Nomalua -- GMod/Lua malware scanner (v1.20)

[Buzzkill]

Thrilled that it found something for you.  That made it worth it, right there.  Unfortunately I've begun realizing that the flexibility of the lua lexicon is so bloody vast that trying to detect bad code smells, anti patterns and malevolent code automatically is a fool's errand, so I've kinda let this project die a natural death. 

[LuaTenshi]

Why not change this into a sort of lua firewall? Catch all calls to external domains etc, etc... Also a net message firewall would be useful as many cheaters exploit net messages (Bridgehack).

[Buzzkill]

That's a good idea, though it would change the design pretty dramatically.  Right now this is an on-demand code scanner.  What you're suggesting would be more of a real-time intercept.  If I resurrect this thing at some point I may move in that direction though.  Code parsing was a bad idea. 

[WispySkies]

Sorry to bump this as nothing has been posted in a while, but can this be used to detect certain strings? In my start-up (singleplayer) when it says stuff like Pillpack loaded and all the ULX stuff is working & loaded (In the yellow text colour) I have one saying "fuckass". I would like to know if I can search my addons for the string "fuckass", because with some common sense that shouldn't be there. I haven't checked if any other of my addons have backdoors in them but this fuckass is more concerning to me than the rest of my addons.

EDIT: Someone told me I can use grep -R "fuckass" PATH and it found this.

Binary file /Users/NAME/Library/Application Support/Steam/steamapps/common/GarrysMod/garrysmod/addons/hyrule_warriors_-_midna_363147859.gma matches

P.S. Nothing wrong with midna, just a crappy

Code: Lua

1. print("fuckass")

. Although I got a monstrous list of OBFUSC encrypted xD

[Buzzkill]

. Although I got a monstrous list of OBFUSC encrypted xD

If you're searching the GMA directly, then yes,  that's to be expected, as gma files are obfuscated and (somewhat) compressed.  'fuckass' appears because it's a string literal and survives tokenization. You can use something like gma extractor to look at the actual contents of the gma.

Midna had to do a fair amount of custom animation tweakingin Lua to get the PM to work, so I suspect the print may have been a leftover bit from a late night debugging session. 

To answer your original question, yes, a custom pattern could have been added to sv_nomalua_checkdef to detect this or any other string of interest.

HTH

[otomcold]

Sorry for the bump

when trying to initiate the scan this lua error appears on my server side console (dedicated server using SerenityServers as host)

[ERROR] addons/nomalua/lua/sv_nomalua_utils.lua:30: table index is nil
  1. AddLuaFiles - addons/nomalua/lua/sv_nomalua_utils.lua:30
   2. CheckFiles - addons/nomalua/lua/sv_nomalua.lua:62
    3. StartScan - addons/nomalua/lua/sv_nomalua.lua:95
     4. unknown - addons/nomalua/lua/sv_nomalua.lua:106
      5. unknown - lua/includes/modules/concommand.lua:54

Has anyone come across this issue before?  This occured the moment I tried to launch the scan.

This seems like a very useful addon and I would love to use it ;\

[JamminR]

@otomcold - just to verify - you restarted your server after installing, yes?

[nex86]

it doesn't output anything in server console but dropping people off the server
is it supposed to show logs in console or seperate log file?

[JamminR]

it doesn't output anything in server console but dropping people off the server
is it supposed to show logs in console or seperate log file?

This does not log.
Nor does this show disconnects. (Though players may time out, from the readme.txt included "Nomalua is rather resource-intensive, so it's not recommended that you run it when the server is particularly busy. ")
This does not run realtime. It's a one time per command scan.
When installed, you run a command from console, it scans, and then reports to console what it finds that may or may not be potential danger.