"Early Resumption Exploit".md

Works by:

1. suspending the thread via an instance function that yields or via task.wait
2. resuming the thread via coroutine.resume

Highlights:

• hides return values from hooks
• breaks those that "bypass" it (example: Simple Spy)
• works on any instance function that yields
• calling those functions will return the return values of the previous yield
• probably has other uses, i couldnt be bothered to explore

Example below ✅✅✅✅

client.luau

--!native
--!optimize 2

local ReplicatedStorage = game:GetService("ReplicatedStorage")
local RunService = game:GetService("RunService")

local RemoteFunction = ReplicatedStorage:WaitForChild("EarlyResumption")
local InvokeServer = RemoteFunction.InvokeServer

local function SecureYield(Function, ...)
	local Caller = coroutine.running()
	
	local Bindable = Instance.new("BindableEvent") -- Two separate events are required, won't work with just one
	local Waiter = Instance.new("BindableEvent")

	Bindable.Event:Once(function(...)
		Bindable = nil
		Waiter = nil
		
		coroutine.resume(Caller, ...)
	end)

	task.spawn(function(...)
		task.defer(coroutine.resume, coroutine.running())

		if select("#", Function(...)) ~= 0 then
			-- Quick check to see if the function even yields
			-- works because we call the function, thread yields, gets resumed by coroutine.resume
			-- if function actually yielded, we shouldn't get any arguments back
			-- this will obviously get fooled by functions that return nothing
			error("Function was tampered with or doesn't yield")
		end

		local Results = table.pack(Waiter.Event:Wait()) -- use waiter event to get the return of InvokeServer
		Bindable:Fire(table.unpack(Results, 1, Results.n))
		coroutine.yield(1, 2, unpack(table.create(7999, 0))) -- Required to break scripts that spawn a new thread such as Simple Spy
	end, ...)

	return coroutine.yield()
end

print("Performing the Early Resumption Exploit")

print("Client got:", SecureYield(function()
	return RemoteFunction:InvokeServer(false)
end))

print("Client got 2:", SecureYield(function()
	return RemoteFunction:InvokeServer(true)
end))

crash_studio.luau

-- unfortunately only works in studio, client simply throws an error (same behaviour in studio if it wouldn't crash)
local ReplicatedStorage = game:GetService("ReplicatedStorage")

local BindableFunction = Instance.new("BindableFunction")
local RemoteFunction = ReplicatedStorage:WaitForChild("EarlyResumption")

local function Crash()
	local Bindable = Instance.new("BindableEvent")
	
	task.defer(coroutine.resume, coroutine.running())
	RemoteFunction:InvokeServer()
	
	local Payload = table.create(7999, {})
	Bindable:Fire(coroutine.yield(1, 2, 3, unpack(Payload))) -- Crashes if the 8000th argument is not a number/string
end

Crash()

example_hook.luau

local ReplicatedStorage = game:GetService("ReplicatedStorage")
local RemoteFunction = ReplicatedStorage:WaitForChild("EarlyResumption")

local __namecall
__namecall = hookmetamethod(game, "__namecall", newcclosure(function(...)
	local self = ...
	
	if self == RemoteFunction then
		if getnamecallmethod() == "InvokeServer" then
			warn("EarlyResumption:InvokeServer()")

			local Results = table.pack(__namecall(...))
			warn("InvokeServer #Results:", Results.n) -- should print 0
			
			return table.unpack(Results, 1, Results.n)
		end
	end
		
	return __namecall(...)
end))

idea.luau

-- Rudimentary "hooking" example
-- Run on server

local RunService = game:GetService("RunService")

local function EarlyResumptionTest(TargetFunction, ...)
	local Event = Instance.new("BindableFunction")
	local SpoofedArguments = table.pack(...)

	Event.OnInvoke = function()
		RunService.Heartbeat:Wait()
		return table.unpack(SpoofedArguments, 1, SpoofedArguments.n)
	end

	return function(...)
		task.defer(coroutine.resume, coroutine.running())
		Event:Invoke()
		TargetFunction()
	end
end

local function MyNormalFunction()
	assert(typeof(game) == "Instance", "not overwriting game global..")
	-- assert(tostring(game):find("hf testing") ~= nil, "not overwriting game global..")
	
	if (pcall(table.clear, game)) or getmetatable(game) ~= "The metatable is locked" then
		error("not overwriting game global...")
	end
	
	local Test = Instance.new("Part", game)
	if Test.Parent ~= game then
		error("not overwriting game global..")
	end
	
	local GroupService = game:GetService("GroupService")
	local GROUP_ID = 57
	local pages = GroupService:GetAlliesAsync(GROUP_ID)
	warn("GetAlliesAsync:", pages) -- "GetAlliesAsync: Spoofed"
	warn(debug.info(1, "slnaf"))
end

EarlyResumptionTest(MyNormalFunction, "Spoofed")()

server.luau

local Remote = Instance.new("RemoteFunction")
Remote.Name = "EarlyResumption"

Remote.OnServerInvoke = function(player, shouldWait)
	warn("called server")
	if shouldWait then
		task.wait() -- isn't needed
	end
	return "hi", math.random(), {"lol"}
end

Remote.Parent = game:GetService("ReplicatedStorage")

DOES THIS MEAN I CAN REMOVE ADONIS HOOK DETUCTIAN FRAM MY ANTIAXPLAIT?

⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣀⡤⠤⠆⠐⠂⠀⠀⠀⠰⠤⠤⣄⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣠⡴⠖⠋⢁⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠠⠤⣀⡀⠉⠑⠲⢄⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⠖⠋⢁⣠⠖⠛⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠉⠳⢶⣄⣀⠉⠳⢤⡀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⢀⣴⠋⠁⣠⠖⠋⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⠓⢄⡀⠙⢦⡀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⣰⠋⠀⣠⠞⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⣄⠀⠙⢦⡀⠀⠀⠀⠀
⠀⠀⠀⢀⡞⠁⢀⣴⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⢷⡀⠀⠱⡄⠀⠀⠀
⠀⠀⢠⠏⠀⢀⡾⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⢳⣄⠀⠹⣄⠀⠀
⠀⢠⡟⠘⠉⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡀⠀⠀⠀⠀⠀⠀⠈⢹⠀⠙⡄⠀
⠀⡼⠁⠀⠀⠀⠀⠀⠀⠀⠀⠿⣿⣷⣶⣤⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣤⣶⣾⣿⣿⣂⣀⠀⠀⠀⠀⠀⠈⠃⠀⠱⡀
⢠⠇⠀⠀⠀⠀⢀⣠⡶⠟⠛⠛⠛⠿⣿⣿⣿⣦⡀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣴⣿⣿⣿⠟⠋⠉⠉⠉⠙⢷⣄⠀⠀⠀⠀⠀⠀⡇
⣼⠀⠀⠀⠀⢀⡿⠋⠀⠀⣀⣀⠀⠀⠘⢿⡟⣿⣷⡀⠀⠀⠀⠀⠀⠀⢠⣿⣿⠏⣿⠁⠀⢀⣠⣤⣀⠀⠀⠹⡇⠀⠀⠀⠀⠀⢽
⡟⠀⠀⠀⠀⢸⡇⠀⠀⢸⣿⣿⣷⠀⠀⠘⣷⠈⠻⣷⠀⠀⠀⠀⠀⠀⣿⠟⠁⢸⡇⠀⠀⢸⣿⣿⣿⠀⠀⠀⣿⠀⠀⠀⠀⠀⠈
⡇⠀⠀⠀⠀⠸⣧⠀⠀⠈⠛⠛⠋⠀⠀⣰⣿⡢⠀⠀⠀⠀⠀⠀⠀⠀⣀⢴⣻⣿⣷⡀⠀⠀⠉⠋⠉⠀⠀⣰⠏⠀⠀⠀⠀⠀⢠
⢹⠀⠀⠀⠀⠀⠘⢷⣄⡀⠀⠀⠀⣀⡴⠋⠙⠿⠳⢤⣀⡀⠀⠀⠀⣼⣷⣿⠟⠁⠈⢿⣦⣀⡀⠀⣀⣠⠾⠋⠀⠀⠀⡀⠀⠀⠀
⠈⣦⣤⡾⠶⠶⠖⠒⠛⠛⠿⣶⣿⢿⣤⣤⣤⣤⣤⣦⣿⣷⣤⣤⣶⠏⠉⠀⠀⠀⠀⣼⡿⢷⣿⣿⣿⣶⣶⣶⣶⣶⣾⠛⢷⣄⠄
⠀⣼⠏⠀⠀⠀⠀⠀⠀⠀⢰⢿⡇⠀⠀⠀⠀⠀⠀⠉⠉⠉⠉⠉⠉⠀⠀⠀⠀⠀⠈⠛⠃⠀⠀⣰⢶⡉⠉⠉⠉⠉⠉⠀⠀⢻⡄
⠀⡏⠀⠀⠀⠀⠀⠀⠀⠀⠋⣸⣷⣶⣤⣀⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⣀⣀⣤⣶⣾⣿⡀⠀⠀⠀⠀⠀⠀⠀⠀⠈⣷
⠀⣷⠀⠀⠀⠀⠀⠀⠀⠀⢠⣿⡏⠉⠉⠛⠛⠛⠛⠻⠿⠿⠶⠶⠶⠾⠿⠿⠟⠛⠛⠋⠉⠁⢈⣿⣧⠀⠀⠀⠀⠀⠀⠀⠀⢠⡿
⠀⠸⣧⡀⠀⠀⠀⠀⠀⣠⡿⠉⠻⣦⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣴⠟⠁⠘⢷⣄⡀⠀⠀⠀⠀⣠⡿⠁
⠀⠀⠈⠙⠲⠤⣤⠶⠟⠋⠀⠀⠀⠈⠙⠷⣤⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣀⣤⠾⠋⠁⠀⠀⠀⠀⠙⢿⣷⡶⠖⠛⠁⠀⠀
⠀⠀⠀⠀⠀⠀⠈⠓⢤⡀⠀⠀⠀⠀⠀⠀⠀⠉⠙⠛⠲⠦⠤⠤⠤⠤⠖⠚⠋⠉⠀⠀⠀⠀⠀⠀⠀⢀⣴⠞⠁⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⠢⣄⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⠶⠋⠁⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠉⠒⠤⢀⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⣠⠶⠛⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠉⠓⠒⠲⠤⠤⠤⠴⠦⠔⠒⠛⠉⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀

Woah haha what's this bad boy