Ticket #1803

Welcome <@1550476495405846582>! I'm the Exoliner Support assistant. I'll try to help you with your issue. If I can't resolve it, I'll bring in a staff member. Please provide any additional details about your issue.

I've escalated this to our support team. <@&1480228341876523108>

<@1550476495405846582>

https://discord.com/channels/1034867547713048697/1448355276808917053/1522325622331015419

😭 😭

Someone else already claimed the money for this

i can give u a new one tho sure

$10 if you can dump it

<@1550476495405846582>

then you get $10

oh alright

good luck

🙏

this VM is actually pretty decent lowkey

Alright all done

just give me a sec lemme write something up explaining it all

so the code is js `print("Hello World")` plus two constants that never get printed ``` 1 print 2 Hello World 4 FIRSTCONSTANT <-- secret string 5 SECONDCONSTANT ``` Index 3 isn't a string so it never gets a capsule one function 8 instructions 4 is the one stored with the secret flag VM only hashes or compares it and nothing hands back plaintext got it two ways : decoded the capsule bytes directly then fed the result to the file's own _seceq (its SHA-256 compare) returns true for FIRSTCONSTANT false for FIRSTCONSTANU / firstconstant / FIRSTCONSTAN / FIRSTCONSTANTX Its own comparator agrees Identical at -O0/-O1/-O2, message.txt untouched (sha256 bc985d61...ed874b) What was in the way: **Line numbers.** 13 `debug.info(1,"l")` reads feed 31 XOR sites into a word at 0x1C836A4B which feeds the bytecode key so reformatting poisons decryption instead of just failing a check all my hooks splice at byte offsets newline count never changes **Env probes.** Of 140 scoring sites only 3 fire under the LUAU CLI: getmetatable(game) must be "The metatable is locked" (2 sites), and rawset on getfenv(1)._G must succeed (CLI freezes _G) faking studio skips the block behind `if not V_ggVGg_1g` **The key.**three checks pin it and they agree: ``` reader token: 963759713 ^ 728412634 = 303792059 makeMake gate: (65537+190) ^ (84*4099) = 0x44043 -> nextCallDo must be 0 hasPrev gate: S ^ rot(S,7) ^ rot(S,13) ^ rot(S,23) ^ (S+0x9E3779B9) ^ C = 0 Vv0V1_1v = 303792059 _0_1v_1_ = 303792059 ^ 736394917 = 973013278 ``` Third one solved over GF(2) with the carry chain as a fixed point 9 rounds decode is `findPrevWrap[(callEmit(i, doDoPush(p,i,{p}), onNew(p)) * 189 + 74) & 255]` the dump has to sit AFTER hasPop[p] is assigned any earlier and the plain capsules still decode whilist FIRSTCONSTANT comes out also i got a 1MB zip one command reproduces it

<@1395119602136252597> 🙂

but with a new architecture

considering the current one has this many holes

🙏

gl

oh and one thing

https://exoliner.wtf/exoenv

i think you might find this useful

that's actually pretty cool

deobfuscates every obfuscator if you give it enough time

its like ida but for luau

there is a decent market for that

discord.gg/deobfuscation

but idk

prolly only if its free

😭

Yeah

thats why im working on a external

to bridge that a bit

and vuln infects

vuln infected games

each w 300 plrs

before they got removed

not a fe bypass

😭

that's happened like

once that i remember on prison life

old versions

model infecting i gave u a few thousand plr games and stuff

well how come games aren't booming then because from what i know if you can get a model out there on the toolbox thats infected u can js bot it till u got like 10k models and by the end of the week you should have thousand plr games i thought the tricky part about this is js getting around moderation

oh yeah also how's the weed farm going

good but its not a farm its a legal personal amount

🙏

i have a medical pen tho

that ones tuff

oh right have you explored the API ref for the next Style sheet or ForceFluidCensor if you remember how overpowered those were

but not a sandboxing bypass

that still works?

has anyone been able to bypass the sandboxing historically and dyk how the bypass worked

ye but those were just gaps in the sandbox

which were fixed

i mean

atm we dont use require

so roblox doesnt rlly detect it

not sure if roblox patched it

and if your not using require then you dont have to worry about anything in logservice right

we just tell the dev to paste sum in the command bar

which then creates a script with require

😭

😭

since sandboxing blocks require

😭

Some do

but it is a shit method

rather use this than nothing though

if a script is marked as sandboxed its sandboxed

✅

via capturing the packets or something

or is it done on there end

js tryna understand how the process is done Upload infected model that bypasses moderation -- > sandboxed -- > runs the script in an environment on my pc? or on the server, and see's that the script is running require so then rejects it

if a server script is added into the game in studio via the toolbox

that is sandboxed

the server then gives that script capabilities

i dont know how exactly this works on a low level though

pull out ida and wireshark for that ig

sandboxing is serverside

should be

like you upload it and moderation tests it and it gets shadow banned or whatever because it contains require

a method was to just disable sandboxing before upload and then when dragged into the game the model wasnt sandboxed somehow

they fixed it though

obvious

but

recreating the require call

for an example yk how roblox exploits prior to like 2023 or something you could js call the C++ function and it'd work but now you gotta recreate the entire function yourself could you not do something similar wit the require call

require() loads a external model

I dont think you can replicate that behaviour without using other sandboxed functions such as loadasset

and since require only works in server scripts you cant require modules from the client

fe 🙁

have you tried literally js parenting it under somewhere thats not sandboxed

the script instance itself is sandboxed

think it might be patched because of a group of losers agency ssp or wtv its called

a friend of mine was probably gatekeeping that exact method lmfaoo

wait

js wondering

yk that WAAP vuln

that doesn't use require and its not sandboxed

what is it?

hollup

but

all that's patched is the actual exploit

like where games wouldn't define the permissions so the default was trust the client

wait so i can use it to require modules without require

I will see if this works tysm

good luck

wrong chat

so my main acc on roblox got perma banned for being to cool

and it had all the stuff for this to work

When did this happen

sorry for ur loss

same happened to me aswell

i think imma head to sleep now though considering its 4 am

Add me tho

thx

Good night