H3x - Script Sandbox (Deprecating soon)

That’s cool! It definitely has some obscure tricks that you might find useful. (Also for new users reading this thread DM me your mention list requests. I changed it to avoid clutter)

I also think I might have some time tonight to fix some stuff and work out the Runner issues.

1 Like

It’s looking fantastic! I’ve taken a look through the code and it’s well-written! There’s one thing I’m looking for:
I would like to know the result of the code, so what happened (and not what’s printed). For example:
The code Instance.new("Part") ran in a sandbox. How would I know what had been created?

You would probably either use the hooking APIs for this or write/modify a custom environment. By default the script cannot access instances so you’d need to remove this in the hooking API.

If you allow access to more instances you would also most likely need to make sure the player’s service access is limited. E.g. MessagingService, LogService, TeleportService, etc.

Additionally you can also have scripts return values you want to use (be careful since they can contain malicious metatables and functions). Also, arguments you pass to the script can be used in a script via the vararg token (…).

1 Like

I apologize for the lack of activity haha. I should for sure have some stuff fixed/added this weekend. I’ve had not a lot of time to work on stuff this past week.

I just published a new update and I made some really stupid mistakes in the previous one (mainly not testing for blatant bugs before publishing). Things are working smoothly and I should be able to update the docs and get a github page going soon (by tomorrow at least).

Does it have something for a callback for a custom log?

The Hook API can be used for exactly that.

1 Like

How easy would it be to edit this, but instead of using loadstring use an interpreter like FIOne?

Probably not too difficult. You’d just need to change the call in the Context module and as long as it returns a function you’re good.

1 Like

I think(?) I have found a bug. It doesn’t look like a hook is returned by sandbox:Load()?

Another question, how can I access the sandboxed scripts stack?

Thanks!

Thanks for letting me know about that! I’ll check it out when I have time. Also to track the call stack you’d need to use the hooking api and track calls yourself.

Yeah that’s what I thought, thanks! I’ll wait for your update :smiley:

Notice: I’m planning on rewriting H3x with new (and better) technology. I realize that I didn’t really ever get this update released and that’s most likely how things will be until I have gotten to the rewrite.

Some general plans for the rewrite:

  • Neater code (particularly for those looking to modify my code to better fit their game’s uses)
  • Easier alternative to the hooking API
    (My current implementation is confusing imo and I have an interesting idea I might play with)
  • Custom thread handler/tracker (most likely including some extra thread related tools, notably shutting down scripts)

Here’s some info for those interested in how H3x works currently. There’s also some information on what I’m planning at the very end.

H3x has two main, essential sections:

  1. Sandboxing
  2. Spawning

H3x’s sandbox essentially tries to minimally impact detectability by remaining as close to Roblox’s actual environment as possible. One of the main features of H3x is that it will wrap certain functions into coroutines, which are marked by Roblox as c based functions meaning functions which do not allow c functions will fail (such as coroutine.wrap itself).

There’s a caveat to this trick though. Yielding within a wrapped function will simply permanently yield. This is something I want to address in my rewrite and something I was somewhat unaware of to begin with. Normally c functions can’t yield, and attempting to do so from lua will cause an error (and should in my case). Wrapped functions do not have this behaviour since they are linked with a thread.

I’m pretty proud of the spawning piece of H3x in terms of reliability, speed, and that idea of sticking as close to Roblox lua as possible. This code takes user code, and actually runs it. The method I use to do so is actually pretty simple all things considered. I simply create a “parent” script which will spawn an actual script thread. Getting it to run the code is fairly simple as well. What I do is give the spawner script an event, and a module (for referencing data). The module is required by H3x, necessary data/code is inserted, and the script is ran.

In the rewrite these are the main changes I want to make to these two components of H3x:

  1. Properly erroring in c functions, as well as documenting that you cannot yield in c functions. Alternatively a better wrapper solution for c functions, which I’ll need to experiment with first.
  2. The spawner will be faster and more reliable than it was (particularly with certain scripts)
  3. Custom thread tracing which will have the power to completely, and instantaneously terminate a thread or script, yield/pause its execution externally, and more.
  4. Smart stack (technically just thread related) tracing and better stack overflow handling (no freezing when there’s a stack overflow, and no recursive threads breaking Roblox’s hang timer)
5 Likes

Any progress on the rewrite? I’m having a LOT of fun with H3x rn.

Welp, unfortunately not really as I lost the code, however, I’ll have extra time to start again soon hopefully. This really really needs an update though haha :smile:

2 Likes

It’s good to see someone take that kind of loss calmly.

I know someone else who hasn’t taken those incidents so well. It’s not fun.

1 Like

Yeah… Part of that is just that I’ve had it happen enough by now that I know how to handle it I guess. I tend to take it as more of a good thing though personally, because I can take into account any issues I had prior, getting it done better and more efficiently before. I am always really disappointed when I lose work, but, usually I just start over and I am generally happier with the results than I would be originally, and that’s always satisfying enough for me :smile: