I know that exploiters have the ability to use debug.getupvalue and debug.setupvalue, to get and set upvalues. Although I don’t understand the point of this facility, especially on the client since they have total control of everything. I heard it has to do with something related to remote events, but I couldn’t find much, the topic seems very abstract. Only thing I found was this v3rmillion thread which explained it, but I spent almost 15 minutes trying to get access, it’s stupidly hard to get in there. Thanks!
Maybe try this link:
yet again, this thread is from late 2014, and is probably outdated.
No unfortunately, this seems to be an old bug of some sort.
Upvalues tend to live more than most parts of the script. Local variables are only alive for as long as a function is running, but captured upvalues (like at the root scope of a module) live for the entirety of the module and its functions. As such, it’s the go-to for most value changing related exploits.
3 Likes
I see, their lifetime/extent makes them targets. I was also reading along, and I think from what I’m understanding, the lifetime of an upvalue even surpasses the client/server boundry. I’m still searching! Thanks!
Sorry to barge in on the chat but, would I be right then in assuming that as long you keep your local module values from holding sensitive data then it would make this particular exploit useless? For instance in a module used like a class that generates instances of itself the values initialized specific to that instance wouldn’t be effected by this exploit correct?
1 Like
upvalues can be spoofed by exploiters means.
Exploiters can change any arguments for functions or networking calls in real time. About network, they usually use hookfunction and newcclosure
1 Like