Exploit

Not to be confused with the use of glitches to gain an unfair advantage also known as exploiting.

On Roblox, an exploit (known as a cheat in other games) is a third-party program used to alter the client in order to gain an unfair advantage over others. Exploits are also used in griefing, and are also used to steal places or models, including scripts. Some exploits are in the form of programs or injectable DLL files. Use of exploits on Roblox is against the Community Standards and is bannable. Roblox uses Hyperion to counter exploiting. Exploiting is sometimes known as cheating.

Most exploits allow injection of client-sided scripts to be run in a place the user is in. Exploits are also used to abuse vulnerabilities within a place's use of remotes, which could give exploiters more control over the place up to server-sided execution depending on the severity. Developers can prevent this by securing their remotes, such as adding checks to the server code. Some games such as Phantom Forces also implemented a votekick system designed to mitigate exploiters. Some models, particularly free models, may include a backdoor that can be used by exploiters, whether intentional or not.

The term exploiting is sometimes used for the use of glitches in the engine or scripts in order to gain an unfair advantage, though the more common term glitching is preferred to distinguish from third-party modification. An example would be wearing the V Pose - Tommy Hilfiger emote, which can then be used to clip through walls by playing the emote and then rotating the character instantaneously (turning the camera or using shift lock) while in full position. Such use of glitches is not bannable by Roblox, but players caught doing this can be banned by a developer if the game has moderation infrastructure, like an admin script.

Anti-cheat efforts

The Report Abuse feature allows users to report someone who is breaking the rules, which includes a category for users who are using exploits. The developer community also actively takes effort in mitigating/preventing exploiting. Anti-exploit scripts are developed which detect suspicious client behavior and kick/ban the user if found to be exploiting. Client-sided anti-exploit scripts cannot fully prevent exploiting as they can be bypassed via full control of the client.

In an effort to mitigate exploiters and bad networking practices within scripting, the FilteringEnabled property was introduced in February 2014 which turns on replication filtering, limiting the actions of the client that can affect the server via replication. In 2017, Experimental Mode was introduced which hid games without FilteringEnabled on for users under 13 and deprioritized them in search results. In 2018, Roblox hid Experimental Mode games for all users and limited their availability to only users over 13. Not long after, Roblox ultimately removed Experimental Mode and deprecated the FilteringEnabled property, effectively forcing replication filtering across all games.

In May 2023, Roblox released the Hyperion anti-tamper software which detects software interacting with the client and crashes the client if it identifies bad software, also known as "badware". Hyperion was initially developed by Byfron Technologies, the company that was bought by Roblox in 2022. Later in October, Roblox also entered a close partnership with Synapse Softworks LLC in countering exploits.

Types of exploits

Bytecode through loadstring function

When Lua runs programs, the Lua virtual machine compiles code to Lua bytecode before it is interpreted. This process is irreversible without artifacts (via decompilation) and thus was frequently used for Code Obfuscation.

Lua bytecode does not have the same structure as Lua and allows, by unconventional means, manipulation of the stack and other things that are not possible in normal Lua programming. It is possible, though difficult, to write Lua assembly code manually and to assemble it into Lua bytecode. The Roblox process can load Lua code and Lua bytecode through use of the loadstring function (which can be toggled on the ServerScriptService.)

It has been proposed on the Lua mailing list that direct stack manipulation could be used to access the environment of other functions during their execution and, therefore, to steal values from these functions (including C functions that Lua has access to), something which is not possible in pure Lua.

The Roblox user NecroBumpist proved the idea to be true and possible. Using Lua bytecode, he created a function that allowed a script to steal values from other functions, including C functions. This made it possible to steal values from Roblox's API's, but months passed until someone found a way to use this bug to modify the global environment and to become capable to make the core scripts and the join script execute any Lua code in a game server.

This resulted in the removal of bytecode from Roblox and the ability to use it with the loading function. Despite common belief, this exploit was unrelated to a Direct Dynamic Library (DLL) exploit in the same time period. The removal of bytecode had no other side effect than rendering code obfuscation impossible without other means.

Proto Conversion

After the removal of the Lua compiler from the client, Roblox made heavy changes to the Lua VM. Roblox-compatible bytecode after the change contained heavy use of encryption and obfuscation and required special signing from the server, which is where all client scripts were compiled. Generating this new bytecode from scratch would prove near impossible for would-be exploiters.

In the summer of 2015, Roblox exploiter Chirality on the now-defunct Roblox exploiting forum "v3rmillion" came up with an idea; by using the regular vanilla Lua compiler to generate a Lua function prototype, then modifying it to be compatible with Roblox's VM, he could achieve script execution. This process was made easier through use of C++'s very flexible data types, where after reversing the right structs, accessing all the data from a Roblox function prototype was trivial.

After solving the encryption, this user achieved script execution, and dubbed his method "proto conversion." He then created an exploit, which was the first of many exploits to use the new method. Some of the most prevalent and infamous exploits in history have used this method to execute scripts.

Lua Wrapping

A new method to obtain script execution was also in the works after the heavy VM changes that Roblox implemented. This method - dubbed "Lua wrapping" or just "wrapping", became the second most popular method to obtain script execution. This method worked by generating a fake Roblox environment in a normal Lua instance and emulating the regular Roblox environment in C functions implemented by the exploit. This made Roblox's attempts to patch these exploits extremely hard, allowing them to survive major security updates without any features lost.

Early attempts to implement this method of script execution was included in a few highly popular exploits - made by the some of the major exploit developers of the time. Both of these exploits were later rewritten to use Proto Conversion instead.

Around 2 years later, a new class of wrapper exploits was born with an exploit which, to this day, is one of the most popular exploits. Around a month later, another exploit also implemented the same method of obtaining script execution. Both of these exploits largely used the same methods described at the top of this section.

DLL Injection

Most current exploits are DLL files that are injected into Roblox using a DLL injector. Once injected, the exploit is able to function correctly. Injecting a DLL into a process is not all that is required, as Roblox has introduced many safeguards to prevent memory from being manipulated easily.

Lag Switching

Lag switching is an exploit that has not been patched since a demonstration in 2015. Loading up a lag-switch will allow you to use the hotkeys available. If the user triggers the activation, their computer will stop sending signals to the modem in this case the user is already using Roblox and can roam around freely, the user must reconnect their computer to the internet in 9 seconds or Roblox will shut down. If the user deactivates the lag switch, their client returns to normal. People complain about this exploit as users can "teleport" to almost anywhere in the game. One major advantage to the lag-switch, for exploiters, is that the client side of the game, GUI etc., still works as normal, so do workspace items, so they could, in a puzzle game with moving levers, disconnect and change the levers the complete wrong way and then reconnect to mess up the game.

Another exploit known as process freezing allows the user to freeze themselves by pausing all execution of Roblox code. An example of this was the Jailbreak exploit where people could pause the game's process to exit the train faster.

Exploit Levels

Levels are the Roblox Thread Identity that the script executed through the Roblox exploit is running. Normal LocalScripts run with Level 2, Roblox Scripts usually run with Level 3–4, the Command Bar on Roblox Studio runs with Level 5, and Plugins in Studio run in level 6. It is a common misconception that levels assosciate with how well an exploit is, but in reality, if you could already execute in Roblox, you could set the level. Most exploits run their scripts in Level 6 and intentionally downgrade their levels when calling certain functions in-game to avoid detection. Level 7 is an upper level that is commonly used in popular exploits. The last and most advanced exploit level is level 8. Scripts running on this scale have access to every function and therefore provide the most "freedom" to script developers.

Unified Naming Convention

The Unified Naming Convention (UNC) is a standardized API written in Luau designed to address the inconsistencies caused by different naming conventions used by various executors. These discrepancies often lead to incompatibility when an exploit does not support certain functions within a script. UNC aims to solve this issue by establishing a unified naming structure. Included in the repository is a UNC Test, which allows exploit developers to assess which functions their exploit supports. This initiative has had a significant global impact on the exploiting community, with many developers striving to achieve a high UNC score for their exploits.

Externals

In Roblox, "externals" typically refer to exploits or cheats, often used in FPS (first-person shooter) games where precise aiming is essential to success. These externals frequently include features like aimbots, silent aim, ESP (Extra Sensory Perception), and other visual enhancements, which provide players with unfair advantages. These exploits contain several distinct features, which will be explained in more detail below.

"Silent aim" refers to exploits that manipulate the hitbox of a weapon’s ammunition to ensure a more accurate hit on the target, without the game visually indicating a perfect shot. On the other hand, "blatant" aimbots allow the crosshair to perfectly track an enemy, resulting in obvious, flawless targeting. Silent aimbots are often preferred when trying to mask cheating, as they allow for subtle alterations in the range of aiming assistance.

These exploits typically don't work with games that use projectile-based weapons, but advanced exploit developers can adjust for projectile trajectories to improve accuracy. Other exploiters may also use scripts that aim for different parts of the body, such as the stomach, to avoid suspicion, as headshots are often more noticeable. However, while these cheats may be difficult to detect, they can still be recognized through careful observation, especially when used repetitively or with inconsistent gameplay.

Inappropriate exploits

Reader discretion is advised for this section. Read at your own risk.

Some exploiters have inserted inappropriate models, decals, and sounds and used scripts to do inappropriate things to avatars in game, prompting concerns of parents when such exploits are exposed to children. The most severe case of this and exploits in general was on the 4th of July 2018 when two exploiters were doing strongly inappropriate actions to a 7-year-old girl's avatar. This incident was featured heavily on several news websites, leading to Roblox permanently banning the exploiters and applying restrictions to Experimental Mode games (see Experimental Mode game restrictions for more info).Please note that antiviruses find exploits as a malware. Exploits are viruses on certain cases and others not, they slow down devices if executed.

See also

• Replication filtering
• Thread identity
• Glitch