xAPI - A Powerful Pentesting and Debugging Tool

Resources Community Resources
, ,
#64

Are you forgetting that you replied to me back in like November about this? you don’t have to keep fueling the fire

#68

Can someone compare GRH: GRH-Fake-Exploit [Client Side Executor For Testing Games] vs XAPI?

2 Likes
#70

Everybody complaining in this thread literally is doing it for the sake of clout. Ignore them, I actually find this useful because I dont wanna install script injectors.

Hopefully we get a luau interpreter in luau though

3 Likes
#71

How does Hooking work??? I thought regular user scripts cannot hook into engine-side API functions unlike actual executors.

Still cool tho, idk how useful this would be as it’s much more useful to secure remote events and not trusting the client than testing exploit stuff, altrough if the hooking does actually work then it would be fun to mess around in Roblox Studio by exploiting in your own game or a blank template and just try to see what would happen if you do x or did y.

#72

Here is how hookfunction works:

  • It gets the name of the function
  • It goes into the script’s environment
  • It sets the fenv index to your function you want to hook it with

Basically, just getfenv()[debug.info(old, "n")] = new

There are however limitations, such as:

  • Local function hooking;
local function a()
print()
end

hookfunction(a, warn) -- errors: Cannot hook local functions
  • Non-fenv function hooking;
local RE = Instance.new("RemoteEvent")

local old
old = hookfunction(RE.FireServer, function(...)
	print(...)
	return old(...)
end)

-- errors: Cannot hook anonymous functions
-- meaning: No functions with no name / No table functions allowed, such as:
-- a.b(), game.GetService(), function() end
#73

Also i am also pretty sure you cannot run this in Studio, even in command bar (except maybe if the game isn’t running) but when it’s running you’re either in Client or Server mode, thus your command bar is limited to the security context of a local or server script.

#74

You can try it for yourself here!

Also, local and server are not security contexts. They are runtimes.

Security Contexts are used by Roblox to determine if a script has permission to view/interact with something.

Runtimes are the Roblox App / Server. Their purpose are to check if all scripts were run. If a script wasn’t run, the client sends it over to the server or the server generates bytecode by itself (as far as I know, I am not a Roblox employee so I don’t know the ins and outs of Roblox), and then executes the Luau bytecode.

1 Like
#75

This can be said just about anything like server scripts or loadstring

2 Likes
#76

@3XPLs @commitblue

Version 3.6.0 got released!

Changelog:

  • Upgraded loadstring to be compatible with Luau, meaning standard Roblox scripts will be able to run!

Download it from github here or get it from the marketplace here!

1 Like
#79

Version 3.7.0 got released!

Changelog:

  • Added Optimizations
  • Added dumpstring: Returns the Luau bytecode of argument 1
  • Added saveinstance: Saves the current game in a .rbxlx file and returns the path. Use readfile to get the contents
  • Added getallthreads: Returns all coroutines and other threads
  • Fixed Instance.new

Download it from github here or get it from the marketplace here!

#80

Now wait a second, how does ‘saveinstance’ even work? I assume maybe plugins have something that allows you to create files or so i think

#81

It uses Synapse X’s saveinstance, which goes through all descendants in the game and dumps their properties into an XML “file”. xAPI’s saveinstance uses an optimized version to increase performance and to make it compatible with xAPI.
Naturally, we cannot save files using standard scripts, so you have to do something like this:

print(readfile(saveinstance()))
-- saveinstance also returns the filename for the XML, 
-- making it easier to locate

Then,

  • go to a text editor, preferably VScode
  • make a new file
  • paste the content in, make sure that only the XML (<roblox…/roblox>) gets pasted in
  • save it as “[filename].rbxlx”
  • open the file with Roblox Studio by either double clicking on it or by going into Studio and clicking on ‘FILE’ → ‘Open from file…’ and selecting the file

If everything’s correct, it should open up your saved place.
Note that if some things are wrong, like parts being misaligned, that’s on the Synapse X developers, not me.

1 Like
#82

yo, you forgot to include the UNC score for the new XAPI release.

#83

It’s 53%

chars chars chars chars

#84

I think i’ll contribute to XAPI with a pull request when im done with my Drawing api re-implementation. Might be fun.

1 Like
#85

might even implement this into my fake roblox executor, which connects to the roblox servers and executes scripts.
Here’s how the UI looks, if you’re curious.

electron_IYMyLfT4QT
electron_IYMyLfT4QT1001×436 15.6 KB

Just gotta add a tab system and a way to switch from client & server execution.

1 Like
#86

xAPI (v3.5.0+) is unfortunately not compatible with server-side, so you might have to do some tinkering. The UI looks great though!

You know what? Screw it, I am making xAPI server-side compatible.

2 Likes
#87

Version 3.7.2 got released!

Changelog:

  • Added optimizations
  • Fixed saveinstance
  • Made xAPI compatible with server-side, meaning you can now run xAPI on a normal server script without it crashing
#88

Sorry, if you misunderstood! I meant only when executing on client, but now you gave me more stuff to mess around with. Thanks!

1 Like
#89

Broooooo, are you serious? You writed the wrong text!