kingdudely

http://www.roblox.com
http://www.roblox.com/Adhoc.ashx
http://www.roblox.com/AgeUpConfirmation.aspx
http://www.roblox.com/Badges.aspx
http://www.roblox.com/Browse.aspx
http://www.roblox.com/Catalog.aspx
http://www.roblox.com/Content.xsd
http://www.roblox.com/Default.aspx
http://www.roblox.com/Empty.aspx
http://www.roblox.com/favicon.ico

kingdudely

bypassing blocked function protections using corescripts

author: James Napora.

---

roblox and exploit fundamentals

• corescripts have RobloxScript permissions on Roblox.
• exploit function protections do not run on any threads except exploit threads.
• roblox has several permission levels: None, Plugin, LocalUser, RobloxScript and Roblox.
• actors on Roblox run whenever a script under it has a client run context, e.g local scripts, scripts with RunContext.Client and corescripts.
• scripts under actors share the same global state

kingdudely

/**
 * cloudflare-worker-youtube-dl.js
 * Get direct links to YouTube videos using Cloudflare Workers.
 *
 * Usage:
 *   GET /?v=dQw4w9WgXcQ
 *   -> Returns a JSON list of supported formats
 *
 *   GET /?v=dQw4w9WgXcQ&f=251
 *   -> Returns a stream of the specified format ID