DevAX1T

According to all known laws
of aviation,


there is no way a bee
should be able to fly.


Its wings are too small to get
its fat little body off the ground.

DevAX1T

Write-up

A warning to Roblox developers about a powerful exploit primitive. In this, I will detail the research I’ve conducted into this attack vector and walk you through how you as a developer, can protect against exploits with primitives like this.

DataStoreService lets you store data that needs to persist between sessions, such as items in a player’s inventory or skill points. Data stores are consistent per experience, so any place in an experience can access and change the same data, including places on different servers.

By default, experiences tested in Studio cannot access data stores, so you must first enable API services. You will need to do this to test the vulnerabilities.

The idea I wanted to explore when pondering the above question was; can we exploit remotes to prevent data from saving? It is easy to blame the developer for not protecting themselves against such a simple exploit but it ends up being more complicated than that. I found plenty of examples of these vulnerabilities occurring

DevAX1T

-- load

local math = math -- GETGLOBAL
local newproxy = newproxy -- GETGLOBAL 
local ipairs = ipairs -- GETGLOBAL
local floor = math.floor -- GETTABLE KST(C)
local pi = math.pi -- GETTABLE KST(C)
local _nil = nil -- LOADNIL B -> C (1) 
local _true = true -- LOADBOOL B(1) 
local _false = false -- LOADBOOL B(0)

DevAX1T

local DS_INT_TO_INT = {} :: {[number]: number}
local INT_TO_DS_INT = {} :: {[number]: number}
local INT_TO_DS_CHAR = {} :: {[number]: string}
local DS_INT_MAX;
do
	-- All characters under this are control characters, must avoid them because
	-- they get expanded out into control sequences.
	local MIN_DS_VALUE = 0x20
	local MAX_DS_VALUE = 0x7E

DevAX1T

import * as Constants from './constants';

const randomInArray = <T>(arr: readonly T[]): T =>
  arr[Math.floor(Math.random() * arr.length)];

export interface Card {
  suit: typeof Constants.SUITS[number];
  face: typeof Constants.FACES[number];
  baseValue: number;
};

DevAX1T

local SEQ = {
	[0] = "A", "B", "C", "D", "E", "F", "G", "H",
	"I", "J", "K", "L", "M", "N", "O", "P",
	"Q", "R", "S", "T", "U", "V", "W", "X",
	"Y", "Z", "a", "b", "c", "d", "e", "f",
	"g", "h", "i", "j", "k", "l", "m", "n",
	"o", "p", "q", "r", "s", "t", "u", "v",
	"w", "x", "y", "z", "0", "1", "2", "3",
	"4", "5", "6", "7", "8", "9", "+", "/",
}

DevAX1T

Exploiting Debug Library Guide

Written by Greenman#0001

Last Updated Thursday, 05-Sep-2019 11:59:24 GMT-0400

Information

Before you continue, please understand these things:

• This guide is written based on Synapse X's debug functions