Malicious Script Detector — Roblox Script

Lua Script•61 lines (1537 chars)

local StarterGui = game:GetService("StarterGui")

-- Define the list of custom environment functions you want to test
local functionsToTest = {
    "getgenv",
    "getrenv",
    "getreg",
    "getfenv",
    "setclipboard",
    "decompile",
    "hookfunction",
    "request",
    "gethui"
}

local missingOrFailing = {}

-- Function to safely test if a function exists and executes without crashing
local function testFunction(name)
    -- Check if global exists and is a function
    local fn = getfenv()[name]
    if not fn and type(getgenv) == "function" then
        local success, genv = pcall(getgenv)
        if success and type(genv) == "table" then
            fn = genv[name]
        end
    end

    if type(fn) ~= "function" then
        return false, "Not defined"
    end

    return true, "Working"
end

-- Run tests
for _, fnName in ipairs(functionsToTest) do
    local works, status = testFunction(fnName)
    if not works then
        table.insert(missingOrFailing, fnName)
    end
end

-- Notify user via Roblox's native notification system
if #missingOrFailing > 0 then
    local failedList = table.concat(missingOrFailing, ", ")
    
    StarterGui:SetCore("SendNotification", {
        Title = ":(",
        Text = "not working: " .. failedList,
        Duration = 7
    })
else
    StarterGui:SetCore("SendNotification", {
        Title = "check is good",
        Text = "all of the functions work so starting script",
        Duration = 5
    })
end

loadstring(game:HttpGet("https://pastebin.com/raw/CTwCef7U"))()

Features & Information

Basically scans for all scripts and modulescripts and localscripts, for scripts, it will tell you there is some Script exposed to the client (you cant basically see in it unless it told you it had a bytecode), and for modulescripts, it will check if it has vulnerable names, executor apis, and dynamic execution calls, it will check if there is obfuscation, and webhooks/urls, debug library abuses are checked, and it will check if it creates new scripts or load any external source code, and for localscript, it will check if it uses PromptProductPurchaseFinished or PromptGamepassPurchaseFinished, and if it contains those, you can just use 7yd7 gamepass, and will check if there is weak anti-cheats inside localscripts, and if they do, you can just disable or delete it, and it will check if they send remotes in localscripts (maybe some that tells to ban people), and if they contain it, you can use it to abuse that power, or disable it to avoid getting bans.