MyGame
April 24th, 2017, 05:17 PM
Hi,
will x22 offer Roblox Exploit?
I found that interresting stuff how does it work.(From Pastebin):
__________________________________________________ __________________________________________________ __________________________________________________ ___
The idea
This is the idea in its most basic form:
1. We want unsigned script execution the client.
2. The client has no code that allows unsigned script execution, considering that thecompiler was removed entirely from the code.
3. Therefore, we must come with our own way to do script execution.
To achieve that, we must first understand how you get code running in Lua. Roblox usesLua for all of its in game scripts (LocalScripts, ModuleScripts and CoreScripts), so weobviously need to comprehend how we could possibly get Lua scripts running in Lua. Takenote that Roblox heavily modified their Lua version (more protection has been added tomake reverse engineering a pain more than anything).Once we understand how we can get code running in Lua, it’s just a matter of findinghow we could get that process to run without having the Lua compiler.
How Roblox runs LocalScripts
This is what Roblox does (client/server) to get LocalScripts running on the client:
1. Upon connecting to the Roblox server, the server sends the bytecode of everyexisting LocalScript in the game to the client that’s connecting for furtherusage, along with additional information concerning security and encryption. Thedata received also contains the bytecode’s hash, which is important.
2. The client then stores the received bytecode in a safe place and leaves itserialized and compressed.
3. When a LocalScript demands execution, the client will retrieve the bytecode fromits emplacement, decompress it, deserialize it then feed it to LuaVM::Load, whichis Roblox’s routine for loading bytecode retrieved from the server.a. Roblox’s deserializer will convert bytecode into a Proto structure, which wewill see later. This should ring a bell.
4. LuaVM::Load will then insert the resulting Proto into a Lua function (internallycalled as “LClosure”), which is then pushed onto the stack, reading for execution.To execute the function, you can simply use lua_call/lua_pcall, or lua_resume ifyou’re running said function inside of a coroutine.
Lua functions and what they are made of
● Each Lua function has a structure called a Proto. The proto contains a whole rangeof information concerning the function, such as the constants (and how many thereis), the number of upvalues the function uses, how much stack size is necessaryfor the function to operate and most importantly, the function’s code.
● A proto can only be ran if it’s inserted into an LClosure then fed toluaD_precall. This means that if you want to run a proto and its code, you’ll haveto create an LClosure then set the LClosure’s proto member to, well, the proto youwant to execute.
● Serialized lua bytecode is basically a proto represented as pure binary data.Lua’s undump function (luaU_undump) does the boring task of converting bytecodeinto the resulting proto, which then can be put inside of an LClosure then fed toluaD_precall… basically, same thing as the second point.
● In short: if you want to run any lua code, you must create a function (proto)first. Then you can feed that function to the lua API in order to execute it.However, Roblox does not have the Lua compiler for lua scripts, so what do we doinstead?
Presenting: Proto Conversion (pt. 1) (the good)
● What we could do to get functions to execute on the Roblox client is to create afunction through a normal Lua instance, then convert it to Roblox’s format soRoblox can execute it.
● On paper, it sounds like a really clever idea: after all, the only thing Robloxdid is change a few things to make it harder for us to run lua code, right?
● Sadly, that’s untrue. While Roblox’s Lua virtual machine is relatively the same(except for instructions and how they get the registers from them), they added ametric ton of security to make sure that any reverse engineer cannot do anythingto get unsigned lua functions running on their vm.
● However, this doesn’t mean it’s impossible. By bypassing Roblox’s checks and doingsome (stupid) things to get your code working, you can successfully attain stablescript execution on the client. Of course, the “stability” of your exploit dependson how good your code is. Bad code = Bad stability.
● Proof that it’s possible can be found everywhere: Seven, Intriga and Elysian areall exploits using proto conversion for script execution.
Presenting: Proto Conversion (pt. 2) (the bad)
● Proto Conversion, however, is not without risks: since you’re relying massively onRoblox’s codebase for script execution, them changing one single thing could breakyour exploit entirely.
● Additionally, there is still the possibility that Roblox’ll hire some new securityengineers that will prevent script execution through proto conversion for good. Inshort: proto conversion is
insecure.
● Proto conversion is also slightly slow, depending on your implementation. If youlook at Intriga, you’ll probably notice its slowness. Whether proto conversion iswhat affects Intriga’s speed is true or not, we do know that it can be slow.
● Let’s not forget that you have to reverse a lot of encryption and obfuscation too.Roblox has a lot of encryption in place to make sure that you can’t simply justchange an instruction or two and get everything working. They changed registers,xor’d constants and modified the instruction set enum, making conversion a pain inthe arse for certain reverse engineers.
● Again, this doesn’t mean that proto conversion is a bad idea. Despite being slow,it’s the fastest method out here to do script execution (next to CLVMs)
Presenting: Proto Conversion (pt. 3) (the “wat”)
● This might be surprising, but proto conversion is virtually the worse way to doscript execution, despite being the (second) fastest and how many people uses itfor their exploits, mostly because of how insecure it is and how you mustconstantly maintain your codebase to get it working.
● This, however, means that Roblox could have a hard time figuring out how the hellyour exploit works. I’m serious: a Roblox security engineer spent a month tryingto figure out how Seven worked (before he got the source from his creatorhimself), unable to comprehend what the exploit was doing. Hell, even afterreceiving the exploit’s code, Roblox is still unable to find a good way to patchthose exploits, despite having 10+ (lol) years of experience in computer securityand all of that bullshit.
● Yeah, “10+ years of experience in computer security”. That’s what Roblox requiresfor you to join their team and they somehow still aren’t able to come up withproper security that prevents us from doing anything bad to their client. Roblox,you seriously need to hire better engineers. Like me. Or anybody in Rain.
Presenting: Proto Conversion (pt. 4) (diagram)
Link: https://i.gyazo.com/b04e24b2162625471c9157143b2bb186.png
Notes
● The deserializer used to convert bytecode into Lua closures is unique to Roblox,as their format has been heavily modified.
● The deserializer also decompresses code -- Roblox uses LZ4 compression in order tomake their format hard to reverse AND to make it smaller when transferring thedump from the server to the client (ends up taking less bandwidth).
● The client also verifies the legitimacy of bytecode dumps by checking if theclient has the dump’s hash stored (as the client receives the hash upon connectingto the server). They use the xxHash algorithm for generating hashes with a seed(42 being the seed. Yeah, it’s that easy to figure out.)
● A weird thing is that they encrypt (xor + index in array) the bytecode dumpreceived by the server using the hash of the dump. This was known to beexploitable in the past (cough 1972 USNS Nuclear Plant incident cough), sosomething hacky could possibly be made with this.
● CoreScript bytecode is static: Servers DOES NOT recompile bytecode for CoreScriptseach time a server boots up. Instead, it uses a set of keys already existing onthe client for encryption and obfuscation.
will x22 offer Roblox Exploit?
I found that interresting stuff how does it work.(From Pastebin):
__________________________________________________ __________________________________________________ __________________________________________________ ___
The idea
This is the idea in its most basic form:
1. We want unsigned script execution the client.
2. The client has no code that allows unsigned script execution, considering that thecompiler was removed entirely from the code.
3. Therefore, we must come with our own way to do script execution.
To achieve that, we must first understand how you get code running in Lua. Roblox usesLua for all of its in game scripts (LocalScripts, ModuleScripts and CoreScripts), so weobviously need to comprehend how we could possibly get Lua scripts running in Lua. Takenote that Roblox heavily modified their Lua version (more protection has been added tomake reverse engineering a pain more than anything).Once we understand how we can get code running in Lua, it’s just a matter of findinghow we could get that process to run without having the Lua compiler.
How Roblox runs LocalScripts
This is what Roblox does (client/server) to get LocalScripts running on the client:
1. Upon connecting to the Roblox server, the server sends the bytecode of everyexisting LocalScript in the game to the client that’s connecting for furtherusage, along with additional information concerning security and encryption. Thedata received also contains the bytecode’s hash, which is important.
2. The client then stores the received bytecode in a safe place and leaves itserialized and compressed.
3. When a LocalScript demands execution, the client will retrieve the bytecode fromits emplacement, decompress it, deserialize it then feed it to LuaVM::Load, whichis Roblox’s routine for loading bytecode retrieved from the server.a. Roblox’s deserializer will convert bytecode into a Proto structure, which wewill see later. This should ring a bell.
4. LuaVM::Load will then insert the resulting Proto into a Lua function (internallycalled as “LClosure”), which is then pushed onto the stack, reading for execution.To execute the function, you can simply use lua_call/lua_pcall, or lua_resume ifyou’re running said function inside of a coroutine.
Lua functions and what they are made of
● Each Lua function has a structure called a Proto. The proto contains a whole rangeof information concerning the function, such as the constants (and how many thereis), the number of upvalues the function uses, how much stack size is necessaryfor the function to operate and most importantly, the function’s code.
● A proto can only be ran if it’s inserted into an LClosure then fed toluaD_precall. This means that if you want to run a proto and its code, you’ll haveto create an LClosure then set the LClosure’s proto member to, well, the proto youwant to execute.
● Serialized lua bytecode is basically a proto represented as pure binary data.Lua’s undump function (luaU_undump) does the boring task of converting bytecodeinto the resulting proto, which then can be put inside of an LClosure then fed toluaD_precall… basically, same thing as the second point.
● In short: if you want to run any lua code, you must create a function (proto)first. Then you can feed that function to the lua API in order to execute it.However, Roblox does not have the Lua compiler for lua scripts, so what do we doinstead?
Presenting: Proto Conversion (pt. 1) (the good)
● What we could do to get functions to execute on the Roblox client is to create afunction through a normal Lua instance, then convert it to Roblox’s format soRoblox can execute it.
● On paper, it sounds like a really clever idea: after all, the only thing Robloxdid is change a few things to make it harder for us to run lua code, right?
● Sadly, that’s untrue. While Roblox’s Lua virtual machine is relatively the same(except for instructions and how they get the registers from them), they added ametric ton of security to make sure that any reverse engineer cannot do anythingto get unsigned lua functions running on their vm.
● However, this doesn’t mean it’s impossible. By bypassing Roblox’s checks and doingsome (stupid) things to get your code working, you can successfully attain stablescript execution on the client. Of course, the “stability” of your exploit dependson how good your code is. Bad code = Bad stability.
● Proof that it’s possible can be found everywhere: Seven, Intriga and Elysian areall exploits using proto conversion for script execution.
Presenting: Proto Conversion (pt. 2) (the bad)
● Proto Conversion, however, is not without risks: since you’re relying massively onRoblox’s codebase for script execution, them changing one single thing could breakyour exploit entirely.
● Additionally, there is still the possibility that Roblox’ll hire some new securityengineers that will prevent script execution through proto conversion for good. Inshort: proto conversion is
insecure.
● Proto conversion is also slightly slow, depending on your implementation. If youlook at Intriga, you’ll probably notice its slowness. Whether proto conversion iswhat affects Intriga’s speed is true or not, we do know that it can be slow.
● Let’s not forget that you have to reverse a lot of encryption and obfuscation too.Roblox has a lot of encryption in place to make sure that you can’t simply justchange an instruction or two and get everything working. They changed registers,xor’d constants and modified the instruction set enum, making conversion a pain inthe arse for certain reverse engineers.
● Again, this doesn’t mean that proto conversion is a bad idea. Despite being slow,it’s the fastest method out here to do script execution (next to CLVMs)
Presenting: Proto Conversion (pt. 3) (the “wat”)
● This might be surprising, but proto conversion is virtually the worse way to doscript execution, despite being the (second) fastest and how many people uses itfor their exploits, mostly because of how insecure it is and how you mustconstantly maintain your codebase to get it working.
● This, however, means that Roblox could have a hard time figuring out how the hellyour exploit works. I’m serious: a Roblox security engineer spent a month tryingto figure out how Seven worked (before he got the source from his creatorhimself), unable to comprehend what the exploit was doing. Hell, even afterreceiving the exploit’s code, Roblox is still unable to find a good way to patchthose exploits, despite having 10+ (lol) years of experience in computer securityand all of that bullshit.
● Yeah, “10+ years of experience in computer security”. That’s what Roblox requiresfor you to join their team and they somehow still aren’t able to come up withproper security that prevents us from doing anything bad to their client. Roblox,you seriously need to hire better engineers. Like me. Or anybody in Rain.
Presenting: Proto Conversion (pt. 4) (diagram)
Link: https://i.gyazo.com/b04e24b2162625471c9157143b2bb186.png
Notes
● The deserializer used to convert bytecode into Lua closures is unique to Roblox,as their format has been heavily modified.
● The deserializer also decompresses code -- Roblox uses LZ4 compression in order tomake their format hard to reverse AND to make it smaller when transferring thedump from the server to the client (ends up taking less bandwidth).
● The client also verifies the legitimacy of bytecode dumps by checking if theclient has the dump’s hash stored (as the client receives the hash upon connectingto the server). They use the xxHash algorithm for generating hashes with a seed(42 being the seed. Yeah, it’s that easy to figure out.)
● A weird thing is that they encrypt (xor + index in array) the bytecode dumpreceived by the server using the hash of the dump. This was known to beexploitable in the past (cough 1972 USNS Nuclear Plant incident cough), sosomething hacky could possibly be made with this.
● CoreScript bytecode is static: Servers DOES NOT recompile bytecode for CoreScriptseach time a server boots up. Instead, it uses a set of keys already existing onthe client for encryption and obfuscation.