RbxStu V4: Roblox Studio Luau API modification

Resources Community Resources
, , ,
1

First of all, I will go over the original reason that RbxStu V3 was discontinued:
It was sadly discontinued due to internal changes in the engine. The changes broke many features. This included changing many internal functionalities, and overall it deviated from the original ‘run exploiter scripts’ into a more of a ‘run custom scripts in your game that modify the behavior of Roblox Studio.’

Here I will outline a few changes that have occurred internally:

  • Rewrote the initialization of some features so it is much faster (mainly internal mode).
  • No longer forces you to use DirectX 11, as ImGui is no longer used internally.
  • Documented the ENTIRE API for RbxStu in its own standard.

This project does not support running exploiter scripts anymore, and you should not. The little retro-compatibility that remains is due to the useful tooling that exists, such as Hydroxide, SimpleSpyV3 and other scripts.

RbxStu V4 does not attempt to limit you at all. You can execute everything and anything you want without constraints; this means that there are no in-place limitations or security of any kind, so execute carefully. You are unlikely to face issues by limiting yourself to public APIs that ROBLOX exposes by themselves.

New APIs are being constantly developed for this project. I intend it to mainly be about accessing, modifying, and overall making use of the Luau API that ROBLOX provides us as scripters without limits.

However, you must remember that modifications that directly modify Roblox Studio, like this kind, while not outright banned since they can be beneficial to the community, aren’t exactly something ROBLOX openly supports or will ever do. There are many risks, responsibilities, and promises that a tool like this would need; supporting a project like this is not really something they can do safely. But this is why we have come up with our own solutions to many things. No Luau signal API that’s sufficiently lightweight? No problem, Signal modules have you covered, for example.

When we, the community, are in need, we build the solution most of the time, and I believe this would be the case here.

Use case

RbxStu V4 has brand-new features that help you debug and modify the ROBLOX Luau API and, consequently, your game; you may even find internal crashes on functions by the methods of fuzzing the entire environment. This has, in fact been something exploits have been vulnerable to in the past, and even just the engine itself has these issues from time to time as seen in these two posts → Post 1, Post 2.

That is one use case, just finding bugs that you can report within the engine, although the API only seems to have issues on private segments of it (not something you can trip as a game developer yourself).

Another use case is also just debugging a game quickly. When you are commissioned for fixes in a game, combing through the code just to debug one feature is quite a task, more so when the game is fairly big and you’re on your own. Thanks to RbxStu V4, you can simply load a Remote Spy, which is a tool that tracks remotes, the arguments that are fired with them, and other aspects, such as the script that called it. You use the ‘buggy’ feature, and because you are going to find the remote, finding the script on the server that uses such is a much more manageable task, overall helping you debug more than anything. This does not quite apply on games that use a Networking library, however…

Additionally, part of the pentesting feature set is still active and available and is actually being expanded actively with brand-new features. I have already released one post on how one could use these features to your advantage here. RbxStu was not explicitly required since some things you can achieve without it; however, it was recommended due to simply being the only true option that I could guarantee was

  • safe.
  • had little to no chance of flagging you, a developer, as a cheater.
  • worked fine for dynamic analysis.

Regardless of all the previous, with RbxStu you can completely instrument and control the environment. You can make use of this for things such as tracking connections by hooking metatables and metamethods, and, upon exiting the DataModel, presenting a report of the numbers of connections that were disconnected and connected, for example.

That is simply one of the things you can do. RbxStu is extremely flexible due to the simple APIs in it. There is a myriad of things you can use it for as a developer, and I hope you find its value as I do when I make use of it on my own projects.

You may acquire RbxStu V4 on the new Discord server. Using GitHub releases made me have to duplicate the release notes every time, which was cumbersome and a bit annoying; I may change this and do GitHub releases given enough time; however, it is to be seen.

Frequently Asked Questions

  • Is RbxStu V4 free?
    • Always has been, because there is little chance someone pays for a Roblox Studio executor/modding platform, and I myself am not willing to bill anyone for such a thing.
  • Is RbxStu V4 safe?
    • It is safe, having released more than one post on the subject, as well as having enough time on the developer community. I believe that it goes without saying. This software has no means of tracking back to you on executions or anything.
      Originally I intended to add a webhook for when exceptions were raised; however, it was discarded as the testers I had during development said it was not necessary, and I agreed.
  • What can RbxStu V4 run?
    • RbxStu V4 can run anything as long as it uses the ‘rSUNC’ naming convention, which is its own naming convention, with open-source documentation here, with the published version over here. The documentation is open source; anyone can contribute to define new functions they themselves may find useful.
  • Can I use this on …?
    • All kinds of testing should be supported. You can use it on team tests, local tests, and normal testing.
  • Who is behind this?
    • Me, @roalex2008. I’m the only developer, with contributions from other external parties as times goes on.
  • Can I teleport out of the-
    • no.
  • Will this be open-sourced?
    • Open sourcing This tool was not useful at any point in any of its iterations. No one ever contributed to it. Only some friends I had made throughout the time of development, who already had source access, contributed. Many developers cannot contribute already because RbxStu requires you to know the engine more than just Luau. Base C++ knowledge also is not sufficient because of the design of it going over it (yes, I have improved since RbxStu V1). It also goes that they believe that because something is ‘Open source,’ it is ‘Safe,’ which is not the case (liblzma case, which had a backdoor, even when being in an open source project )

Ultimately, this is a tool for you, the developer; it is up to you how you make use of it or if you dismiss it entirely and use client cheats to achieve similar effects. The project is in constant development, and changes to it are communicated via the Discord server, I hope you can find usage for it :wink:

Notes and References:

27 Likes
2

+vouch
+rep

thank you sir, very good

4 Likes
3

This new version of RbxStu looks like a major leap forward! :fire:

The way you shifted the tool’s focus, from executing external scripts to becoming a controlled environment for deep instrumentation and debugging of Studio, shows maturity in the project and a strong respect for serious developers in the community.

Tools like this, when used responsibly, are absolute gold for professional Roblox developers.
Congrats on the great work, @roalex2008!

And best of luck with the ongoing evolution of the project. :four_leaf_clover:

3 Likes
4

Ok Imma try this out
EDIT: How to download Pls help me

5

I think he left the download file in his Discord server.
Idk its kinda sketchy to me but im not giving any alegations to it being a malware

1 Like
6

I already answered this before, and yet again, you don’t need to use this. You can buy a cheat, I suppose, and go with that, but you be you. If you trust a random, unknown, packed and obfuscated executable, than mine, which isn’t any of the aformentioned :skull_and_crossbones:

7

Bro im not gonna buy any cheat wdym??? :skull::skull::skull:
Client anti cheats not really worth the effort and command bar to me is more than enough for example.

8

Client anticheats are worth the effort. Command bar can’t do everything exploits can.

2 Likes
11

Project Update

RbxStu V4.10 is out! Major improvements on all fronts, as well as releases being moved to GitHub.

Changelog:

RbxStu UI (V1.2)

+ Added all known contributors to the Credits page! (You can request the contributor role in the Discord server if you DM me and have your GitHub connected)
+ Added always on top
+ Fixed ImGUI editor crashes
+ Added basic Luau Analysis capabilities to the UI
+ Added the ability to load custom Luau definition files
+ Fixed a graphical bug with notification toasts
+ Disabled Keyboard navigation (Editor is now usable)
+ Switched away from busy waiting; this should improve performance substancially.

RbxStu Core (V4.10)

+ Switched threadpool implementation. Threads will no longer be exhausted when performing asynchronous work internally.
+ Renamed DLL from RbxStuV4.dll -> RbxStu.Internal.dll
+ Fixed undefined behaviour during the dumping procedure
+ Updated signatures for Roblox Studio 0.681.0.6810805 (July 09)+. They should last more now.
+ Added product details to DLL.
+ Reduced newcclosure execution time (Should improve the execution time of hookmetamethod)

This update addresses many concerns and issues put forth by users, including many editor QoL changes as well as compatibility fixes, expanding the compatibility of RbxStu virtually to all computers that can run Roblox Studio; it also includes changes to the editor, adding very simple and light analysis capabilities (not on LuauLsp’s level, but better than nothing!).

There are more plans for updates and performance improvements, all of which will be announced in due time on the discord server (as I do not want to bump super old threads like this with updates, but as this one was fairly major I decided to do so!)

If you are still affected by issues, let me know in here or in the Discord server.

12

i doubt you know how any exploits work neither a client anti cheat, considering the fact your saying you can use the command bar, which is completely different from a normal exploit which has its own functions such as getgenv and httpget, Dottik is a trusted, reputable user, you clearly dont understand a single thing about exploits, and client anti cheats are the best, im out.

2 Likes
13

How to tell you that you are a skid without saying that:

So you firstly you say that exploiters can hook any client anti cheat making it fully useless and then you say that client anti cheats are superior.
You cant have 2 points at once mate.
Also server anti cheats is a way to go now thanks to AuroraScript anyway.

14

I have reason to believe you yourself don’t know what Aurora scripts are for truly.

I would sincerely recommend not to speak of things you’re not knowledgeable on, the command bar lacks many necessary commodities to properly test your game against cheats, and, last I recall, it itself don’t quite run with the game, rather in a weird middle place, which isn’t particularly exploit like on the slightest.

Furthermore, you claim it is sketchy to leave a download on a discord server, I have since around a few weeks, before I got into midterms, moved the releases to GitHub as I wanted to clean things up a bit, and by directly mentioning it, you’re bringing fourth allegations of it being malicious in nature. Just it being in GitHub doesn’t mean it’s safe.

You’re the kind of individual that believes anything on GitHub is safe and sound, client Anticheats have their place, and knowing your past messages you’re likely not even talking about active measures against exploiting, rather validation, which is something you should do already, and not doing so proves you’re not fit for writing any user facing application.

Cheers

2 Likes
15

Not really but moving it to github are an improvement now definatly. Still to me idea of client anti cheats is so niche and barely rewarding; its more of a side quest with low priority.
Glad to see you actually improving this tool :handshake:

16

handshakes exist.. use your mind, when da hood added their anti cheat, cheats went offline for a solid month because all of them are just skids, also calling me a skid is wild when you said you could use command bar, please hop off and go learn instead of talking bad to your master, i am way more experienced than you, ive been making anti cheats since 2023.

17

“So you firstly you say that exploiters can hook any client anti cheat making it fully useless and then you say that client anti cheats are superior.”

script.disabled = true, is this your definition of a “client anti cheat bypass”, i dont think you know jack#### you genius.

18

That’s skid-tier anti-cheat, straight up.
It’s a glorified placebo that wastes bandwidth and doesn’t catch anyone except the dumbest exploiters.
Real anti-cheat lives server-side-where the client can’t lie.
A decent exploiter can hook whatever script sends your “handshake” and spoof it in their sleep. All you’re doing is sending packets to feel secure.

Experience is just a number-basically a counter for how much time you’ve potentially wasted.
Competence doesn’t care about time. It shows when you learn, not just when you exist.
You don’t become smart by stepping on the same rake for five years straight. That’s not growth-that’s just stubborn repetition.

Just make a damn game, vro :wilted_flower: :folded_hands: Nobody cares about your not-working anti-cheat that eats up performance.

22

that is not a flex :broken_heart:

2 Likes