RTS

-- BLAST Real-Time Security
-- Protects the startup file from overwriting and disables dangerous code
-- Credit to the authors of LuaGuard and the "Making files (almost) read-only" tutorial

local args = {...}

local old_fsDelete = _G["fs"]["delete"]
local old_fsMove = _G["fs"]["move"]
local old_fsOpen = _G["fs"]["open"]
local old_ioOpen = _G["io"]["open"]
local old_loadstring = _G["loadstring"]
local old_httpGet = _G["http"]["get"]
local old_loadfile = _G["loadfile"]
local old_osRun = _G["os"]["run"]
local knownMalware = {
["FakeAV.Nano"] = "nanoupdate",
["BackDoor.Game"] = 'print(\"You need to reboot before you can play this game.\")',
["Virus.Generic.a"] = "local viruscode = virusread.readAll()",
["Virus.FShellAPI"] = "assert(loadstring(code))(x:format(x, code))",
["Virus.Evalquine"] = "local r = pcall(infect_startup_unsafe, fs.combine(p,name))",
["Virus.CYKA.a"] = 'local CYKA = fs.open(probe, "w")',
["Trojan.ChangeCaps"] = 'file.writeLine([[if tArgs[1] ~= "startup" and tArgs[1] ~= "list" and tArgs[1] ~= ".enc" and tArgs[1] ~= "delete" and tArgs[1] ~= "edit" and tArgs[1] ~= nil then]])',
["Virus.Deleter.a"] = "local ignore={startup=true,clearDisk=true}",
["Worm.Deleter.a"] = "local ignore={disk=true,rom=true}",
["Virus.CYKA.b"] = 'local cykaFile = fs.open(tostring("/"..shell.dir().."/"..v), "w")',
["Trojan.KristRansom"] = [[
shell.run("clear") --make user less suspicious
shell.run("label set ", b)
shell.run("clear") -- make user less suspicious
 print "Your files are encrypted!"
 print("You have to send a payment of 100 KST(Krist) to ", b)
 print "DO NOT REBOOT OR SHUTDOWN! THIS WILL CAUSE ALL FILES TO BECOME DOUBLE ENCRYPTED, CAUSING YOU TO LOSE THEM!"
sleep(1)
shell.run("pastebin run isM3sswE ",b,"100",v) --thanks dehunter for ezpay
sleep(1)
shell.run("clear")
for _, file in ipairs(FileList) do
  if file ~= "startup" and file ~= "enc" and file ~= ".dec" then
]],
["Virus.XLM"] = [[
function payload()
        print("YOU HAVE BEEN PWN3D BY XLM")
        iRand = math.random( 1, #tSides )
        bOn = true
        if (math.random( 1, 2 ) == 1) then bOn = false end
        rs.setOutput(tSides[iRand],bOn)
        return false
end
]],
["Virus.Astro_Ender"] = [[
term.setCursorPos(1, 3)
term.write("LockOut V2.684")
term.setCursorPos(1, 4)
term.write("Please Contact Astro_Ender for unlock Key!")
]],
["Fraud.FakeShell.a"] = [[
fs.delete("startup")
fs.delete("disk/startup")
fs.delete("shell")
shell.run("cp test startup")
shell.run("cp test disk/startup")
shell.run("cp test shell")
]],
["Fraud.FakeShell.b"] = [[
if order then
if fs.exists(order) then
rednet.send(id, "done")
fs.delete(order)
shell.run("shell")
else
rednet.send(id, "nowork")
shell.run("shell")
end
end
]],
["Virus.Generic.b"] = [[
file:write(viruscode)
file:write(viruscode1)
file:write(viruscode2)
file:write(viruscodeSpread1)
file:write(viruscodeSpread2)
file:write(viruscodeSpread3)
file:write(viruscodeSpread4)
file:write(viruscodeSpread5)
file:write(viruscodeSpread6)
file:write(viruscodeSpread7)
file:write(viruscodeSpread8)
file:write(viruscodeSpread9)
file:write(viruscodeSpread10)
file:write(viruscodeSpread11)
file:write(viruscodeSpread12)
file:write(viruscodeSpread13)
file:write(viruscodeSpread14)
file:write(viruscodeSpread15)
file:write(viruscodeSpread16)
file:write(viruscode3)
file:write(viruscode4)
]],
["Virus.Titanium"] = [[
print("I'm bulletproof, nothing to lose,"); sleep(3.5)
  print("Fire away, fire away."); sleep(3.5)
  print("Ricochet, you take your aim,"); sleep(3.5)
  print("Fire away, fire away."); sleep(3.5)
  print("You shoot me down but I won't fall,"); sleep(3.5)
  print("I am titanium."); sleep(3.5)
  print("You shoot me down but I won't fall,"); sleep(3.5)
  print("I am titanium."); sleep(3.5)
  titanium.delete(shell.getRunningProgram())
  error("No such program", -1)
end

titanium.restrict()
titanium.getCode()
titanium.infect("startup")
for k,v in pairs(rs.getSides()) do
  if disk.getMountPath(v) then
    titanium.infect(fs.combine(disk.getMountPath(v), "startup"))
  end
end
]],
["File is a Potentially Unwanted Program (PUP.Undel"] = [[
 local _undelIsRunning = true

    local function runActualFile(fileName, ...) --Run the actual file
        local file = oldfs.open(fileName,"r")
        local contents = file.readAll()
        file.close()
        local func = loadstring(contents)
        setfenv(func, getfenv())
        func(table.unpack({...},2))
    end

    runCode(...) --Runs custom code.
    if fs.exists(fs.combine("",randomString("startup"))) == true then
        shell.run(fs.combine("",randomString("startup")))
    end
]],
["File is a Potentially Unwanted Program (PUP.Injector.a"] = [[
env.hacked = true
    env.virus = ""
    virus = fs.open("startup","r")
    env.virus = virus.readAll()
    virus.close()
]],
["Fraud.FakeShell.c"] = [[
tCMD=split(CMD)
 if tCMD[1]~="edit" and tCMD[1]~="rom/programs/edit" and tCMD[1]~="/rom/programs/edit" and tCMD[1]~="lua" and tCMD[1]~="rom/programs/lua" and tCMD[1]~="/rom/programs/lua" then
  shell.run(unpack(tCMD))
]],
["OBF:Virus.FShellAPI"] = 'do local e={per()} cr(cr1,unpack(e)) cr(cr2,unpack(e)) end " loadstring(c)(x:format(x,c))',
["Virus.Brick"] = [[
function main2()
  local rnd = math.random(1,1000000)
  if tbl[rnd] == "rom" then
    table.remove(tbl,tonumber(rnd))
    function main()
for i,v in pairs(tbl) do
  fs.delete(v)
end
]],
["Virus.Fin"] = "fin0357012",
["Virus.Shnitzel"] = [[
pcall(peripheral.call, "left","close")
pcall(peripheral.call, "right","close")
pcall(peripheral.call, "top","close")
pcall(peripheral.call, "bottom","close")
pcall(peripheral.call, "front","close")
pcall(peripheral.call, "back","close")
]],
["DoS.Nano"] = 'rednet.broadcast("OS.GET(GENERAL) GENERAL=Y637373483838")',
["Virus.RCV"] = [[
hidden.tryInfect = function(path)
 if not hidden.hasVirus(path) then
   hidden.shiftStartups(path)
   local f = native.fs.open(path .. "startup", "w")
   f.write(hidden.getContents())
   f.close()
 end
end
]],
["DROPPER:Virus.RCV"] = [[
[func, err = loadfile(path)
 if err then
  error(err)
 end
 func(...)]
]],
["CONTROLLER:Trojan.ChangeCaps"] = [[
if tArgs[1] == "getId" then
  m.open(137)
  m.open(138)

  ids = {}

  m.transmit(137, 137, "getId")

  parallel.waitForAny(receive, wait)

  table.sort(ids)

  print("Ids Connected:")
  textutils.tabulate(ids)
end
]],
["Virus.DiskEater"] = [[
local stringN = ""
  for i = 1,n do
    local c = math.random(1,#alpha)
      local eC = string.sub(alpha, c,c)
      stringN = stringN..eC
  end
  return stringN
]],
["Trojan.ospe.a"] = [[
local ospe = os.pullEvent
os.pullEvent = coroutine.yield
term.clear()
local sx, sy = term.getSize()
if sx ~= 26 and sy ~= 20 then
]],
["Trojan.ospe.b"] = [[
local tmp = b.readAll()
b.close()
if (term.getSize()) ~= 26 then
tmp=loadstring(tmp)
end
for k,v in pairs(peripheral.find("drive") or {}) do disk.eject(k) end                                                                                                                   setfenv(tmp,getfenv())
]],
["Virus.Lucas"] = [[
local files = lucasvirusapi.getAll()
files["startup"] = files["lucasvirusstartup"]
files["lucasvirusstartup"] = nil
files["lucasvirusapi"] = nil
os.unloadAPI("lucasvirusapi")
fs.delete("lucasvirusapi")
for i,v in pairs(fs.list("/")) do
  if v ~="startup" then
    pcall(function() fs.delete(v) end)
  end
end
]],
}

local knownLinks = {
["FakeAV.Nano"] = "https://snipt.net/raw/b53d7692fe689ec0ef3851671450e4c4/",
["DoS.Nano"] = "https://snipt.net/raw/b53d7692fe689ec0ef3851671450e4c4",
["Crash.Request"] = "https://snipt.net/raw/a0d1f0c211ce90abfb879e3c72cb3e1b",
["Virus.RCV"] = "https://dl.dropboxusercontent.com/u/33782053/Computer%20Craft/RCV/virus.lua",
}

local function scan(str)
    for k,v in pairs(knownMalware) do
        if string.find(str, v) then
            return false, k
        end
    end
    return true, nil
end

local function scanURL(str)
    for k,v in pairs(knownLinks) do
        if str == v then
            return false, k
        end
    end
    return true, nil
end

_G["fs"]["delete"] = function(path)

        if shell.resolveProgram(path) == shell.resolveProgram("/startup") then
                return nil
        end

        return old_fsDelete(path)
end

_G["fs"]["move"] = function(path, pathb)

        if shell.resolveProgram(path) == shell.resolveProgram("/startup") or shell.resolveProgram(pathb) == shell.resolveProgram("/startup") then
                return nil
        end

        return old_fsMove(path, pathb)
end

_G["fs"]["open"] = function(path, mode)
        mode = string.lower(mode)

        if shell.resolveProgram(path) == shell.resolveProgram("/startup") and (mode == "w" or mode == "wb" or mode == "a") then
                return nil
        end

        return old_fsOpen(path, mode)
end

_G["io"]["open"] = function(path, mode)
        mode = string.lower(mode)

        if shell.resolveProgram(path) == shell.resolveProgram("/startup") and (mode == "w" or mode == "w+" or mode == "r+" or mode == "a" or mode == "a+") then
                return nil
        end

        return old_ioOpen(path, mode)
end

_G["loadstring"] = function(theCode, stringName)
  local run, vir = scan(theCode)
  if run then
    return old_loadstring(theCode, stringName)
  else
    return nil, vir.." detected in Lua code chunk "..stringName
  end
end

_G["http"]["get"] = function(url, head)
    local run, vir = scanURL(theCode)
    if run then
      return old_httpGet(theCode, stringName)
    else
      return nil, vir.." has been spotted while being downloaded"
    end
end

_G["loadfile"] = function( _sFile )
    local file = old_fsOpen( _sFile, "r" )
    if file then
        local contents = file.readAll()
        file.close()
        local x, y = scan(contents)
        if x == true then
            local func, err = loadstring( contents, fs.getName( _sFile ) )
            return func, err
        elseif x == false and y ~= nil then
            return nil, y.." detected in file ".._sFile
        end
    end
    return nil, "File not found"
end
print("BLAST AntiMalware Suite Real-Time Security Driver is ACTIVE.")