String.dump reports blank function every time

Bug Reports Engine Bugs
#1

In a project I have been working on, string.dump is being used to verify the integrity of my functions so my code can ensure nothing was modified. However, I’ve noticed string.dump returns as if the function is blank when running in online mode for my code would constantly fail integrity checks. Although I could just not verify my code, string.dump not working in online mode seems like a bug to me for it works fine in Studio. Heres a repro:

local function Test()
   print("This is a test function")
end

local String_DumpedFunction = string.dump(Test)
print(#String_DumpedFunction, String_DumpedFunction) -- returns 12 characters even though it should be more every time
String.dump does nothing in Roblox, but documentation says otherwise
#2

Pretty sure this is intentional, otherwise you could steal some parts of private modules with it:

  1. require module
  2. string.dump module’s exported functions
  3. parse dump, reverse bytecode to Lua
  4. send code somewhere
  5. ???
  6. profit
2 Likes
#3

I wouldn’t be too worried about this if I were you.
As long as you have a smart client/server model with FilteringEnabled, clients shouldn’t be able to do much damage.

#4

Have you tried replacing non-whitelisted characters with something such as ? (to see that there was in fact something like that) :stuck_out_tongue:

I remember having to substract about 36 or 64 or how many characters it was (may depend on the path name) to get rid of something that made the rest of the string not show up (could be the NUL/null character?)

#5

Probably intentional to make reverse-engineering of the bytecode format harder.

#6

This is by design.

5 Likes
String.dump does nothing in Roblox, but documentation says otherwise
#7

Well damn, that’s kinda dumb. Why is this an intentional design, and why does it still work in Studio if not in online mode?

On a side note, guess I’ll have to setup a third party web server/compiler … Something I was really hoping to avoid.

#8

It doesn’t make sense to perform the check in OP anyway because if they can modify your code then they can also modify your check. It doesn’t seem like an effective or elegant security measure at all.

It’s not dumb because you don’t want people to be able to easily reverse engineer code from dump information. In Studio it doesn’t matter since you can’t require private modules there anyway, but online it does.

2 Likes
#9

All other replies in this thread are spot on. It works in Studio mostly because we didn’t have to break it there.

1 Like