xAPI - A Powerful Pentesting and Debugging Tool

Resources Community Resources
, ,
#131

Any idea how a remote spy would be done?

#132

We canā€™t really hook Instance metamethods, as Roblox metamethods are written in C, meaning that they donā€™t have an environment we can jam them with.

We can however use Instance wrapping to wrap called functions and indexed properties, though we can only hook remote events/functions that are invoked within the host script. I recommend using Emilarityā€™s guide on Instance wrapping as a reference, because although the guide is useful for the general idea and premise, it isnā€™t practical and the code snippets in the guide itself are prone to errors.

#133

detecting exploits? debugging your anti cheat? and more

1 Like
#134

Version v4.2 got released!

Change log:

Added:

  • FFlags - You can now disable and enable settings to efficiently modify how xAPI works (xAPI ā†’ FFlags)
  • Synapse X library and aliases
  • Even more aliases
  • File system
  • setreadonly, run_on_actor, checkcallstack, cache.replace, fireproximityprompt
  • loadstring, clonefunction, execute_clipboard, and the teleport queue are now equipped with the xAPI environment

Changed:

  • Improved decompiler even more. If the decompiler errors anymore, please let me know!
  • Better Instance type checking

UNC: 49%

Go here to install v4.2 from GitHub!

#135

I use Sirius, source code to test

#136

Can you provide a screenshot or code snippet from the error line, so I can determine what is causing the issue?

#137

Yes, do you have guilded? I need to contact yoi

#138

Like what Iā€™ve said in my other thread that you replied to before, Iā€™ve managed to elevate CommandBar to thread identity 6 (has the same as CoreScript permissions) and make xAPI work on CommandBar. Iā€™ve also modified xAPI and managed to shoot UNC up to 76% (76% success rate in the UNC test) without faking functions, implemented requests and game.HttpGet by just calling HttpService:RequestInternal() and some like WebSocket are implemented by actually executing code in my PC outside Roblox, by taking advantage of ScriptContext:SaveScriptProfilingData() to create a file inside my C drive and get the path to that file, and LinkingService:OpenUrl() to get the code inside that file to execute.

There is one issue that prevents having a good script execution experience though. And that is the fact that most exploit scripts use loadstring() while xAPI uses LuauCeption to compile Luau string into bytecode then passes it to Fiu, which is basically Luau inside Luau and that causes massive performance issues. Scripts like Dex Explorer freeze the client for over 20 seconds before successfully executing, and obfuscated scripts just throw a C stack overflow error.

If we could find a way to implement a reliable loadstring function, this modified version of xAPI can beat actual executors such as Solara. What I first had in mind was making the client invoke a RemoteFunction which will call the loadstring function on the server, then return the function that loadstring returns back into the client, but found out that functions can not be passed through RemoteFunctions.

3 Likes
#139

problem with executors is that they are level 8 now, i was able to test solara and printidentity() returned 8 (i dont know the actual legitimacy of it, it may just deliberately print 8 to fool the user)

#140

With Roblox Internal permissions, it is only possible to elevate thread identity to 6.
image

However, since level 6 has RobloxScript permissions and is like a CoreScript, this should cover most stuff that exploit scripts need level 8 for. The only thing that level 6 doesnā€™t have access to is RobloxEngine locked stuff, such as game:GetService("NetworkServer").

#141

Solara fakes functions btw

lol
lol1300Ɨ1008 248 KB

lol
lol1262Ɨ538 215 KB

Considering the Solara devs had the bauls to fake identity 3, Iā€™d say itā€™s more than likely that identity 8 is fake too.

1 Like
#142

A quick way to check if an executor fakes thread identity 8, is to see if it passes this test up to RobloxSecurity.

local Security = {
    {"None", function() return workspace.Name end},
    {"LocalUserSecurity", function() return workspace.DataCost end},
    {"PluginSecurity", function() return workspace.RobloxLocked end},
    {"RobloxScriptSecurity", function() return game:GetService("CoreGui").SelectionImageObject end},
    {"NotAccessibleSecurity", function() game:GetService("Chat").LoadDefaultChat = game:GetService("Chat").LoadDefaultChat end},
    {"RobloxSecurity", function() return game:GetService("CSGDictionaryService").Name end},
}

for _, Tag in ipairs(Security) do
    local Name, Test = Tag[1], Tag[2]
    local CanDo, Error = pcall(Test)
    if CanDo then
        printidentity("Check passed for tag "..Name.." for identity")
    else
        printidentity("[Permission "..Error:sub(-2, -2).."] Check failed for tag "..Name.." for identity")
    end
end
5 Likes
#143

Version 4.3 released!

Added:

  • added instance wrapping: xAPI now supports game.CoreGui, game:GetHttp, and more!
  • full command bar compatibility

Changed:

  • hopefully fixed most problems with the decompiler, function hooking and loadstring

UNC: 54%

Go here to install v4.3 from GitHub!

1 Like
#144

Itā€™s not intended for placing in a real game, itā€™s meant as a tool to use in Studio to see what exploiters could do with an executor

#145

seems to not work anymore, scripts yield after calling the module

3 Likes
#146

It seems that Roblox has, once again, broken something without notice.
To temporarily fix this just remove the pipe connection thingy on line 259 in the main module.
Keep in mind you wonā€™t be able to use run_on_actor nor protect_function anymore.

I will release an official build fixing this soon.

#147

Powering Unreliability

I believe I have fixed it, but I donā€™t know how it worked before. It can run infinite yield, but some things are broken. I canā€™t tell if this is how it was before Roblox broke xAPIā€¦ but it seems to still be useful.

Basically, I just used breakpoints to find where it yielded and made a workaround that fixed it.

(edit): Removed my version from the reply, I think I forgot to remove some game-specific code.

You can ignore this. A use case would be debugging anti-exploits, using a remote spy, etc. The remote spy I tried with infinite yield did not work with xAPI which is unfortunate, but it maybe could be fixed one day?

1 Like
#148

@TeeMinn

Version 4.4 released!

Added:

  • Decentralized GetObjects: game:GetObjects is now able to import untrusted models without InsertService!

Fixed:

  • Fixed proxy piping and networking

UNC: 55%

Go here to install v4.4 from GitHub!

1 Like
#149

I was still having problems with requiring in this version! No idea why, but Luau decides to stop running the code after requiring. If you debug with breakpoints it works, otherwise something stops the thread.

image
image1258Ɨ108 14.6 KB

I did a lot of changes in an attempt to fix it, but I believe adding a task.wait() at the bottom of the xAPI module fixed it. The fake script may have also had something to do with itā€¦? I donā€™t really know! :cry:

I donā€™t like my solution to this, any investigation in the original version would be appreciated.

Anyways. I added file system saving using one of my resources!

1 Like
#150

solara executor is level 3 identity, most their stuff is faked

1 Like