# Is MainDab a virus? ## MainDab is not a virus {% hint style="info" %} **tl;dr** MainDab is not obfuscated, and you are free to inspect MainDab's code. {% endhint %} It comes as no surprise that there are many so-called "Roblox exploits" which are, in fact, malware! [In fact, you can easily find such malware on GitHub](https://github.com/search?q=roblox+exploit+keyless\&type=repositories\&s=updated\&o=desc). It is worth being concerned as to whether or not MainDab is malware. In this section, we will discuss whether or not MainDab is malware. If you just want to get started on using MainDab, skip to the next section. ### MainDab, as in the application MainDab acts as a frontend for interfacing with Roblox exploit APIs (libraries). If you were to download a Roblox exploit, the frontend for an exploit is where you are most likely to obtain malware from. #### Things proving MainDab is not a virus In summary, MainDab does not hide what it does from you, the user. * MainDab has a [single download source](https://maindab.gitbook.io/maindabdocs/downloading-maindab/downloading-maindab-1) - GitHub releases. As a safety precaution, only download MainDab from the MainDab GitHub Releases page. * MainDab is not obfuscated, meaning a [.NET decompiler](https://github.com/icsharpcode/ILSpy) can be used to inspect MainDab's code. * Applications that support MainDab, such as the WeAreDevs API key system bypass, is not obfuscated. A [.NET decompiler](https://github.com/icsharpcode/ILSpy) can be used to inspect such files. * MainDab's code is [publicly available on GitHub](https://github.com/Avaluate/MainDab/) and you are free to compile MainDab if you wish. * MainDab pushing malware would severely damage its reputation, especially considering MainDab is an organisation that has long moved on from Roblox exploiting. #### Things to be concerned about * MainDab requires elevated permission ("Run as Administrator") to run. This is due to how the WeAreDevs key system bypass works (i.e. admin required to run a web server on `localhost:443`). See: [Bypassing WRD Key System](https://maindab.gitbook.io/maindabdocs/maindab-faq/bypassing-wrd-key-system). * MainDab has an auto-update functionality which forces users to update to the newest version of MainDab. If MainDab's GitHub account were to be compromised, [a malicious update could be unknowingly pushed to you](https://www.sciencedirect.com/science/article/abs/pii/S1353485804001023). #### VirusTotal Scans VirusTotal is a service that scans files for potentially malicious items. VirusTotal scans are not as effective as decompiling MainDab and seeing the true nature of how MainDab operates. As of MainDab 15.2 REL (21 June 2025), here are the scanned items: * MainDab.exe: * MainDabDownloader.exe: * MainDabWRDWrapper.exe: see results for MainDabWRDWrapper.dll * MainDabWRDWrapper.dll: * WRDFakeServer.exe: ### WeAreDevs, as in the API MainDab acts as a front end for the WRD API and as such cannot control what WRD actually does. WRD API downloads files on its own. #### Things proving WRD is not a virus * Since WeAreDevs creation around \~2017 (or perhaps earlier), there has not been a single case of WRD being malware. * MainDab, since its creation on 22 February 2020, has used the WRD API. No malware was reported from the use of WRD. * None of the binaries used by WRD API are obfuscated. #### Things to be concerned about * WeAreDevs provides no documentation whatsoever into how it operates — it [only provides information on functions exported](https://wearedevs.net/d/Exploit%20API). * For instance, WRD creates a folder called `jjploit` in your Documents directory without any indication of such. WRD also hides the debugging console from the user (which MainDab mitigates). It is unknown why WRD chooses to hide debugging information from the user. * WRD also has its own [auto-update functionality](https://www.sciencedirect.com/science/article/abs/pii/S1353485804001023) like how MainDab does. #### VirusTotal Scans As of MainDab 15.2 REL (21 June 2025): * exploit.dll: * injector.exe: * WRD.dll: * wearedevs\_exploit\_api.dll: --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://maindab.gitbook.io/maindabdocs/downloading-maindab/is-maindab-a-virus.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.