xAPI - A Powerful Pentesting and Debugging Tool

Resources Community Resources
, ,
#111

The LuauCeption VM does not work, but the LuauCeption bytecode compiler does. I used Fiu for the VM instead.

Also, Fiu uses an external environment to bring Roblox objects to the VM. I don’t know about types, but I am pretty sure they are only used for the IDE or when --!strict is enabled so we don’t have to worry about those for now.

#112

This wasn’t what I was talking about, but it should be enough to use Fiu and the LuauCeption compiler, you don’t need to step into the LuauCeption VM for this (unless you want to really implement functionality in C/C++ for low-level stuff)

#113

I am not using the LuauCeption VM though?

#114

Hey @SQLanguage! nice module there!

Just a question. is there any documentation for this?

1 Like
#115

You can use UNC’s documentation since xAPI was developed with UNC compatibility in mind.

1 Like
#116

Probably one of the best pentesting tools I’ve ever seen, especially since it works with every script I’ve used, with a little modification (like parenting things from CoreGui to PlayerGui) I have got dark dex v3 running, infinite yield, and various other popular cheats like remote spy. 10/10

1 Like
#117

Infinite Yield and Dark Dex if anyone wants it :wink:
darkdex.rbxm (2.6 MB)
infiniteyield.rbxm (2.5 MB)

3 Likes
#118

How’d you get remote spy working?

#119

Technically, remote spy doesn’t work since you need the games raw metatable from a localscript, but I got the gui working so its a win in my book.

2 Likes
#120

Technically, you could make a server script that tracks all remote events and then tells the client (if fired from the player) what they sent :thinking:

#121

Version 4.1 got released!

Changelog:

Added:

  • oth.hook, oth.unhook (more secure versions of hookfunction and restorefunction)
  • debug.getconstants
  • debug.getconstant
  • debug.getprotos
  • debug.getproto

Fixed:

  • Improved decompiler
  • Updated loadstring (Fiu and LuauCeption)
  • gethwid is now equipped with a real session tracking calculator

Go here to install v4.1 from GitHub!

All of the recently added debug funtions rely on the decompiler, which may ignore things like logic flow or locals.
2 Likes
#122

Ladies and gentleman, we did it.

SOMEONE SKIDDED OFF OF xAPI LMAO :rofl:

censoredv2
censoredv21920×1308 101 KB

To clarify, I have nothing against taking my code without permission. It only gets bad when you talk badly about other people while you have done nothing (good) on your own. Also, if you do decide to take my code, do not say that it is your own. At least imply that it was taken from xAPI.

5 Likes
#123

From what I understand he used xApi to fake execution right?

#124

This is insane work :skull: A level-2 executor and a bonus of a VIRUS :sob:

5 Likes
#125

I believe he made an executor that’s like 100% detected and used xAPI for the extra functionality.
Keep in mind, xAPI was meant for use inside of Roblox - inside of a sandbox. Executors aren’t sandboxed and thus are able to use C code for unrestricted code execution. Nano, however, skidded off of xAPI for (what I believe to be) atleast some of the functionality.

Keep in mind, xAPI, if you were to actually use it to inject into a Roblox game, IS DETECTABLE. xAPI requires some nifty oversights from the Roblox devs, but EVEN WHEN I WAS WRITING xAPI I KNEW that the following are detected, which are coincidentally the most used functions in the Roblox exploiting community:

  • hookfunction
  • getrawmetatable (and all relatives, such as hookmetamethod)
  • decompiler (and all of its children, such as debug.getconstants, dumpstring, etc.)

xAPI is also probably detected by, I don’t know, EVERY SINGLE ANTICHEAT METHOD???

Metaphorically speaking, he lobotomized Usain Bolt, paralyzed him and gave him a wheelchair with shopping cart wheels.

4 Likes
#126

How do you actually use this? There’s no images, videos, documentation, tutorials, or instructions anywhere that I can see. I saw some people getting it to work, but I can’t figure it out myself.

This also is not helpful. This is not your documentation…

#127

Yea I didn’t expect anything else from Nano :skull:

1 Like
#128

There is no need for images, just require the module and enjoy exploiting :100:

1 Like
#129

When I require the module, nothing happens. I don’t know how to run a pentesting script like a remote spy.

#130

Nothing is happening, because you didn’t setup an execution GUI.
You don’t need a GUI, however. You can just put together a script like this:

require(game.ReplicatedStorage.xAPI)()

-- Remotespy, darkdex, IY here

Some scripts may not work on the first try, so you may need to patch some things.
For example, Infinite Yield checks if a player is on mobile or not using a function that is protected by Roblox using the unsafe thread safety. To patch this, go to line 1939 and change the line from

local IsOnMobile = table.find({Enum.Platform.IOS, Enum.Platform.Android}, UserInputService:GetPlatform())

to the following:

local IsOnMobile = false
1 Like