Rbxassetid:// bypasses trust check for animations

If you use rbxassetid:// with an ID of an animation, it bypasses the content provider check to make sure that the creator owns a copy of the animation. If you use http://www.roblox.com/asset?id=id with an animation that you don’t own, it lets you know that the asset isn’t trusted for the place.

A lot of game developers create animations specifically for their games, and have them set to private when we upload them. If we wanted to allow our animations to be used in other games, we would have made them public. The whole point of making something private is to prevent others from using it, as it’s meant only for the creator to use.

Also, this would patch the animation exploits where people can change their default animations to show off in-game (Twerking, long legs, snake etc.)

1 Like

I know roblox has been pushing to help the developers a lot lately, and I appreciate that. This is one of those issues that needs to be patched, otherwise animations that someone spent time making will be used by other people, potentially for profit.

Do note that, being something the clients must know, animations should be fairly easy to steal, even if they’re private and this is fixed. With the removal of the price, animation stealing will only be slightly harder than decal stealing. Why? The client has to receive all the animation data anyways. It’s not like it can’t take it even though you don’t want it to.

Tip: use a custom weld animation system so skids won’t be able to steal your animations since they won’t know how to implement a bunch of CFrame values into their game.

That’s rather overkill, Echo, and you personally know the pain of properly implementing that. I remember you complaining many many times. He already has animations.

And even then, even if everyone uses welds, it’s still not impossible for the client to get the data for the weld changes, because the client must know.

I realize that those techniques are useful, and I’ll definitely consider using them, but shouldn’t something be done about the fact that people can use other people’s animations and make money?

Yes, I’m well aware, but it would still be difficult for people to use after they stole it because they wouldn’t know how to implement it.

Yes – ROBLOX should certainly be more active in punishing people who profit from others’ assets. I believe it was Stravant (thanks for being transparent :DDD) who said that the reason they didn’t do this is because when they have in the past, sometimes the reporter wasn’t always sincere and wasn’t actually the first to make them. This is true, so it’s a sticky situation :frowning: You could also upload the animations on an alt now that they’re free, and use the same technique he’s using to use them for your game. He probably didn’t even exploit to get it – just looked through your models.

@Echo He used that hole in the system to obtain the animations. There is no possible other way he could’ve obtained them; I’ve checked.

Why is everyone so worried about the possibility that someone might use their animations?

Animations are inherently stealable because the client has to know them.

1 Like

@GollyGreg
Imagine if someone stole a few of your models, gave them out for free, then other users made money off of your models.

@sncplay42
They won’t be as accessible by skids if they simply patched the
animation.AnimationId = “rbxassetid://159617797”
bug; where anyone can just grab any animations they want, regardless of its copy-lock protection.

This has happened to me. I wouldn’t feel wronged really. I helped someone. That’s enough for me.

I’ve found and fixed this bug. It will be release after it goes through testing and the normal release process.

I thought rbxassetid:// just used the full ‘/asset/?id=’-url internally…

Does /…/…/…/…/ still work?

Echo, can you give an example of how that format would be used?

There was a thread posted about it:
[url]Documentation - Roblox Creator Hub

1 Like
local _,error = pcall(function() ImageLabel.Image = rbxasset://../../../../Cheat Engine 6.3/Cheat Engine.exe end)
if error and string.find(error, "Failed to resolve texture format") then
print("Client has Cheat Engine 6.3 installed. Wreck havoc on them :evil:")
end

… lets you navigate up through the client’s directory, and if you set an imageLabel, decal, etc’s texture to something, and it gives you the error “Failed to resolve texture format”, then that file exists. If it doesn’t exist, it will error with “File not found”

Edit: derp – Merely ninjad while I was typing that up :frowning:

1 Like

Er, I talked to b1tsh1ft about the UDP bug, and I asked if we can keep it UNTIL ROBLOX releases better CE protection, and he said he didn’t see an issue with it. Now I fo know, authority overules, but hey… It’s all we got until ROBLOX releases that AntiExploit update.

You should no longer be able to load unowned animations using rbxassetid:// as of today.

1 Like