RbxStu V2: Studio Executor - Runtime Debugging and Exploit Patching

s1mple66645 · April 16, 2024, 10:23am

no I mean- can U answer? my question?

roalex2008 · April 16, 2024, 12:18pm

I’ll check why it’s not working sooner than later, thx for telling

roalex2008 · April 16, 2024, 1:55pm

The module opens up a Console using Windows API, you can look at the source code on GitHub to see how it works

roalex2008 · April 17, 2024, 1:23am

Tried fixing it, no luck on my end, I guess the way functions and things are registered on Roblox Studio isn’t a 1:1 with the client, I have said it before, but I’ll say it again, I don’t believe this will be a 1:1 with real Roblox Client executors.

Still, why would you need a remote spy? If you don’t know your own games remotes, then I think you are in a bit of a pickle yourself…

s1mple66645 · April 17, 2024, 6:46am

can u send a link please? to DMS mb

lambarini · April 17, 2024, 10:31am

Nah lol I just like the ui and stuff and how it generates code automatically to fire the remote, I use red as my networking library is its a bit of a hassle

roalex2008 · April 17, 2024, 11:10am

I made a table reconstructor on Lua inspired from a friend, I’d assume rspy does something similar or close enough, it’s on my GitHub as well, I might integrate it into this if I see it is of use for any user using it, but at the time being, I don’t find it significant

roalex2008 · April 17, 2024, 11:12am

What is it? I’m confused on what you need/want

Binaary · April 17, 2024, 1:37pm

Hi, just to start off I’d like to mention that this entire idea is totally unnecessary.

The code base behind this is so sub-performing that it’s insane, it makes me believe that the development team behind this are new programmers.

Let’s begin.

github.com

SecondNewtonLaw/StudioExecutor/blob/dev/Hook.cpp#L185


      
              auto scheduler{Scheduler::get_singleton()};
              do {
                  Sleep(oxorany(88));
              } while (!scheduler->is_initialized());
          }
          
          
void Hook::initialize() const {
              MH_Initialize();    // init mh.
          }
          
          
MH_STATUS Hook::install_hook() const {
              MH_CreateHook(reinterpret_cast<void *>(RBX::Studio::Offsets::pseudo2addr), pseudo2addr__detour,
                            reinterpret_cast<void **>(const_cast<void *(**)(lua_State *,
                                                                            int32_t)>(&__original__pseudo2addr__hook)));
              return MH_EnableHook(reinterpret_cast<void *>(RBX::Studio::Offsets::pseudo2addr));
          }
          
          
MH_STATUS Hook::install_additional_hooks() {
              MH_CreateHook(reinterpret_cast<void *>(RBX::Studio::Offsets::rFreeBlock), freeblock__detour,
                            reinterpret_cast<LPVOID *>(&this->__original__freeblock__hook));
              return MH_EnableHook(reinterpret_cast<void *>(RBX::Studio::Offsets::rFreeBlock));

Really? inline hooking a function using a minhook just to resolve the local lua_State?
Do you know how insanely primitive the idea of an inline hook in x64 assembly actually is? What’s the point of using minhook here? there is no relative rip instructions that you’d actually have to have some minimal form of assembly knowledge to know how to resolve here.

github.com

SecondNewtonLaw/StudioExecutor/blob/48b2bdbe4b602c019472699cf915c135f4395545/Hook.cpp#L55


      
          if (!scheduler->is_initialized() && rand() % 0xff == 0) {  // Randomness for more entropy when getting lua_State*, helped get a valid state faster.
              auto ignoreChecks = false;
              char buf[(0xff)];
          
          
    if (tries > 30) {
                  wprintf(oxorany(L"You seem to be having issues trying to obtain a lua_State*, make sure to publish your game, at least privately, else this tool will NOT work!\r\n"));
                  wprintf(oxorany(L"Validation checks on the lua_State* will be ignored this time. But please remember to publish privately if you wanna use this tool without being an unstable mess!\r\n"));
                  ignoreChecks = true;
              }
          
          
    if (GetWindowTextA(GetForegroundWindow(), buf, sizeof(buf))) {
                  if (strstr(buf, (oxorany_pchar(L":\\"))) != nullptr &&
                      strstr(buf, oxorany_pchar(L"- Roblox Studio")) != nullptr &&
                      strstr(buf, (oxorany_pchar(L".rbxl"))) != nullptr) {
                      wprintf(oxorany(L"WARNING: You seem to have a local file open. This tool does not support them correctly, and the grabbed state may not be correct!\r\n"));
                      ignoreChecks = true;
                  }
              }
              auto ud = static_cast<RBX::Lua::ExtraSpace *>(L->userdata);
              //wprintf(oxorany(L"State ExtraSpace:\r\n"));
              //wprintf(oxorany(L"Identity: 0x%p\r\n"), ud->identity);

??? What is this overengineered garbage code? Do you know you can unironically compare GetForegroundWindow to the handle of the process?

Also, what’s all this oxorany macro sprinkled everywhere for? Do you know this is open source, lol?

github.com

SecondNewtonLaw/StudioExecutor/blob/48b2bdbe4b602c019472699cf915c135f4395545/Hook.cpp#L134-L136


      
          auto mem = malloc(oxorany(sizeof(RBX::Lua::ExtraSpace)));    // Pointer replacement.
          nL->userdata = mem;
          memcpy(nL->userdata, L->userdata,

Hey buddy, stop writing junk code and start reading properly.

github.com

SecondNewtonLaw/StudioExecutor/blob/48b2bdbe4b602c019472699cf915c135f4395545/Hook.cpp#L176-L178


      
          do {
              Sleep(oxorany(88));
          } while (!scheduler->is_initialized());

Nice spinlock with a constant, _mm_pause intrinsic exists.

This entire source is riddled with bad code and terrible memory leaks.
You’re using C++ so start using smart pointers.

Also, your exception filter is disturbingly poorly coded. Please learn to handle your exceptions correctly rather than just dumping the information to io & exiting.

github.com

SecondNewtonLaw/StudioExecutor/blob/48b2bdbe4b602c019472699cf915c135f4395545/main.cpp#L82-L83


      
          DWORD value{};
          DWORD *pValue = &value;

Absolutely no comment, I’m star struck with how badly one can program something like this.

github.com

SecondNewtonLaw/StudioExecutor/blob/48b2bdbe4b602c019472699cf915c135f4395545/main.cpp#L103-L114


      
          std::cout << std::endl;
          std::stringstream sstream{};
          for (unsigned short i = oxorany(0); i < frameCount; ++i) {
              sstream << ("0x") << std::hex << reinterpret_cast<std::uintptr_t>(stack[i]);
              if (i < frameCount) {
                  sstream << (" -> ");
              } else {
                  sstream << ("\r\n");
              }
          }
          
          
std::cout << sstream.str();

Really? you have an identical loop above, just trace within the same loop? It’s not difficult. You’re already using the rtl stackwalking functions.

github.com

SecondNewtonLaw/StudioExecutor/blob/48b2bdbe4b602c019472699cf915c135f4395545/main.cpp#L193-L276


      
          if (oxorany(0) != oxorany(0)) {
              auto a = oxorany(10);
              auto b = oxorany(10);
              auto c = oxorany(10);
              auto d = oxorany(10);
              auto e = oxorany(10);
              auto f = oxorany(10);
              auto g = oxorany(10);
              auto h = oxorany(10);
              if (h == oxorany(9)) {
                  b = oxorany(10);
                  c = oxorany(10);
                  d = oxorany(10);
                  e = oxorany(10);
                  f = oxorany(10);
                  g = oxorany(10);
                  h = oxorany(10);
                  if (a == oxorany(9)) {
                      b = oxorany(10);
                      c = oxorany(10);

This file has been truncated. show original

:T

github.com

SecondNewtonLaw/StudioExecutor/blob/48b2bdbe4b602c019472699cf915c135f4395545/Environment/Environment.cpp#L158


      
          }
          
          
int httppost(lua_State *L) {
              luaL_checktype(L, 1, LUA_TUSERDATA);
              luaL_checktype(L, 2, LUA_TSTRING);
              luaL_checktype(L, 3, LUA_TSTRING);
              luaL_checktype(L, 4, LUA_TSTRING);
          
          
    const std::string targetUrl = lua_tostring(L, 2);
          
          
    if (targetUrl.find(oxorany_pchar(L"http://")) != 0 && targetUrl.find(oxorany_pchar(L"https://")) != 0) {
                  luaG_runerror(L, oxorany_pchar(L"Invalid protocol (expected 'http://' or 'https://')"));
              }
          
          
    const auto *postData = lua_tostring(L, 3);
              const auto *contentType = lua_tostring(L, 4);
          
          
    auto response = cpr::Post(cpr::Url{targetUrl}, cpr::Body{postData},
                                        cpr::Header{{oxorany_pchar(L"Content-Type"), contentType}});
              std::string data2(response.text.begin(), response.text.end());
              lua_pushlstring(L, data2.c_str(), data2.size());

std::string::npos exists

github.com

SecondNewtonLaw/StudioExecutor/blob/48b2bdbe4b602c019472699cf915c135f4395545/Environment/Environment.cpp#L165


      
          
          
    const std::string targetUrl = lua_tostring(L, 2);
          
          
    if (targetUrl.find(oxorany_pchar(L"http://")) != 0 && targetUrl.find(oxorany_pchar(L"https://")) != 0) {
                  luaG_runerror(L, oxorany_pchar(L"Invalid protocol (expected 'http://' or 'https://')"));
              }
          
          
    const auto *postData = lua_tostring(L, 3);
              const auto *contentType = lua_tostring(L, 4);
          
          
    auto response = cpr::Post(cpr::Url{targetUrl}, cpr::Body{postData},
                                        cpr::Header{{oxorany_pchar(L"Content-Type"), contentType}});
              std::string data2(response.text.begin(), response.text.end());
              lua_pushlstring(L, data2.c_str(), data2.size());
              return 1;
          }
          
          
int httpget(lua_State *L) {
              luaL_checktype(L, 1, LUA_TSTRING);
              std::string targetUrl = lua_tostring(L, 1);

yesss cpr post with the large overhead.

github.com

SecondNewtonLaw/StudioExecutor/blob/48b2bdbe4b602c019472699cf915c135f4395545/Environment/Environment.cpp#L167


      
          
          
    if (targetUrl.find(oxorany_pchar(L"http://")) != 0 && targetUrl.find(oxorany_pchar(L"https://")) != 0) {
                  luaG_runerror(L, oxorany_pchar(L"Invalid protocol (expected 'http://' or 'https://')"));
              }
          
          
    const auto *postData = lua_tostring(L, 3);
              const auto *contentType = lua_tostring(L, 4);
          
          
    auto response = cpr::Post(cpr::Url{targetUrl}, cpr::Body{postData},
                                        cpr::Header{{oxorany_pchar(L"Content-Type"), contentType}});
              std::string data2(response.text.begin(), response.text.end());
              lua_pushlstring(L, data2.c_str(), data2.size());
              return 1;
          }
          
          
int httpget(lua_State *L) {
              luaL_checktype(L, 1, LUA_TSTRING);
              std::string targetUrl = lua_tostring(L, 1);
          
          
    if (targetUrl.find(oxorany_pchar(L"http://")) != 0 && targetUrl.find(oxorany_pchar(L"https://")) != 0) {
                  luaG_runerror(L, oxorany_pchar(L"Invalid protocol (expected 'http://' or 'https://')"));

???

github.com

SecondNewtonLaw/StudioExecutor/blob/48b2bdbe4b602c019472699cf915c135f4395545/Environment/Environment.cpp#L370


      
              L->top++;
              return 1;
          }
          
          
int gethui(lua_State *L) {
              lua_getglobal(L, oxorany_pchar(L"game"));
              lua_getfield(L, oxorany(-1), oxorany_pchar(L"CoreGui"));
              return 1;
          }
          
          
int isrbxactive(lua_State *L) {
              char buf[0xff];
              if (GetWindowTextA(GetForegroundWindow(), buf, sizeof(buf))) {
                  lua_pushboolean(L, strstr(buf, oxorany_pchar(L"Roblox Studio")) != nullptr);
              } else {
                  lua_pushboolean(L, false);
              }
          
          
    return 1;
          }

lua_pushboolean(L, GetForegroundWindow() == handle);

github.com

SecondNewtonLaw/StudioExecutor/blob/48b2bdbe4b602c019472699cf915c135f4395545/Hook.cpp#L134


      
          nL->gt = luaH_clone(L, L->gt);
          rL->gt = luaH_clone(L, L->global->mainthread->gt);
          lua_ref(L, oxorany(-1)); // Avoid dying.
          lua_pop(L, oxorany(2));
          // RBX::Security::Bypasses::SetLuastateCapabilities(L, oldObf);
          
          
RBX::Studio::Functions::rFromLuaState(L, nL);
          RBX::Security::Bypasses::set_thread_security(L, oldObf);
          
          
if (nL->userdata != nullptr) free(nL->userdata);
          auto mem = malloc(oxorany(sizeof(RBX::Lua::ExtraSpace)));    // Pointer replacement.
          nL->userdata = mem;
          memcpy(nL->userdata, L->userdata,
                 oxorany(0x98));    // We detach it from the original lua_State* we originate it from, thus our caps still work.
          RBX::Security::Bypasses::set_thread_security(nL, RBX::Identity::Eight_Seven);
          RBX::Security::MarkThread(nL);
          
          
lua_settop(L, oldTop);
          //auto L_userdata = reinterpret_cast<RBX::Lua::ExtraSpace *>(L->userdata);
          //auto nL_userdata = reinterpret_cast<RBX::Lua::ExtraSpace *>(nL->userdata);
          //nL_userdata->sharedExtraSpace = L_userdata->sharedExtraSpace;

by the way, realloc clears data so your check is ambiguous and thus, memory is not always free’d.

I can’t even be bothered to go deeper into this. I’ll end this with saying one simple thing, this still breaks tos and is just a polished attempt to make a script executor for roblox studio considering it has no security at all.

s1mple66645 · April 17, 2024, 2:04pm

the link to a module you used to open a Windows desktop app with console?

roalex2008 · April 17, 2024, 3:07pm

I literally never intended to make this public, the oxorany are because it’s based of an old project of mine meant to be an injected DLL, most code is underperformant and that’s alright, there is no real reason to want assembly-level speed when you don’t need it; I’m using Minhook because I’m not gonna be doing manual hooking of any kind for this, I don’t code a full Cor C++ style I just mix stuff up, I’m not a life-long C++ programmer neither lol, if you think you can make it better make it better, destructive criticism works alright, but I believe you are being quite harsh. I’m picking easy ways of doing the things I’m doing, and I’m not gonna bother to do it better because it was a project I wrote in two weeks and no more. You normally don’t start with writing the cleanest code, and I don’t feel like using smart pointers because I believe I can manage memory myself responsibly, as for the not usage of realloc, I was smashing my head while writing that for three days, so the solution isn’t necessarily the best and it wasn’t intended to be, I had to do a small rewrite of Security.cpp just to allow setthreadidentity to work correctly and not force Level 8 by default. Most codebases of injected dlls are not clean by any means, I’m not going to be reversing every Roblox struct, and this one isn’t intended to be neither, I have seen worse codebases that relate to the injecting dlls part of this world, and they have been much more disgusting than this one.

In short, you have valid points, but I don’t feel it’s fair to hold the level of C++ of a program you control yourself over a program whose lifecycle is not really part of your control and it’s part of code that is not yours or that you don’t know entirely how it works, with that said, you have your opinions I have mine, this codebase ain’t even a month old, it’s barely two weeks, not cleaned up truly, and I just mix and match C/C++ as I feel like it, no one will probably contribute to it, and the reason I open sourced it is because people didn’t trust it, most production codebases do sins just for existing and we don’t berate much or them

shadowmaster940 · April 17, 2024, 8:42pm

I believe this tool could be pretty useful to some people, I myself would love to be able to pentest my games without the worrying of being banned or having to run some closed source software run by a shady community.

emblazes · April 18, 2024, 12:34am

It’s really not that deep.
Chill

Katrist · April 18, 2024, 10:31pm

Any news on the release of a new DLL?

roalex2008 · April 18, 2024, 10:32pm

Currently updating; couldn’t do so yesterday because my mouse had broken, currently finding the offsets required, i’ll push into github after its done and release a build as well.

bitsplicer · April 18, 2024, 10:35pm

macOS support??

ill be willing to contribute and try to add that.

roalex2008 · April 18, 2024, 10:46pm

I believe that adding MacOS would mean quite the touch ups on the codebase, and I don’t have a MacOS to directly support it, it is a CMake project, though, so it could be done with not that much effort I believe, but I’d have to make wrappers for calls to Windows API so it calls the respective MacOS/*Nix APIs instead if it is MacOS

Katrist · April 18, 2024, 10:48pm

Thank you very much for the update.

bitsplicer · April 18, 2024, 10:50pm

Yeah maybe a wrapper for the windows API which is crossplatform. Only downside is macOS requires S.I.P to be disabled which requires a lot of digging through the system.

GitHub - notahacker8/RobloxCheats: Cheating tool for Roblox (MacOS M1) this project, while it has bad intentions could be used as a reference for implementing injection-like systems.

roalex2008 · April 18, 2024, 10:54pm

I believe this was more of an ESP, Luau execution could be a 1:1 with what I currently have, the only caveat would be wrapping the native API calls and possibly making the offset platform-dependant, still, I would have to account for ARM, which IS more problematic becuase I’m not used to ARM assembly to touch much onto the Roblox M1/2/3 Studios. (And also some small things with ARM that go on (You need to add like 0x1 to an address for it to be good I believe)), which sum up to making this into more of a chore