Advertisement
aquafina120

Untitled

Nov 9th, 2016
111
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 5.64 KB | None | 0 0
  1. local Exploits, Successes, AddressList, NoRun, Interface = {}, {}, {}, {}, {};
  2. local GlobalOffset = "28";
  3.  
  4. function GetExploit(index)
  5. local tab, scan, result = Exploits[index], createMemScan(true);
  6. memscan_returnOnlyOneResult(scan, true);
  7. memscan_firstScan(scan, soExactValue, vtByteArray, rtTruncated, table.concat(tab[2], " "), nil, 0, 0x00FFFFFF, "", fsmNotAligned, nil, false, false, false, false);
  8. memscan_waitTillDone(scan);
  9. result = memscan_getOnlyResult(scan);
  10. if result == nil then return nil; end
  11. result = string.format("%X", result + tab[3]);
  12. result = string.rep("0", 8 - string.len(result)) .. result;
  13. return result;
  14. end
  15. function AddExploit(name, hex, offset)
  16. table.insert(Exploits, {name, hex, offset})
  17. end
  18. function toAddr(num)
  19. local num = tonumber(num);
  20. local addr = string.format("%X", num):upper();
  21. addr = string.rep("0", 8 - string.len(addr)) .. addr;
  22. return addr;
  23. end
  24.  
  25.  
  26. debugger_onBreakpoint = function()
  27. local function GetAddress(ESPaddr, Offset)
  28. local ESPaddr, Offset = tostring(ESPaddr) or string.rep("0", 8), tostring(Offset == nil and GlobalOffset or Offset);
  29. local SCaddr_base = tonumber("0x" .. ESPaddr) + tonumber("0x" .. Offset);
  30. local SCaddr_cont1, SCaddr_cont2, SCaddr_cont3, SCaddr_cont4 = tostring(string.format("%X", SCaddr_base)), tostring(string.format("%X", SCaddr_base + 1)), tostring(string.format("%X", SCaddr_base + 2)), tostring(string.format("%X", SCaddr_base + 3));
  31. local SCaddr = (readBytes(SCaddr_cont1) + (readBytes(SCaddr_cont2) * 256) + (readBytes(SCaddr_cont3) * 65536) + (readBytes(SCaddr_cont4) * 16777216));
  32. return toAddr(SCaddr);
  33. end
  34. --if readBytes(GetAddress(toAddr(ESP), GlobalOffset), 1) == 0x0D then
  35. local JOIN_addr = GetAddress(toAddr(ESP), GlobalOffset);
  36. local JOIN_len = tonumber("0x"..GetAddress(toAddr(ESP), string.format("%X", tonumber("0x"..GlobalOffset) + 4)));
  37. local JOIN_script_tbl = readBytes(JOIN_addr, JOIN_len, true);
  38. local JOIN_script = "";
  39. table.foreach(JOIN_script_tbl, function(i, v) JOIN_script = JOIN_script .. string.char(v); end);
  40. local script = JOIN_script .. [==[--[[INSERT SCRIPTS HERE]]--]==]
  41. local memory = allocateSharedMemory("[ROBLOX]-ScriptTrainer", string.len(script) + 5);
  42. local mem = toAddr(memory);
  43. local len = toAddr(string.len(script));
  44. local success_catch = writeString(mem, script);
  45. writeBytes(ESP + tonumber("0x" .. GlobalOffset), tonumber("0x" .. mem:sub(7, 8)), tonumber("0x" .. mem:sub(5, 6)), tonumber("0x" .. mem:sub(3, 4)),tonumber("0x" .. mem:sub(1, 2)));
  46. writeBytes(ESP + tonumber("0x" .. GlobalOffset) + 4, tonumber("0x" .. len:sub(7, 8)), tonumber("0x" .. len:sub(5, 6)), tonumber("0x" .. len:sub(3, 4)),tonumber("0x" .. len:sub(1, 2)));
  47. --print("[FiveInjector]: Script Execution location " .. GetAddress(toAddr(ESP), GlobalOffset) .. " with length " .. tonumber("0x" .. len));
  48. pcall(function() debug_removeBreakpoint(EIP); end);
  49. debug_continueFromBreakpoint(co_run);
  50. messageDialog("studio.ashx found and " .. (success_catch and "Thejustifierx successful" or "failed to inject."), (success_catch and 2 or 1), 2);
  51. --else
  52. --debug_continueFromBreakpoint(co_run)
  53. --end
  54. end
  55.  
  56. function Exec()
  57. local unprotect_mem = {00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 01, 00, 01, 01, 01, 01, 01, 00, 01, 00, 01, 00, 00, 00, 01, 01, 01, 00, 00, 00, 00, 00, 01, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 00, 00, 01, 00, 00, 00}
  58. writeBytes("00F24118", unprotect_mem);
  59. pcall(function() object_destroy(Interface.MainFrame); end);
  60. Exploits, Successes, AddressList, Interface = {}, {}, {}, {};
  61. --AddExploit("level", {0x89, 0x74, 0x24, 0x0C, 0x89, 0x06, 0xE8}, 4)
  62. AddExploit("script", {0x83, 0xEC, 0x14, 0x56, 0x57, 0x8B, 0x7C, 0x24, 0x2C, 0x85, 0xFF}, 3)
  63. for i, v in pairs(Exploits) do
  64. local exploit = GetExploit(i);
  65. if (exploit == nil) then
  66. print("[FiveInjector]: Failed \"" .. v[1] .. "\"");
  67. else
  68. pcall(function() debug_removeBreakpoint(exploit); end);
  69. debug_setBreakpoint(exploit);
  70. AddressList[v[1]] = exploit;
  71. table.insert(Successes, v[1]);
  72. print("[FiveInjector]: Success \"" .. v[1] .. "\" [" .. exploit .. "]");
  73. end
  74. end
  75. print("[FiveInjector]: " .. tostring(#Successes) .. "/" .. tostring(#Exploits) .. " exploits found.")
  76.  
  77. if #Successes == #Exploits then
  78. print("[FiveInjector]: Attached successfully. Listening for studio.ashx now...");
  79. else
  80. messageDialog("[FiveInjector]: Initializing failed. FiveInjector fails to launch", 1, 2);
  81. end
  82. end
  83.  
  84. function myCheck(_)
  85. local id = getProcessIDFromProcessName("RobloxPlayer.exe");
  86. if id ~= nil then
  87. for i, v in pairs(NoRun) do
  88. if v == id then
  89. return
  90. end
  91. end
  92. table.insert(NoRun, id);
  93. openProcess(id);
  94. debugProcess(2);
  95. Exec();
  96. else
  97. local id2 = getProcessIDFromProcessName("RobloxPlayerBeta.exe");
  98. if id2 ~= nil then
  99. for i, v in pairs(NoRun) do
  100. if v == id2 then
  101. return
  102. end
  103. end
  104. table.insert(NoRun, id2);
  105. openProcess(id2);
  106. debugProcess(2);
  107. Exec();
  108. end
  109. end
  110. end
  111.  
  112. t = createTimer(nil)
  113. timer_setInterval(t, 500)
  114. timer_onTimer(t, myCheck)
  115. timer_setEnabled(t, true)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement