Insights on exploit prevention

[TacoBellSaucePackets]

Oh lol. Never seen a noclip that does that.

[TheRings0fSaturn (SaturianNightmare)]

How do they even work - the ones that don’t use bodymovers.

[TacoBellSaucePackets]

Some change the HumanoidState to StrafingNoPhysics or just make all the parts in workspace non-cancollide (something like that)

[Amiaa16 (Amia)]

(post withdrawn by author, will be automatically deleted in 24 hours unless flagged)

[Amiaa16 (Amia)]

How do they even work - the ones that don’t use bodymovers.

Some change your humanoid state to StrafingNoPhysics, other ones set all your body parts CanCollide to false in a RenderStepped loop, and some just change the CanCollide of every part you touch to false.

[jaschutte]

They cannot modify your code at runtime

So when I have a local script running an infinite loop does that mean that script can’t be modified? I have a custom camera script with :BindToRenderStep(). The script basicly never stop executing does this mean that all the hacker can do is change variables? Because if so why don’t we just put a while loop at the end of each script so the hacker can’t modify it?

[Snowskateer (Snow)]

Let me stop you right there. It can 100% be avoided if you know what you’re doing.

No, it can’t. Their machine = their terms. Anything on their client can be modified and manipulated.

They can’t if the script is a modulescript, as those don’t have the Disabled property.

ModuleScripts return something, they do not run code. The code is ran on the code that required it, meaning they can be disabled if you disable the code that runs it.

Not really. They are limited by the tools they use, which you can take advantage of.

The limits are still practically non-existent. A competent exploiter can manipulate practically anything on their client.

[Autterfly]

They cannot modify your code at runtime

All data of a Lua proto can be modified at runtime. Code is not an exception.

[IdiomicLanguage]

To strengthen what you are saying, let me add some examples.

I have installed a SSL certificate on my machine which allows me to perform a MitM attack on any program performing network requests on my machine over SSL/TLS/HTTPS (like Roblox). I can see and write simple scripts (with the tools I use, in Lua) to replace any values I want. This means that if the client tries to tell the server in any way that I’m misbehaving, I can just edit it transparently without my machine or the server knowing what I did. I can also send any messages I want, duplicate them, or even block them for a time or indefinitely. The server will never know if a local anti-cheat detects anything.

Since Lua is a VM language, editing its memory is easier than a normal compiled program like the engine. The interpreter has a defined (open source, mind you), predictable, and consistent behavior. This makes editing its memory easy. Editing the variables in a script is easy. Since editing variables in a script is easy, controlling its logic is also easy. You see where I’m going with this? I can make any script see anything I want it to see. Since I don’t want to see the bad things I’m doing, I’ll just make it see that I’m not doing anything bad. All client anti-exploits have just been defeated by a single method that is easy to slightly change for every use case.

If I really wanted to mess with things, I’d make it easier by running Roblox on Linux using Wine (Wine Is Not an Emulator, the implementation of windows libraries in linux) and use Linux’s extra freedom to really screw around. All OS functionality can be relatively easily edited to do whatever I want; report on whatever memory or arguments I want it too, and lots more.

I’ve repeatedly told you, and am telling you again along with the two other respectable people above me, client side anti exploits are easily avoided and are only suitable for a quick and dirty emergency patch while a more robust method of prevention is developed.

[unix_system]

• They are limited in practice, but in theory they have the power to stop threads (and I do recall that at some point an executor has been able to do this and advertised it as a high-end feature)

• The exploiters code can be executed before the source is even executed on the client.

• And finally, no - it cannot be avoided! It doesn’t matter if you invented Lua or just started yesterday, you cannot prevent your code from being stopped or modified on the client because they control the client. They can modify your environment’s variables. Example: to counter your first argument about destroying the script, the can just rebind the :Destroy() function to just return true?

You’ve just described things that can annoy an exploiter into giving up more easily - I am not talking about practice though. You stated that it can 100% be prevented - and it cannot. You cannot do anything except obfuscate and irritate the malicious user. Nothing that has been described will stop someone who is being getting sums of money to create exploits for a front-page game.

This argument always goes back and forth, so I’m going to state here - I’m not entirely against client-side checks. I am just very cautious about reccomending them, especially where it is at the expense of proper serverside checks.

It’s far harder to execute effective client-side security than it is to focus effort on server-side security, so reccomending beginners to learn all of these advanced concepts about script environment hooking and causing complicated decompilers to error will just mean that the answer is less effective, and in my opinion, they haven’t actually learnt how to properly secure their game.

[unix_system]

Yes, a hijacker can very easily change any of those variables. Or they could stop the loop from executing by changing the value of :BindToRenderStep(). It’s not effective.

Please don’t do that.

[Snowskateer (Snow)]

No, it can’t. Their machine = their terms. Anything on their client can be modified and manipulated.

True, in theory. Practice is different.

The limits are still practically non-existent. A competent exploiter can manipulate practically anything on their client.

Again, theory.

It’s not theory though. Client data manipulation is very real, not theoretical, and many people can do it.

ModuleScripts return something, they do not run code. The code is ran on the code that required it, meaning they can be disabled if you disable the code that runs it.

Uh, what? ModuleScripts don’t run code??? That’s something new

Yes, requiring a module simply returns the variable that it’s told to in the ModuleScript. No code is ran inside the module, and is ran as if it was, for example, a function of the script that required it.

[Autterfly]

It’s not theory though. Client data manipulation is very real, not theoretical, and many people can do it.

There is a distinction. Dynamic data can easily be manipulated (this includes protos, scripts, instances, etc) and this is by design and must be possible. Static data (readonly data and Roblox binary source) on the other hand, while it can be modified, there is a super complex check in place for it that no one ever really bothers with because you don’t need to get around it to get an exploit working.

Side note: “Data manipulation” for dynamic data is often as easy as *(type*)data = value;.

[dillanrules]

Server side security is the way to go. While good client side security can and will prevent most exploiters, there will always be someone in the exploiting community competent enough to break your security, and even worse, profit off of it.

Improve your server side security first, and client security next. Do not even consider renaming locals or minifying scripts as obfuscation, as that will not get in the way of determined exploiters who want to defeat your security.

[IdiomicLanguage]

Sure, you can MITM Roblox traffic - the best you will get though is pictures and audio from the game you are playing. Only static assets (such as the two things I said) are transmitted that way - no scripts or map info are.

I’m not sure what you mean by no scripts or map info are sent over the network. You can see script source in the .rbxl file along with part and other information easily. It is made even easier by the fact that Roblox released their special compression formation and tools to extract place information are available. If your talking about script variables and run time internals then I’d agree with you, but I never mentioned that in my post. You can also see part movements over the wire, although I’ve never done this.

That won’t work with a HTTP proxy like Fiddler - since well, its a HTTP proxy , and Roblox’s game protocol most definitely isn’t HTTP. While you could use a packet interceptor/sniffer like Wireshark, that is extremely overkill and nobody is going to bother going that far.

A HTTPS proxy can. As I said, I’ve installed a local certificate and I have gone that far. I actually wrote a paper deconstructing Roblox internal API calls for my advanced protocol analysis class. I used Wireshark and a HTTPS proxy I will leave unnamed. For that project I ran Windows in a VM on my Debian Linux machine so that I could host Roblox in a Host-Only network and guarantee that I catch ALL traffic.

Roblox’s protocol is specifically built to prevent replay attacks or other packet interception (via dynamic encryption keys and all sorts of other stuff) - that simply wont work.

That wouldn’t be Roblox’s protocol, it would be HTTPS or lower down the OSI model TLS. Once you strip that away with the HTTPS proxy as I mentioned, it is prone to replay attacks.

While Lua itself is open source and consistent, Roblox’s Lua VM was specifically built from the ground up to be the exact opposite. I won’t go into specific details on how that works - but trust me, it is.

I’m sorry, at this point I don’t trust you.

No, it isn’t. All numeric Lua variables in Roblox are obfuscated via a dynamic xor key that is calculated at every launch.

An annoyance, nothing more.

Again, see above, but I doubt you can get much info on the control flow of a program by just the constants within it. (and especially without knowing what the script does in the first place)

While I admit that getting a complete picture of the control flow may be more difficult, changing variables to hide activities is much easier. This controls the logic flow, effectively making the anti-cheat innocuous.

While Roblox doesn’t even run on Wine, it still wouldnt somehow magically defeat the security measures within Roblox. All checks would still work fine - that is sort of the point of a “wrapper”.

Right, the point of using Wine is to ease some of the security features present in Windows. In Linux you can easily load Kernel modules and become the true god of your machine. I haven’t done it myself (but being a Linux user I’ve looked into it) but it is present inside the WineHQ database.

While yes, you can make a script see whatever you want it to see, nobody bothers to go with the route you said since it is simply a waste of time. I can guarantee that mostly everyone who would bother to attempt to bypass your anti-exploit would just be using a script injector anyway, making anything you just said irrelevant.

All it takes is one person to decide they want to profit from their knowledge, then the script kiddies swarm down.

[Autterfly]

I’m sorry, at this point I don’t trust you.

Everything from the instruction opcodes being shuffled to their encoded register/values being encrypted is possible. This reply isn’t exactly valid and just dismisses the point. “Editing” the “memory of the Lua VM” is actually editing the memory of the Lua states being used by the VM, so I can’t exactly tell what you were trying to say with your original post either.

[IdiomicLanguage]

I can’t exactly tell what you were trying to say with your original post either.

Ah, shoot, let me clear it up then:

From my viewpoint Lua’s memory and the VM’s memory are the same thing. Since the VM alters its memory in the same way for every script, it is easier to manipulate Lua’s memory than the memory of a normal compiled executable.

[dillanrules]

Sure, you can MITM Roblox traffic - the best you will get though is pictures and audio from the game you are playing. Only static assets (such as the two things I said) are transmitted that way - no scripts or map info are.

I’m not sure what you mean by no scripts or map info are sent over the network. You can see script source in the .rbxl file along with part and other information easily. It is made even easier by the fact that Roblox released their special compression formation and tools to extract place information are available. If your talking about script variables and run time internals then I’d agree with you, but I never mentioned that in my post. You can also see part movements over the wire, although I’ve never done this.

Sniffing Roblox’s HTTP traffic won’t give you scripts or map info. They’re sent over Roblox’s gameserver protocol. You’re going to have to look somewhere else if you want to even consider getting anything useful from Roblox’s HTTP requests.

That won’t work with a HTTP proxy like Fiddler - since well, its a HTTP proxy , and Roblox’s game protocol most definitely isn’t HTTP. While you could use a packet interceptor/sniffer like Wireshark, that is extremely overkill and nobody is going to bother going that far.

A HTTPS proxy can. As I said, I’ve installed a local certificate and I have gone that far. I actually wrote a paper deconstructing Roblox internal API calls for my advanced protocol analysis class. I used Wireshark and a HTTPS proxy I will leave unnamed. For that project I ran Windows in a VM on my Debian Linux machine so that I could host Roblox in a Host-Only network and guarantee that I catch ALL traffic.

Fiddler is an HTTP proxy with abilities to sniff HTTPS traffic. As stated earlier Roblox literally does nothing useful in terms of the actual game over HTTP, everything is done over the protocol Roblox uses for their gameserver. I highly doubt you’ve “deconstructed Roblox’s internal API calls” since you’re still telling everyone how you sniffed their HTTPS requests and got very useful data.

Roblox’s protocol is specifically built to prevent replay attacks or other packet interception (via dynamic encryption keys and all sorts of other stuff) - that simply wont work.

That wouldn’t be Roblox’s protocol, it would be HTTPS or lower down the OSI model TLS. Once you strip that away with the HTTPS proxy as I mentioned, it is prone to replay attacks.

Roblox doesn’t use HTTPS to communicate with it’s gameservers and as far as I know they NEVER have, so your statement is invalid.

While Lua itself is open source and consistent, Roblox’s Lua VM was specifically built from the ground up to be the exact opposite. I won’t go into specific details on how that works - but trust me, it is.

I’m sorry, at this point I don’t trust you.

You can’t be trusted either considering you’re spreading invalid knowledge.

No, it isn’t. All numeric Lua variables in Roblox are obfuscated via a dynamic xor key that is calculated at every launch.

An annoyance, nothing more.

Still prevents what you’re saying is possible.

Again, see above, but I doubt you can get much info on the control flow of a program by just the constants within it. (and especially without knowing what the script does in the first place)

While I admit that getting a complete picture of the control flow may be more difficult, changing variables to hide activities is much easier. This controls the logic flow, effectively making the anti-cheat innocuous.

Why would you just change random variables for no reason?

While Roblox doesn’t even run on Wine, it still wouldnt somehow magically defeat the security measures within Roblox. All checks would still work fine - that is sort of the point of a “wrapper”.

Right, the point of using Wine is to ease some of the security features present in Windows. In Linux you can easily load Kernel modules and become the true god of your machine. I haven’t done it myself (but being a Linux user I’ve looked into it) but it is present inside the WineHQ database.

I’m pretty sure you’ve never tried running Roblox on wine. It simply WON’T work. You can also load kernel drivers in Windows too, no difference.

While yes, you can make a script see whatever you want it to see, nobody bothers to go with the route you said since it is simply a waste of time. I can guarantee that mostly everyone who would bother to attempt to bypass your anti-exploit would just be using a script injector anyway, making anything you just said irrelevant.

All it takes is one person to decide they want to profit from their knowledge, then the script kiddies swarm down.

Spreading misinformation won’t help it you guys either.

I can’t exactly tell what you were trying to say with your original post either.

Ah, shoot, let me clear it up then:

From my viewpoint Lua’s memory and the VM’s memory are the same thing. Since the VM alters its memory is more predictable ways (since its always the same VM running every script), it is easier to manipulate Lua’s memory than the memory of a compiled executable.

Also, like said earlier, Roblox has added a ton of security to it’s Lua implementation. It’s far from predictable.

[Syndir]

That wouldn’t be Roblox’s protocol, it would be HTTPS or lower down the OSI model TLS. Once you strip that away with the HTTPS proxy as I mentioned, it is prone to replay attacks.

IIRC it is actually RakNet which provides replay attack mitigation. I don’t really know why you’re talking about using a HTTPS proxy; the Roblox game client only makes use of HTTPS to fetch assets (images, audios, etc.)

If you want to learn more about the Roblox protocol, I recommend taking a look at roblox-dissector by @gskw

I’m not sure what you mean by no scripts or map info are sent over the network. You can see script source in the .rbxl file along with part and other information easily. It is made even easier by the fact that Roblox released their special compression formation and tools to extract place information are available.

When a user joins a game, they don’t receive a .rbxl file. The server replicates instances over the network and scripts (rather, Lua bytecode chunks) are sent in a serialized, enciphered form.

[IdiomicLanguage]

I’ll admit, when I deconstructed the HTTPS traffic it was Roblox Studio’s traffic instead of the Roblox Player. I assumed that the Roblox player must do something similar, which many of you are telling me it doesn’t. I’d have to look further into the Roblox Player communication before I comment any further. My mistake.

(I didn’t want to risk encountering other player’s information or exploit on a live server)