-atcy]

Fun fact:I learned so much from the script of the model

[@Misteramen]

The amongus part almost freaked me out,like,those noises are pretty unsettling

[@builder4099]

the deeper we go into the folders the more we find about this thing and maybe the stranger it gets

[@finixdevaerbakk]

If your wondering what this process is This code has been "Obfuscated" The term obfuscation is basically making your code unreadable and not understandable Obfuscation nowadays (Luraph, MoonSec v3, 77Fuscator, Ironbrew2, LuaSeel, clvbrew, Defaultio's Obfuscation (which this malicious code was obfuscated from), and etc) are very secure in they're own ways having anti tampering scripts and other professional stuff that make your code unreadable This obfuscated code right here is trying to hide constants inside a string by using a code mutator that changes these values into hexadecimal value. The process GnomeCode is doing here is called Deobfuscation Hope this helped :)

[@morgue502]

alright, i used to work on stuff like this, let me break it down so the code seems to insert an SS executor (watch youtubers like Dark Eccentric for 5 minutes and you'll see what im talking about) into the game via that little bit of code the user with the bunch of random characters is sort of a whitelist system for the SS, adding users who buy it via an automated bot system, the code checks if someone who joins the game is friends with that whitelist dummy account and injects the GUI into the person the GUI itself allows users to execute serversided code like grab knife that allow players to pretty much bypass FE, the inserted require is probably a system to check if a game is active and send logs of its servers to the SS's discord

[@pacifist1354]

its literally serverscripts of course it bypasses FE lol

[@EvacTouch]

Damn, he went from a single short script to a discord webhook that shows game information

[@Sand.]

so the first function gives the discord server info on the game also letting members know that its now back doored. the second function detects if the player is friends with that alt account & if it is it gets backdoor access. -I think-

[@ccrww]

this is honestly really cleverly set up, require scripts to obscure the models, unreadable codes to hide from moderation and other coders looking into it, all the way to sending all the available games to a server so they can easily exploit it, shows that exploiters have become very advanced within the past few years

[@bankruptcy3890]

Fun idea, make it so it still notifies the person that your game has it but make it so they don't have any of the other things that they put in.

[@Sethilliano]

Ye, Idk if they actually detect the joint virus one

[@shelf4287]

A fun series idea Search up a few names in the models section(names like tree,spawn,zombie,house and etc) and get a bunch of free models and check if they are a virus

[@Whom1337]

Seems like it's just in the experimental stage for now. Likely testing to see if it works in smaller games that will use free skyboxes since they're time consuming to make, then eventually throwing a more advanced version in commissioned assets is my guess.

[@Pythonaixx1]

Theory: The Free model uses that script to tell a discord server when a game is public so a group of people could go attack it e.g hack in it or spam to ruin your game... or it's just a bored developer wanting to play a new game. or someone doing a survey to see how many people fall for free model Viruses.

[@3hukwuma]

I think the devs just want to know who uses their model

[@trinity6880]

@@3hukwuma no, they insert a module which loads a backdoor (mostly a ss executor gui) when they join, or they can access the game and "exploit"

[@bubbletea695]

@@3hukwuma There is a second script that he didn't cover in the video that means everyone who is friends with that user gets commands to hack the game, meaning if you use that model, they will know the link of the game, join it, and ruin it

[@baconfartyguy]

It's a SS.

[@hivonemy8786]

@@3hukwuma no this is the work of a SS

[@smokeydeadwood9580]

Super entertaining video, you should do more of these! Maybe turn it into a series?

[@scriptingfever8676]

As of right now scripts inside of studio can’t do anything to your account, most of the time it is just a server side exploit or selling you expensive clothing. The most malicious thing they could do is put inappropriate images/models/audio in your game to get you banned.

[@jjee4ever894]

Damn didn't know free models had straight-up ARGS in them

[@cookiehawk]

lmao

[@kowhaifan1249]

lmao

[@brosthestickmandude]

Moral: Be careful with models in the toolbox, I recommend you to do the models yourself, My first time as a dev using anything I found in toolbox was a mistake. Now after 1 year, I learned from my mistakes. However I'm not forcing you to stop completely, I mean, just use the toolbox only a bit and if your gonna use one. Check EVERYTHING, the scripts, the instances, EVERYTHING So your game is 100% virus free. Hope it helps.

[@AcornGroove8274]

Good thing Roblox notifies you if there is a script in the model, anything could be dangerous on the internet.

[@Sethilliano]

@@AcornGroove8274 yeah but they can disguise it as a joint

[@AcornGroove8274]

@@Sethilliano So Roblox doesn’t know if there is a script inside of a joint?

[@SVENY]

Ex-backdoor dude here. These scripts are extremely common in free models, when I was doing my own investigative work, I found one every 3 free models. Usually they allow a (whitelisted) list of players to execute lua code serverside (as opposed to clientside lua execution, like Synapse X). With my own system, it was anyone within a Roblox group got backdoor access (a menu where you could type or paste lua, including some pre-saved lua scripts and execute it). Then when a backdoored server goes online, it notifies us in a Discord server using webhooks of which server and a command you could input into the Chrome/Firefox javascript console to automatically start Roblox and join that server. Honestly it was quite fun doing it.

[@SVENY]

@@rekaepSotatoP My group was not the only one, there are THOUSANDS of other little groups spreading these virus models around and using them. I wasn't the only one, and until Roblox moderators don't get behind all of this (which has been going on for a while) game creators that use free models will have to rely on checking if models they use have scripts in them or not.

[@SVENY]

@@rekaepSotatoP why would I want to provide a link to a group that's nonexistent.

[@littlehorn0063]

@hydra, why are you trying to recieve access to this group anyway?

[@SVENY]

@@rekaepSotatoP i thought jokes were supposed to be funny

[@pearlywhitesgaming9998]

i still do make and use backdoors, can confirm this is true

[@777orment]

This is a server side. I've made these before in the past. THIS IS A BACKDOOR.

[@keshsans536]

Why did you make them??!!?

[@charlescalvin271]

@@keshsans536 People can be stupid at younger ages or he just wanted cash for them.

[@baconfartyguy]

I think it's called like exilium ss or something.

[@spongebot6955]

Sad to see many new devs dont realise 90% models are backdoors..

[@Alex-vx5lk]

@@spongebot6955 did u know that R O B L O X deleted all the models that have back doors

[@Xylys]

this was a really good video u should do more of these

[@f456faux.6]

There is something that the creator tells the user who used the creator's model, it is like this: ----------------------------------------------------- THANKS FOR USING MY MODEL! ----------------------------------------------------- But, some models has a code in it, it is like: _________________________________________ Thank you so much for using this model! _________________________________________ (Insert virus string code, IP logger, etc.)

[@darel28]

i am working on a piggy fan game and when i was wondering what to do i found you u are the first roblox channel i subbed to ur videos helped so much thank you :)

[@GnomeCode]

Welcome aboard!

[@RoStopMotion]

Same, his tutorials are really helpful

[@demo_lition6260]

moment i saw require i just knew it was a backdoor, also the fact that its checking a guy's friends list means a whitelist and if it wasnt obvious enough then the logo and the name was the giveaway

[@CasperTheRamKnight]

Damn,this is deep

[@cheesemaster02]

This is why it's important to thoroughly check free models you use.

[@Marioman73]

Hey that's me!

[@FSHY.]

Indeed

[@FF08_]

Yep, that's you!

[@ScreamingCell]

Hey, that’s you!

[@Marioman73]

@@ScreamingCell Oh dear god, its a gun with a gun!

[@AceTWW]

Glad you found my script. it's been long enough.

[@inkdabest100percent]

wheres teddy tho :( i want more teddy :)

[@GnomeCode]

I've been working on it all week, can't wait to show you guys soon ;)

[@inkdabest100percent]

@@GnomeCode Thank you!!!

[@mythicstudios5234]

@@GnomeCode Cool l love your Teddy vids I have ben working on a game like Teddy But the AI crashed:( Can you help? There is no error in the output My bot moves in the middle of the waypoints

[@Peach_Lobot0my]

😳🥶 i knew it. my friend told me about one of these. he was in a discord server with one of those web hooks D:. if a player joins that game (in that server with an exploit) it allows them to run code (server code like requires to troll)

[@scoutstop]

I Actually Put This Sky In My Game Dont Worry, The Secnd I Saw A Script Was Even In There, I Deleted It

[@antonifawalte]

you're smart

[@STEVE_AhPiss]

8:57 The discord server the webhook is integrated contains all the other info of other roblox games and that script makes the webhook post info using internet magic.

[@specowos]

Lesson of the day: don't obfuscate your crappy ss with hex, that aint gon work chief

[@stalecheez-it1034]

prombogen!!!!!!

[@leaderr_]

toaster

[@specowos]

@@leaderr_ toaster

[@stalecheez-it1034]

@@specowos toaster

[@specowos]

@@stalecheez-it1034 toaster

[@NewBuildmini]

I thought this was a Computerphile video judging by that thumbnail lol.

[@fraydeyy]

It's just an obfuscated script that infects your game with an ss lol.

[@leogotlost2482]

I have always looked for these kind of videos! Can you make more of these please? I would love it!

[@polarcat0156]

On what exactly? He covered pretty much everything there is to back doors here

[@yusufart4676]

Is it just me or do I think I always use free model viruses

[@achannel77373]

you edited your comment from "first" to this

[@Lenvii_]

It's not only you lol

[@yusufart4676]

@@achannel77373 I commented as fast as I can so I just put “first” then edited it to my real comment

[@achannel77373]

@@yusufart4676 "real" yea so the first one wasnt the actual real, totally

[@achannel77373]

@@theabyss2b2t87 maybe

[@user-oy7mq6yc7j]

It most likely is a back door. The first script with the two PlayerAdded events required two different scripts. He only checked one of them, so we can assume the other module being required is the actual planted executor.

[@Iumey]

ironically, as this backdoor is super easy to decode, you can backdoor the backdoor with the webhook link

[@Sethilliano]

What happens when you change it to a yt link?

[@FluoFalI]

No way someone tried their sole best to hide the fact that it is just a harmless code that notifies if someone is using his skybox💀

[@der_schnolli]

It can acctually steal your data

[@pe_w]

i saw the video title and subscribed immediately. sad how youtube had to show me your channel a year later.

[@misterclubs]

please do more of these, they are so interesting

[@hahahanooboobo1587]

im going to decode this further and attempt to make my own so that I can understand it better

[@Justin_Joy]

Judging from the thumbnail, I thought the virus model was gonna be the gnome avatar.

[@nekoyd]

ive been in a discord server which was a serverside backdoor thingy, basically what that script does is when someone plays the game, it sends the game info in their discord server, and if theyre friends with that sus account, they get serverside access and can destroy your game (sorry for my bad grammar lol)

[@grill4825]

the game id is printed into a discord channel which is then used to show that the game is backdoored (for ease of access to a backdoored game), they can run bypassed requires which basically are filtering disabled scripts (exploits) that show server side

[@Xxelijah3314xX]

yeah I have made quite a few backdoors like this and gotten access to a lot of the top game like mad city, jailbreak, meep city using a cool blur effect that a lot of games like.

[@NorbYyY_GG]

"If you dont know what the script means, remove it" ~Gnome Code 2021

[@karamil9556]

Lol I saw this video thumbnail and I thought the gnome was the model 😂 so when I saw your channel with the same model I left imidiatily. When I saw the video I was confused because you were talking about. But the think was damn sky box 😂😂

[@SamLeroSberg]

wallop560 mentioned about the 2nd require, and yes i was about to point that out, but he told it, so i'll just explain how this thing works FROM my thoughts: - The webhook sends data to a discord account - If that game GETS popular and its recently updated and stuff like that, they'll exploit in it - Then the 2nd require will help them have access to run server sided code in the game (as wallop560 said) This is how exploiters are trying gain access to one's game, so everyone out there, be careful alright, we dont want these problems to happen

[@yannoahhc8240]

4:53 Though he was singing life goes on and on and on and on

[@RikThePixel]

I find it funny that they took the time to obfuscate the strings, but didn't obfuscate the function calls and indexing they could have done: game[" [ HEX string here ] "] to index the items or HttpService[" [HEX string of function name here] "](HttpService, ...) because some functions are methods they want a "self". You can either call a method with a colon to give the self automatically or pass in the self youself

[@DRFBlox]

I used to exploit and basically, it sends it to a serverside like Sympex, Exoliner, etc. and it makes it so buyers of the script can see what game is infected so that they can run scripts inside. Remember those old roblox exploiting videos? Pretty much that but more complicated.

[@mach272]

GnomeCode i thought you were gonna make that tower defense series

[@hun7632]

Dam, u explane stuff so good! Deserves a sub

[@MiroSynthBit]

Great video! Series Suggestion: How to make a fnaf game Which includes a ending

[@user-or7nv3uq4f]

Biggest step of code, be abstract! this isn't a terrible coder.

[@redfirebomb5873]

This is why I check every script in my game that I have not created myself

[@sansundertale4245]

this man is going throught all of the stages of investigation

[@Karsussy]

I found some of those virus assets and this is so fun to see how are they trying to hide require.

[@djmoonelf2959]

When do you plan on posting A new Chapter of Teddy and posting a Video on it?

[@thefireph0enix]

I figured it out abit early why they had this, it's mostly definitely a discord server with a tracker of games with available backdoors exclusive to the friends of the selected user. Abit strange not to point this out in the video.

[@JokerKoldovstvo]

Everyone talking about video, but i want to say its super cool video. Thank you for such a good content

[@davidh0610]

Once, I used a model to handle DevProduct transactions. In it, I saw two things -A script for DevProducts that wasn't going to work -A script named "Give me admin" I find it funny how it was so blatant.

[@suolakurkkusk]

I didnt understand mostly any of this, but it was still fun to watch!

[@BenDover-wp4co]

This person is so good at catching virus codes. 👌👌👌

[@nopfp416]

Roblox doesn't sensor scripts there is a plugin to deobfuscate and obfuscate code they were using minimal effort the script was made by them sure but the plugin did a lot of the work. Obv not sharing the plugin.

[@thaaSufle]

It's a backdoor that gives the owner,his friends and alts admin in games that have the model

[@gokuchavoso7312]

what it does is, send that message on discord, with all that information, so the owner of the script can know which place his scripts infected, they can use it as when they join they get trolling gui and all that stuff, my friend have one of those.

[@mr.mystical9776]

Yeah, i learned to always delete weird scripts in models the hard way. FSR whenever i had one of those scripts in a free model in my game, it said that i was trying to hack players in my game, (it was on private and i only had 1 friend join it) and disabled my account and i tried consulting with roblox and they couldn't do anything so about 40 dollars on robux wasted.

[@magic1574]

it gives the person SS access to your game ( basically do whatever they want / admin perms )

[@HaniSiKucing]

I would like to see more of these videos maybe make this a series since it's really interesting

[@itsjustpazman2110]

This Was Really Fun To Watch! When Is Teddy Chapter 4 Coming Out Is It In Build Yet?...

[@hepbep_]

9:05 this is actcually a discord embed script and it is posting all the game details to the webhook. this is how they get the info, i Believe

[@AlperSocial]

This code is actually a virus for a serverside called exilium. Basically if you insert a free model into a game and if it has this kind of virus it can allow people who have bought the serverside to execute any require script or any other script but others can see it.

[@RevolutionaryDragons]

What's the game in the background in the intro? Looks dope.

[@kyudeathsbr3138]

You should create a webhook to replace that with to test what happens

[@AV-wu8nl]

subscribed within 5 seconds, looks like quality content to me.

[@pearlywhitesgaming9998]

i think you have uncovered an SS here

[@pottoker612]

it would be nice if roblox would mention that viruses possibly exist in the model section on the developer page

[@confi4011]

missed a chance to send comedy gold embeds to that webhook

[@kingtan9579]

amazing video, you are the best developer i saw ever

[@catslovestuff]

I’m I create server sides and backdoors you’d be surprised to how many there are I created Stamp SS and I’m partnered with other ServerSides such as floppaware, strategy SS, teefus, pact SS, Topk3k and cephalon

[@simplicity474]

6:07 | I got a AD for Discord when he said that... :flushed:

[@Verchant917]

me while watching the vid normally : sounds interesting my brain after 2 seconds later : **Plays horror music**