Проверка скриптов и плагинов на вредоносное ПО

lemonager

;)
Автор темы
Всефорумный модератор
809
1,709
Версия SA-MP
  1. Любая
nX15Ep5.png

eNo5cSj.png

Общая тема для просьб о помощи проверки скриптов, плагинов и приложений.
Теперь не нужно создавать много отдельных тем о помощи с проверкой.

Рекомендации:
  1. Ставить к себе в игру что-либо с темы крайне не рекомендуется, если файл не был проверен опытным пользователем или Вы в нём сомневаетесь.
  2. Сообщения по типу "спасибо, помог" по правилам форума считаются флудом и будут удалены. Если вам помогли, вы можете нажать кнопку Мне нравится под ответом - это даст понять, что ответ верный.
eNo5cSj.png

qJTRxhB.png
 

JotaroStar

Потрачен
101
8
Обратите внимание, пользователь заблокирован на форуме. Не рекомендуется проводить сделки.
Чист?
 

Вложения

  • tram.luac
    190.1 KB · Просмотры: 3

xinata9

Участник
37
5
|>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<|
|> | AntiStealer | V5.2.5 | By DarkP1xel | .LOG File | <|
|> Official Web-Site: https://blast.hk/ <|
|> Subscribe to my YouTube Channel: https://vk.cc/5PCsTe <|
|> Official Topic: https://blast.hk/threads/16018/ <|
|> DONATE: https://qiwi.me/antistealer/ <|
|> KEEP CALM AND SMOKE SOME WEED <|
|> !AntiStealer LOADED! <|
|>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<|

[PATCHED] > [Process32First] > [C:\Games\GTA San Andreas\fixFTH.asi]
[PATCHED] > [WinHttpConnect] > [C:\Games\GTA San Andreas\_ci.asi] > {pswzServerName: f0446239.xsph.ru | nServerPort: 80}
[PATCHED] > [ZwOpenProcess] > [C:\WINDOWS\System32\KERNELBASE.dll] > {DesiredAccess: 1040}
[PATCHED] > [K32EnumProcessModules] > [C:\WINDOWS\SYSTEM32\amdihk32.dll] > {hProcess: BAD PROCESS}
[PATCHED] > [ZwOpenProcess] > [C:\WINDOWS\System32\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\WINDOWS\System32\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\WINDOWS\System32\KERNELBASE.dll] > {DesiredAccess: 1040}
[PATCHED] > [K32EnumProcessModules] > [C:\WINDOWS\SYSTEM32\amdihk32.dll] > {hProcess: BAD PROCESS}
[PATCHED] > [ZwOpenProcess] > [C:\WINDOWS\System32\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\WINDOWS\System32\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\WINDOWS\System32\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\WINDOWS\System32\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\WINDOWS\System32\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\WINDOWS\System32\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\WINDOWS\System32\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\WINDOWS\System32\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwSetInformationFile] > [C:\WINDOWS\System32\KERNELBASE.dll] > {FileInformationClass: HIDE}
[WARNING] > [gethostbyname] > [C:\Games\GTA San Andreas\samp.dll] > {name: DESKTOP-2L210CM}
[WARNING] > [URLDownloadToFileA] > [C:\Games\GTA San Andreas\MoonLoader.asi] > {szURL: https://blast.hk/moonloader/data/version-info.json | szFileName: C:\Users\SKY\AppData\Local\Temp\moonloader-version.json}
[WARNING] > [URLDownloadToFileW] > [C:\WINDOWS\SYSTEM32\urlmon.dll] > {szURL: https://blast.hk/moonloader/data/version-info.json | szFileName: C:\Users\SKY\AppData\Local\Temp\moonloader-version.json}
[WARNING] > [InternetOpenW] > [C:\WINDOWS\SYSTEM32\urlmon.dll] > {lpszAgent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Zoom 3.6.0)}
[WARNING] > [InternetConnectW] > [C:\WINDOWS\SYSTEM32\urlmon.dll] > {lpszServerName: blast.hk | lpszUserName: - | lpszPassword: -}
[WARNING] > [InternetConnectA] > [C:\WINDOWS\SYSTEM32\WININET.DLL] > {lpszServerName: blast.hk | lpszUserName: - | lpszPassword: -}
[WARNING] > [HttpOpenRequestW] > [C:\WINDOWS\SYSTEM32\urlmon.dll] > {lpszObjectName: /moonloader/data/version-info.json}
[PATCHED] > [ZwQueueApcThread] > [C:\WINDOWS\System32\sechost.dll]
[WARNING] > [gethostbyname] > [C:\Games\GTA San Andreas\samp.dll] > {name: DESKTOP-2L210CM}
[WARNING] > [gethostbyname] > [C:\Games\GTA San Andreas\samp.dll] > {name: DESKTOP-2L210CM}
[WARNING] > [gethostbyname] > [C:\Games\GTA San Andreas\samp.dll] > {name: DESKTOP-2L210CM}
[WARNING] > [gethostbyname] > [C:\Games\GTA San Andreas\samp.dll] > {name: DESKTOP-2L210CM}
[WARNING] > [gethostbyname] > [C:\Games\GTA San Andreas\samp.dll] > {name: DESKTOP-2L210CM}
[WARNING] > [gethostbyname] > [C:\Games\GTA San Andreas\samp.dll] > {name: DESKTOP-2L210CM}
[WARNING] > [gethostbyname] > [C:\Games\GTA San Andreas\samp.dll] > {name: DESKTOP-2L210CM}
[WARNING] > [gethostbyname] > [C:\Games\GTA San Andreas\samp.dll] > {name: DESKTOP-2L210CM}
[WARNING] > [URLDownloadToFileA] > [C:\Games\GTA San Andreas\MoonLoader.asi] > {szURL: https://blast.hk/moonloader/data/version-info.json | szFileName: C:\Users\SKY\AppData\Local\Temp\moonloader-version.json}
[WARNING] > [URLDownloadToFileW] > [C:\WINDOWS\SYSTEM32\urlmon.dll] > {szURL: https://blast.hk/moonloader/data/version-info.json | szFileName: C:\Users\SKY\AppData\Local\Temp\moonloader-version.json}
[WARNING] > [InternetConnectW] > [C:\WINDOWS\SYSTEM32\urlmon.dll] > {lpszServerName: blast.hk | lpszUserName: - | lpszPassword: -}
[WARNING] > [InternetConnectA] > [C:\WINDOWS\SYSTEM32\WININET.DLL] > {lpszServerName: blast.hk | lpszUserName: - | lpszPassword: -}
[WARNING] > [HttpOpenRequestW] > [C:\WINDOWS\SYSTEM32\urlmon.dll] > {lpszObjectName: /moonloader/data/version-info.json}
[WARNING] > [gethostbyname] > [C:\Games\GTA San Andreas\samp.dll] > {name: DESKTOP-2L210CM}
[WARNING] > [gethostbyname] > [C:\Games\GTA San Andreas\samp.dll] > {name: DESKTOP-2L210CM}
[WARNING] > [gethostbyname] > [C:\Games\GTA San Andreas\samp.dll] > {name: DESKTOP-2L210CM}
[PATCHED] > [ZwOpenProcess] > [C:\WINDOWS\System32\KERNELBASE.dll] > {DesiredAccess: 4096}
 

JotaroStar

Потрачен
101
8
Обратите внимание, пользователь заблокирован на форуме. Не рекомендуется проводить сделки.
|>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<|
|> | AntiStealer | V5.2.5 | By DarkP1xel | .LOG File | <|
|> Official Web-Site: https://blast.hk/ <|
|> Subscribe to my YouTube Channel: https://vk.cc/5PCsTe <|
|> Official Topic: https://blast.hk/threads/16018/ <|
|> DONATE: https://qiwi.me/antistealer/ <|
|> KEEP CALM AND SMOKE SOME WEED <|
|> !AntiStealer LOADED! <|
|>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<|

[PATCHED] > [Process32First] > [C:\Games\GTA San Andreas\fixFTH.asi]
[PATCHED] > [WinHttpConnect] > [C:\Games\GTA San Andreas\_ci.asi] > {pswzServerName: f0446239.xsph.ru | nServerPort: 80}
[PATCHED] > [ZwOpenProcess] > [C:\WINDOWS\System32\KERNELBASE.dll] > {DesiredAccess: 1040}
[PATCHED] > [K32EnumProcessModules] > [C:\WINDOWS\SYSTEM32\amdihk32.dll] > {hProcess: BAD PROCESS}
[PATCHED] > [ZwOpenProcess] > [C:\WINDOWS\System32\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\WINDOWS\System32\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\WINDOWS\System32\KERNELBASE.dll] > {DesiredAccess: 1040}
[PATCHED] > [K32EnumProcessModules] > [C:\WINDOWS\SYSTEM32\amdihk32.dll] > {hProcess: BAD PROCESS}
[PATCHED] > [ZwOpenProcess] > [C:\WINDOWS\System32\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\WINDOWS\System32\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\WINDOWS\System32\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\WINDOWS\System32\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\WINDOWS\System32\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\WINDOWS\System32\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\WINDOWS\System32\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\WINDOWS\System32\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwSetInformationFile] > [C:\WINDOWS\System32\KERNELBASE.dll] > {FileInformationClass: HIDE}
[WARNING] > [gethostbyname] > [C:\Games\GTA San Andreas\samp.dll] > {name: DESKTOP-2L210CM}
[WARNING] > [URLDownloadToFileA] > [C:\Games\GTA San Andreas\MoonLoader.asi] > {szURL: https://blast.hk/moonloader/data/version-info.json | szFileName: C:\Users\SKY\AppData\Local\Temp\moonloader-version.json}
[WARNING] > [URLDownloadToFileW] > [C:\WINDOWS\SYSTEM32\urlmon.dll] > {szURL: https://blast.hk/moonloader/data/version-info.json | szFileName: C:\Users\SKY\AppData\Local\Temp\moonloader-version.json}
[WARNING] > [InternetOpenW] > [C:\WINDOWS\SYSTEM32\urlmon.dll] > {lpszAgent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Zoom 3.6.0)}
[WARNING] > [InternetConnectW] > [C:\WINDOWS\SYSTEM32\urlmon.dll] > {lpszServerName: blast.hk | lpszUserName: - | lpszPassword: -}
[WARNING] > [InternetConnectA] > [C:\WINDOWS\SYSTEM32\WININET.DLL] > {lpszServerName: blast.hk | lpszUserName: - | lpszPassword: -}
[WARNING] > [HttpOpenRequestW] > [C:\WINDOWS\SYSTEM32\urlmon.dll] > {lpszObjectName: /moonloader/data/version-info.json}
[PATCHED] > [ZwQueueApcThread] > [C:\WINDOWS\System32\sechost.dll]
[WARNING] > [gethostbyname] > [C:\Games\GTA San Andreas\samp.dll] > {name: DESKTOP-2L210CM}
[WARNING] > [gethostbyname] > [C:\Games\GTA San Andreas\samp.dll] > {name: DESKTOP-2L210CM}
[WARNING] > [gethostbyname] > [C:\Games\GTA San Andreas\samp.dll] > {name: DESKTOP-2L210CM}
[WARNING] > [gethostbyname] > [C:\Games\GTA San Andreas\samp.dll] > {name: DESKTOP-2L210CM}
[WARNING] > [gethostbyname] > [C:\Games\GTA San Andreas\samp.dll] > {name: DESKTOP-2L210CM}
[WARNING] > [gethostbyname] > [C:\Games\GTA San Andreas\samp.dll] > {name: DESKTOP-2L210CM}
[WARNING] > [gethostbyname] > [C:\Games\GTA San Andreas\samp.dll] > {name: DESKTOP-2L210CM}
[WARNING] > [gethostbyname] > [C:\Games\GTA San Andreas\samp.dll] > {name: DESKTOP-2L210CM}
[WARNING] > [URLDownloadToFileA] > [C:\Games\GTA San Andreas\MoonLoader.asi] > {szURL: https://blast.hk/moonloader/data/version-info.json | szFileName: C:\Users\SKY\AppData\Local\Temp\moonloader-version.json}
[WARNING] > [URLDownloadToFileW] > [C:\WINDOWS\SYSTEM32\urlmon.dll] > {szURL: https://blast.hk/moonloader/data/version-info.json | szFileName: C:\Users\SKY\AppData\Local\Temp\moonloader-version.json}
[WARNING] > [InternetConnectW] > [C:\WINDOWS\SYSTEM32\urlmon.dll] > {lpszServerName: blast.hk | lpszUserName: - | lpszPassword: -}
[WARNING] > [InternetConnectA] > [C:\WINDOWS\SYSTEM32\WININET.DLL] > {lpszServerName: blast.hk | lpszUserName: - | lpszPassword: -}
[WARNING] > [HttpOpenRequestW] > [C:\WINDOWS\SYSTEM32\urlmon.dll] > {lpszObjectName: /moonloader/data/version-info.json}
[WARNING] > [gethostbyname] > [C:\Games\GTA San Andreas\samp.dll] > {name: DESKTOP-2L210CM}
[WARNING] > [gethostbyname] > [C:\Games\GTA San Andreas\samp.dll] > {name: DESKTOP-2L210CM}
[WARNING] > [gethostbyname] > [C:\Games\GTA San Andreas\samp.dll] > {name: DESKTOP-2L210CM}
[PATCHED] > [ZwOpenProcess] > [C:\WINDOWS\System32\KERNELBASE.dll] > {DesiredAccess: 4096}
В каком-то скрипте автобнова.
 

zTechnology

Известный
1,101
485
CLEO:
{$CLEO .cs}

//-------------MAIN---------------
0000: NOP



wait 2100
gosub @CLEO
0AC6: 0@ = label @text offset
0AB1: call @TextInChat 1 text 0@
0AC6: 0@ = label @text2 offset
0AB1: call @TextInChat 1 text 0@

if 8AA2: 0@ = load_library "samp.dll" // IF and SET
then 0A93: end_custom_thread
end

var
    0@: integer
end
0AC6: 1@ = label @callback offset
0AC6: 2@ = label @cmdname offset

// write 31@ address to assembly code
1@ += 9
0AC7: 3@ = var 22@ offset                       
0A8C: write_memory 1@ size 4 value 3@ virtual_protect 1
1@ -= 9

1@ += 15
0AC7: 3@ = var 11@ offset                       
0A8C: write_memory 1@ size 4 value 3@ virtual_protect 1
1@ -= 15

11@ = 1 // zeroing 11 var
0AB1: call_scm_func @registerClientCommand 3 dwSAMPHandle: 0@ szCommandName: 2@ CallBack: 1@
jump @Noname_2599


:callback
hex
    51                      // push     ecx
    56                      // push     esi
    8B 74 24 0C             // mov     esi, [esp+0Ch]
    89 34 25 11 11 11 11    // mov     [11111111], esi
    83 35 11 11 11 11 01    // xor     [11111111], 01
    5E                      // pop     esi
    59                      // pop     ecx
    C3 // retn
end

:cmdname
hex
    "fd" 0
end

:registerClientCommand // unsigned long dwSAMPHandle, char szCommandName[], CMDPROC CallBack
var
    3@: integer
    4@: integer
end

3@ = 0@ // dwSAMPHandle
3@ += 0x26E8CC{SAMP_CHAT_INPUT_INFO_OFFSET} // struct
0A8D: 3@ = read_memory 3@ size 4 virtual_protect 1
4@ = 0@ // dwSAMPHandle
4@ += 0x69000{SAMP_FUNC_ADDCLIENTCMD} // function

0AA6: call_method 4@ struct 3@ num_params 2 pop 0 2@ 1@
0AB2: ret 0

:TextInChat
0AA2: 31@ = load_library "kernel32.dll" // IF and SET
0AA4: 30@ = get_proc_address "GetModuleHandleA" library 31@ // IF and SET
0AA7: call_function 30@ num_params 1 pop 0 "samp.dll" 3@
0A8E: 2@ = 3@ + 0x26E8C8
0A8D: 1@ = read_memory 2@ size 4 virtual_protect 1
0A8E: 2@ = 3@ + 0x67460
0AA6: call_method 2@ struct 1@ num_params 5 pop 0 params 0 0x636363  0 0@ 8
0AB2: ret 0

:text
hex
"[FogDistance | LUCHARE] {ffffff}Загружен! Для активации используй {636363}/fd [0-3600]" 00
end

:text2
hex
"{ffffff}Адаптация для RadmirRP - {fcad00}Serge_Ton [02].{ffffff} Отдельное спасибо {636363}D3.Pheonix [BH team]" 00
end



:Noname_2599
wait 0
00D6: if
0039:  11@ == 0
else_jump @Noname_2748
jump @on

:on
wait 0
if
12@ == 1
004D: jump_if_false @Noname_452
12@ = 0  
jump @Noname_452   




:Noname_2748
wait 0
00D6: if 
0039: 11@ == 1 
else_jump @Noname_2839 
jump @off

:off
wait 0
if
12@ == 0
004D: jump_if_false @Noname_452
12@ = 1  
jump @loop_off

:loop_off
wait 0
00D6: if 
0039: 11@ == 0 
else_jump @loop_off
jump @Noname_452



:Noname_2839
0002: jump @NONAME_77


:Noname_452
:NONAME_77 
wait 0 
if
11@ == 0 
else_jump @Noname_2599

0AD4: 4@ = scan_string 22@ format "%d" 32@ //IF and SET

008F: 30@ = integer 32@ to_float

0A8C: write_memory 0x00B7C4F0 size 4 value 30@ virtual_protect 0  //Y

0A8D: 16@ = read_memory 0x00B7C4F0 size 4 virtual_protect 0
0092: 17@ = float 16@ to_integer
if
17@ > 3600
else_jump @2


18@ = 3600
008F: 19@ = integer 18@ to_float
0A8C: write_memory 0x00B7C4F0 size 4 value 19@ virtual_protect 0  //Y
0A8D: 20@ = read_memory 0x00B7C4F0 size 4 virtual_protect 0
0092: 21@ = float 20@ to_integer
01E4: show_text_1number_lowpriority GXT 'NUMBER' number 21@ time 2000 flag 1  // ~1~
wait 2000
03D5: remove_text 'NUMBER'  // ~1~
11@ = 1
jump @Noname_452

:2 
01E4: show_text_1number_lowpriority GXT 'NUMBER' number 17@ time 2000 flag 1  // ~1~
wait 2000
03D5: remove_text 'NUMBER'  // ~1~
11@ = 1
jump @Noname_452
 
 

:CLEO 
0AC6: 0@ = label @HOOK offset
0@ += 0xB 
0085: 1@ = 0@
1@ += 0xE
0AB1: @asm_jmp_addr 3 offset 0@ function 1@ virtual_protect 1  
0@ += 0xA   
0085: 1@ = 0@
1@ += 0xE
0AB1: @asm_jmp_hook 3 offset 0@ function 1@ virtual_protect 1  
0@ += 0x12  
0AB1: @asm_jmp_hook 3 offset 0@ function 0x0055FCCF virtual_protect 1   

0AC6: 0@ = label @HOOK offset
0AB1: @asm_jmp_hook 3 offset 0x0055FCC8 function 0@ virtual_protect 1    
0A8C: write_memory 0x0055FCCD size 2 value 0x9090 virtual_protect 1 //NOP
return

:HOOK
hex
 9C                    // pushfd 
 60                    // pushad 
 8D 46 50              // lea eax,[esi+50]
 3D F0C4B700           // cmp eax,gta_sa.exe+77C4F0 { [800.00] }
 0F84 0A000000         // je 0E96001A
 61                    // popad 
 9D                    // popfd 
 D9 5E 50              // fstp dword ptr [esi+50]
 E9 02000000           // jmp 0E96001C
 8B 10                 // mov edx,[eax]
 D9 5E 50              // fstp dword ptr [esi+50]
 89 10                 // mov [eax],edx
 61                    // popad 
 9D                    // popfd 
 D9 44 24 18           // fld dword ptr [esp+18]
 E9 AAFCBFF1           // jmp gta_sa.exe+15FCCF
 90                    // nop
end // hex

//0AB1: @asm_jmp_hook 3 offset 1@ function 2@ virtual_protect 1
:asm_jmp_hook
0A8C: write_memory 0@ size 1 value 0xE9 virtual_protect 2@
0062: 1@ -= 0@ // (int)
000E: 1@ -= 5
0@ += 1
0A8C: write_memory 0@ size 4 value 1@ virtual_protect 2@
0AB2: ret 0
:asm_jmp_addr
0062: 1@ -= 0@ // (int)
000E: 1@ -= 4
0@ += 1
0A8C: write_memory 0@ size 4 value 1@ virtual_protect 2@
0AB2: ret 0T
вроде чист, но inet loader меня пугает
 

bebra1

Гений
154
31
Привет! скажите пж, есть ли тут стилеры?
 

Вложения

  • walt final.lua
    2.3 KB · Просмотры: 3
  • rwh.lua
    7.8 KB · Просмотры: 2