Overview
Originally discovered in 2021 by raphtalia, it uses the os.clock() function which is intended to be used for benchmarking code in Lua to generate a unique identifier for a CPU. Even while being heavily sandboxed from the standard Lua os library by Roblox Studio, is able to be used for this method. os.clock() cannot be changed by changing your system time.
Potential
Using this vulnerability we can,
- Allow players to only make a certain amount of alts
- Fingerprint Ban players Device
- Log Fingerprint and Alts in Discord
Example Script
Add Remote to ReplicatedStorage, the FPModule to ServerScriptService, and the LocalScript to StarterPlayerStricts
Config:
local config = {
["KICK_IF_FINGERPRINTED"] = true,
["LOG_IN_DISCORD"] = false,
["DISCORD_WEBHOOK"] = "",
["BAN_MESSAGE"] = "IMMA FIRIN MAH' LAZAR",
}
return config
Example Script:
print(module.GetFingerPrint(player)) -- Returns Fingerprint
module.FingerPrintCheck(player) -- Checks if Fingerprinted and adds to it if its a new account
print(module.GetAltAccounts(player)) -- Gets all Alt Accounts
module.AddPlayer(player) -- Adds player to fingerprint
module.RemovePlayer(player) -- Removes player from fingerprint
module.AddFingerprint(fingerprint) -- Adds a fingerprint to database with no player list
module.RemoveFingerPrint(fingerprint) -- Removes fingerprint
if table.getn(module.GetAltAccounts(plr)) > 5 then -- Example script to check amount of alts
plr:Kick("Too Many Alts")
end
Cons
Anything sent from the client can be modified by exploiters, but as of 2024, exploiters have been literally wiped from the face of Roblox and this method would work against exploiters using external hacks like AI aimbot. The only big con is that restarting the PC resets the CPU time used by Lua.
Legality / Potential for Abuse
Roblox’s Terms of Use only allows for a developer to use data to protect their game and not to collect personally identifiable information (IE. fingerprints, biometric information, etc). As for potential for abuse, all information gathered is considered public information.
Conclusion
Sorry for some sloppy code or writing. I am not looking for hate but rather feedback. I believe that using os.clock() is just as similar to using things like a player’s UserId. Even though bypassing this method is as simple as just restarting your pc, would restarting your entire PC in addition to getting another alt account with an old account age be convenient for the person banned? No, that’s the entire point. It’s a tentative method to inconvenience the person as people.
Module:
FingerprintModule.rbxm (3.5 KB)
