xAPI - A Powerful Pentesting and Debugging Tool

[SQLanguage (Eskue)]

Introduction

xAPI is a fast, flexible and powerful pentesting and debugging tool written in pure luau.
It can detour, decompile and clone functions, hook metamethods and features over 45 globals that emulate the functionality of most executors.

Installation

To install xAPI, you will need to install the module from the GitHub repository and then insert it into your game, preferably inside of game.ReplicatedStorage.

You can then use the following script to load xAPI:

require(game.ReplicatedStorage.xAPI).load(debug.info(1, "f"))

Feedback and Improvements

• Go to Issues for questions or bugs
• Go to Pull Requests for improvements

---

Notes

Current version: 4.0a

[koliemini (Chessboard)]

Pretty sure this is against Roblox ToS. Its pretty much the same thing as a Ultimate Trolling GUI. If you put it inside the game, your game will get deleted.

[SQLanguage (Eskue)]

Is it really? There’s no real exploiting nor anything that ruins other players’ experience. I mean you could do it, but that’ll be like saying Roblox Studio is against the TOS because you can make TOS breaking content in it.

[koliemini (Chessboard)]

Unfortunately yes. Even if its not real exploiting you can still insert innapropiate things with it. Its the same case as Ultimate Trolling GUI. With that, you can also insert innapropiate things. I’ve seen countless Script Executor games get deleted in an almost instant.

The reason why its probably against the ToS is because it allows you to insert things without it being really in the game. Making the game basically not liable. The ToS prevents that and will get the game/creator banned.

[SQLanguage (Eskue)]

@koliemini

With that, you can also insert innapropiate things.

With xAPI there’s only one function which could insert innapropiate things: a modified version of require. That’s it. There’s no loadstring, Http requests or GetObjects.

(Outdated since v3.5.0)

[koliemini (Chessboard)]

@koliemini

The reason why its probably against the ToS is because it allows you to insert things without it being really in the game. Making the game basically not liable. The ToS prevents that and will get the game/creator banned.

I have updated the post. Require can also insert Ultimate Trolling GUI.

[SQLanguage (Eskue)]

And using require isn’t against TOS. Your point? Even if there’s a possibility of someone using my script maliciously, it’s still not me who did it.

[koliemini (Chessboard)]

Seems like you haven’t read my post.

@koliemini

Making the game basically not liable. The ToS prevents that and will get the game/creator banned.

require is only against the ToS if you’re inserting ToS breaking stuff.

[SQLanguage (Eskue)]

So require isn’t against TOS unless you are using maliciously? Doesn’t that apply to xAPI as well?

[koliemini (Chessboard)]

No. xAPI is a Script Executor. and once again the ToS doesn’t like Script Executors because they can make the game not liable.

[SQLanguage (Eskue)]

It’s not a script executor though.

[koliemini (Chessboard)]

[SQLanguage (Eskue)]

*Simulator. It’s supposed to mimic the functions of a Roblox executor which vanilla Roblox doesn’t have.

[koliemini (Chessboard)]

Simulator or not, its STILL a Script Executor.

[SQLanguage (Eskue)]

Have you read the source code? There’s no way you can execute scripts using it.

[Brylan_Leske]

Its no different then using HD admin :insert command… All It can do is require other things which have been uploaded to roblox and already passed moderation.

Anyway, the creator of the asset is not responsible for how people use it.

[koliemini (Chessboard)]

@SQLanguage

Have you read the source code

No. im not gonna read a 600 line code.

@Brylan_Leske

Its no different then using HD admin :insert command… All It can do is require other things which have been uploaded to roblox and already passed moderation.

Yes. But HD admin is for admins only. You can’t decline that it can be used by multiple people (which are also not ADMIN) and insert malicious things. You also can’t decline that multiple Executor games have been banned in the past and still are.

[bluebxrrybot (blueberry)]

Seems cool, but what are the use cases? Making exploits so skids can play with it?

[SQLanguage (Eskue)]

If you’re not gonna read it, then how do you know what you are talking about?

[Brylan_Leske]

HD Admin can be used by anybody??? It’s a free model, not limited to roblox admins. There are hundreds of free admin games which haven’t been banned. You can not insert malicious things via the require command or insert service, etc as they are only able to insert things which have already been uploaded to roblox and gone through moderation,

Script executers which make use of load string have been banned, that is because players can run their own code which has not been moderated by roblox in a live environment that roblox can not moderate.

Also, you dont need to read the source code, its not that hard to search for instances of load string and find that there are none.

Lastly, it really doesn’t matter. If roblox has a problem with this asset, they have the right to moderate it, you dont.