Archangel: Difference between revisions

From the Garry's Mod Factions Wiki
Jump to navigation Jump to search
ST2005 (talk | contribs)
"No I would literally post the source code to babel here if you wanted" - March
Phil2014 (talk | contribs)
 
(7 intermediate revisions by 3 users not shown)
Line 8: Line 8:
}}
}}


'''The Archangel''' is a destructive type of antisteal under project Babel, developed by [[The Imperium|IMR]] and fielded by several members of Wojtek.
'''The Archangel''' is a destructive type of antisteal under project Babel, developed by [[The Imperium|IMR]] and fielded by several members of the Wojtek Pact. The functionality of the Archangel is currently classified. Upon deleting any dupe with the Archangel loaded, the Archangel would alert [[The Imperium|IMR]] leadership, then clear the entire "garrysmod/data" folder of the person who spawned the dupe. This would delete files critical to the production and use of ACF technology, such as E2s, Starfall Chips, and AdvDupe 2 contraption files. This was intended to ensure as much protection of the stolen dupe and its technology as possible by causing severe damage to the stealer's domestic industry. Furthermore, the Archangel targeted everyone on the server, save for people who had a special folder that would filter them out of the targeting process. The Archangel had a tight set of conditions that had to be satisfied to be activated, these conditions were the following:


The functionality of the Archangel was classified initially, but the script was dumped by independent members on April 18th and documented extensively. Once a chip with the Archangel is destroyed, it would alert [[The Imperium|IMR]] leadership by sending a message to Discord over a webhook, then wipe `garrysmod/data` folder of all connected players (except players who have directory called `vqzy` there) and proceed to fill them with junk data.
# The server had to have ULX.
# E2 had to have 'concmd' enabled.
# The stolen vehicle had to be despawned by an unauthorized user.
# Said unauthorized user had to be a superadmin.


== First Coming of the Archangel ==
=== Deployment ===
On the 15th of April, 2026, Computeration would ask Sergei, Plab, March and Upa to connect to Engineering Sandbox, an ACF-2 sandbox server owned by Jordi. Shortly after KATO spawning the Striker, which was loaded with the Archangel, Radd would be given owner rank, and all 4 members would be banned off the server for 5 minutes. Upon returning, none of the IA members were still on the server. It is presumed the dupesteal took place during these 5 minutes. Later on, the Archangel notified [[The Imperium|IMR]]'s leaders of a stolen dupe being spawned on Engineering Sandbox and wiped data folders of all connected players.
The Wojtek Pact and Jordi's Federal Agency of Intelligence [FAI] had ongoing hostilities on the latter's capital server, Engineering Sandbox, which used the deprecated ACF-2 addon. Because the server was owned by Jordi, and supported by the fact that Jordi was in possession of old IMR tanks, Wojtek and IMR feared that the server would be a prime location for the enemy to steal their dupes. The Archangel was mounted on every Wojtek and IMR vehicle spawned on the server to maximize security.


Shortly after the script's gist was dumped, the discord webhook was deleted and the gist was made unavailable.
On the 15th of April, 2026, Computeration challenged Sergei, Plab, March and Upa to fight on Engineering Sandbox. March deployed the Striker, a bait tank, to see if Jordi would refrain from or give in to dupestealing. In the middle of fighting, Mr. Radd, an allegedly retired member of the Imperial Alliance, was granted ULX owner permissions and subsequently banned every Wojtek and IMR member present for 5 minutes. When Wojtek-IMR forces rejoined, all FAI and IA members had left the server. On the 17th of April, Wojtek and IMR both received news that Jordi's data folder had been wiped by the Archangel. To prevent excess collateral damage or weaponization by hostile entities, Archangel was quickly decommissioned.


== Mechanism ==
=== Aftermath ===
News reached Wojtek and IMR via Ratakis, an IA member, complaining about Jordi's data folder being wiped in the GMA discord. While Jordi's data folder was wiped, it was presumed that he would recover his assets through Discord channels over time. While the Archangel was designed to be a lesson against dupe theft, Jordi was defended by GMAP and IA, accusing the Wojtek-IMR coalition of using malware to wipe Jordi's data folder, thus no lesson was learned.


=== Executor ("Archangel") ===
==== Coverup as an Investigation ====
In a tank only identified as "ape.txt", there was an E2 that hooked in event "removed()", in which it made a `concmd()` call that would run a `ulx luarun` in console, supplied with a script that would download, compile and run a snippet formerly available at [https://gist.github.com/rcl-rca/d829982aa8478d386e1af4fb3728c6ce this link]. It would then be executed on the server console. Notably, despite claiming that the dupe had to be removed voluntarily, having being hooked in "removed" event means that this would get triggered upon destruction, map cleanups and other involuntary means. Also, the archangel checks if the owner is a super admin, so the executor would refuse to run if `IsSuperAdmin()` doesn't return true for the owner's rank.
After March uploaded [https://youtu.be/AFf8WaFTYKg?si=IqJ6HE6THm1SXL2s a video] exposing Jordi for dupe theft, Jordi immediately commented that they were under duress from Mr. Radd. Since the video recognized that blaming Radd was a possible strategy for IA, Jordi rapidly changed his tone from somber to confident. Jordi then changed the story to claim that stealing the tank was meant to be part of an investigation into the Striker.
[[File:JordiPart1.png|thumb|526x526px|Jordi's initial comment claiming he was under duress.]]
[[File:JordiPart2.png|thumb|523x523px|Jordi then replaced the above comment with ridicule.]]
[[File:JordiPart3.png|thumb|523x523px|Jordi's new story claiming it was an investigation.]]


=== Payload ("Babel") ===
==== IA's Defense ====
The actual script defines two strings that contain Lua functions. Those functions are written in what initially appeared as an obfuscated form, but actually had to be shrinked to fit pre-April Update character limit.
After hearing of the incident, Xgonn and Crisis, retired IA members, confronted March and Arna on the use of the Archangel. Xgonn claimed that it was malware, an argument that became a popular talking point amongst GMAP and Jordi. Furthermore, Xgonn argued that Wojtek and IMR had no right to protect any of their dupe files, even though anti-steal systems have existed alongside the history of competitive ACF combat.
 
[[File:XgonnsDefense.png|thumb|523x523px|Xgonn claiming that nobody is entitled to protecting their dupe files from theft.]]
First script is titled "Erase". First, it checks if the local player has a folder called "vqzy" in their "data" folder. If they don't, it defines a function "P_(p,c,a)", which has been independently defined to be "RecursiveWipe(offset,flag)". RecursiveWipe method first removes all files, then calls itself on all directories (hence "recursive" wipe), if flag is a truthy value (number 1 used internally) then the current directory will be deleted. After defining the function, RecursiveWipe is called with a single empty string argument.
 
Second script is titled "Fill". It does a vqzy-check, after which it defines a string "n", independently defined to be "filename". The filename is set to current system time stamp (with dots replaced by underscores) and ".txt" appended at the end. Then, it creates a file handle in data folder. Then, for a random amount of iterations between 50000 and 99999, it generates a number in range (-946993;3584912846.13), where it's converted to a string and written to the end of the file. (The actual algorithm for generating junk data is: `math.random() * math.Rand(-946993, math.exp(22))`).
 
Directly under each subscript definitions, there's a for-loop that iterates over all connected players and calls Player.SendLua with the respective script. What this means is that Archangel is indiscriminate and, rather than "only punishing dupestealers", is "only avoiding whitelisted players", which puts innocent randoms at risk equal to that of dupestealers.
 
<nowiki>After sending malicious payloads, a table called "FriendlyMessages" is defined with following strings: "im a fucking PEDOPHILE", "heil hitler i hate (((jews)))", "i was OWNED by the duopoly.... fuck niggers i love raping kids haha", "i am BLACK OWNED. GLORY TO ISRAEL", "fill me with your crew", "im sorry for being IA. please punish me with your bibisi", "im sorry for being IA. im sorry for being IA. im sorry for being IA. im sorry for being IA.", "I’m not taking my ABS off, I am breachers o’ toole!", "CONQUERED, not STOLEN". Then, a timer called "IN_CQNTRQL" is created and set to run every second indefinitely. In that timer, server's sv_location variable is changed to "ru" to make a Russian flag appear in the master list, server's hostname variable is changed to "卐 卍 N1993RLAND SIEG AND R@PE - ⚡︎⚡︎ 14,88 ⚡︎⚡︎ - HE1L H1TLER RP - CP ON DOWNLOAD 卐 卍", and PrintMessage function is called to print message "KATO$$$$CONTROLLING:::####{{ MOUNTING ACF-3 TO SERVER$$$;&@928247" to all connected players' HUD center. Then, admins are sent a script that chooses one of the FriendlyMessages, chooses an number from 0 to 4 and makes admins repeat the chosen message at the chosen interval.</nowiki>
 
Finally, a function that generates a server player list is defined. It returns a single linebreak-delimited string. After defining the function, an HTTP POST request is made to [https://discord.com/api/webhooks/1482857101016437072/2aT5_pyrxWe5jTV7NGnCRHBfbYxXVPNOVHGnlANV5OEQGD-Isxq9s6Sd0cObz1wQfvlD this webhook] (long removed, used to be called "Archangel") with a message titled "P0 'Babel'" that carries server name and IP, map name, player count and list of players generated by the function defined immediately before.
 
== Criticism ==
As mentioned previously, Babel obviously puts innocent players at risk. However, the gist history shows that a month prior, it had Jordi-specific references (e.g. "im sorry for being IA" message and the ACF-3 joke") and no KATO, KXMI or IMR members have admin permissions (ranks for which call to `IsSuperAdmin()` would return true), so it's not entirely unthinkable that such a mechanism would only ever be triggered on Engineering Sandbox. Regardless, it puts random innocent players at risk and that none happened to decide to check Engineering Sandbox out on April 15th is a lucky occasion.
 
== Reaction ==
Since the First Coming, Archangel users would always claim that only people guilty of intentional dupe theft would be affected, which is objectively false. On May 27th, in Space Sandbox Server's discord server, when ST2005 (the person who archived the antisteal soon after the First Coming) jokingly brought up "KATO Virus" offhandedly, KMI member Faisal and KATO member March confronted him about calling it a "virus". Over the course of conversation, however, March publicly confirmed the criticism described above, but tried to downplay it by completely denying the possibility that a random passer-by would ever join Engineering Sandbox. After that, March tried to accuse ST2005 of "pulling him into drama" even though March wasn't mentioned before the conversation, then March and Arna tried discrediting ST2005's programming abilities likely to debunk the above analysis with their most prominent argument being "you say table of entities, therefore you don't understand programming", but it doesn't matter because March, a person who confirmed that he has read the Babel source code and understands how it works, has confirmed the criticism described above, therefore making criticism of ST2005's programming abilities irrelevant.
 
== Sources ==
[https://pastebin.com/wPkqPUF4 Backed-up source code of Babel]
 
[https://pastebin.com/nVE2YsbH E2 chip with Archangel executor]
[[Category:Technology]]
[[Category:Technology]]

Latest revision as of 00:25, 5 June 2026

Archangel
General information
TypeDestructive Antisteal
DesignerIMR
History
In service15.03.2026 - 19.04.2026
OutcomeJordi's data folder wiped

The Archangel is a destructive type of antisteal under project Babel, developed by IMR and fielded by several members of the Wojtek Pact. The functionality of the Archangel is currently classified. Upon deleting any dupe with the Archangel loaded, the Archangel would alert IMR leadership, then clear the entire "garrysmod/data" folder of the person who spawned the dupe. This would delete files critical to the production and use of ACF technology, such as E2s, Starfall Chips, and AdvDupe 2 contraption files. This was intended to ensure as much protection of the stolen dupe and its technology as possible by causing severe damage to the stealer's domestic industry. Furthermore, the Archangel targeted everyone on the server, save for people who had a special folder that would filter them out of the targeting process. The Archangel had a tight set of conditions that had to be satisfied to be activated, these conditions were the following:

  1. The server had to have ULX.
  2. E2 had to have 'concmd' enabled.
  3. The stolen vehicle had to be despawned by an unauthorized user.
  4. Said unauthorized user had to be a superadmin.

Deployment

The Wojtek Pact and Jordi's Federal Agency of Intelligence [FAI] had ongoing hostilities on the latter's capital server, Engineering Sandbox, which used the deprecated ACF-2 addon. Because the server was owned by Jordi, and supported by the fact that Jordi was in possession of old IMR tanks, Wojtek and IMR feared that the server would be a prime location for the enemy to steal their dupes. The Archangel was mounted on every Wojtek and IMR vehicle spawned on the server to maximize security.

On the 15th of April, 2026, Computeration challenged Sergei, Plab, March and Upa to fight on Engineering Sandbox. March deployed the Striker, a bait tank, to see if Jordi would refrain from or give in to dupestealing. In the middle of fighting, Mr. Radd, an allegedly retired member of the Imperial Alliance, was granted ULX owner permissions and subsequently banned every Wojtek and IMR member present for 5 minutes. When Wojtek-IMR forces rejoined, all FAI and IA members had left the server. On the 17th of April, Wojtek and IMR both received news that Jordi's data folder had been wiped by the Archangel. To prevent excess collateral damage or weaponization by hostile entities, Archangel was quickly decommissioned.

Aftermath

News reached Wojtek and IMR via Ratakis, an IA member, complaining about Jordi's data folder being wiped in the GMA discord. While Jordi's data folder was wiped, it was presumed that he would recover his assets through Discord channels over time. While the Archangel was designed to be a lesson against dupe theft, Jordi was defended by GMAP and IA, accusing the Wojtek-IMR coalition of using malware to wipe Jordi's data folder, thus no lesson was learned.

Coverup as an Investigation

After March uploaded a video exposing Jordi for dupe theft, Jordi immediately commented that they were under duress from Mr. Radd. Since the video recognized that blaming Radd was a possible strategy for IA, Jordi rapidly changed his tone from somber to confident. Jordi then changed the story to claim that stealing the tank was meant to be part of an investigation into the Striker.

Jordi's initial comment claiming he was under duress.
Jordi then replaced the above comment with ridicule.
Jordi's new story claiming it was an investigation.

IA's Defense

After hearing of the incident, Xgonn and Crisis, retired IA members, confronted March and Arna on the use of the Archangel. Xgonn claimed that it was malware, an argument that became a popular talking point amongst GMAP and Jordi. Furthermore, Xgonn argued that Wojtek and IMR had no right to protect any of their dupe files, even though anti-steal systems have existed alongside the history of competitive ACF combat.

Xgonn claiming that nobody is entitled to protecting their dupe files from theft.