Signature Buffer Overflow

Signature Buffer Overflow

YOU NEED TO ADD YOUR OWN ADDRESSES! Only applies to 2009M-2018

Explanation

• A buffer overflow is a memory vulnerability where custom or legacy engine code can be exploited by inputting more data than a buffer can handle. It's like a RCE but worse. That's why you need to patch this. To prevent this, you need to patch this.

How it works

• CRoblox: Detours CRobloxApp::InitInstance and CRobloxCommandLineInfo::ParseParam to allow authentication and join-script command line arguments.

• Context: Adds verbose (or, at the very least, easier-to-understand) error messages for permission checks. This is only enabled when Lure is compiled as Debug.

• Crypt: Adds SHA256 support for signature verification and patches a buffer overflow.

• Http: Detours Http::trustCheck and Http::httpGetPostWinInet. Replaces the trustcheck with a custom check wherein you can include your own domains. Also redirects the /asset, /Thumbs/Asset.ashx, and /Thumbs/Avatar.ashx endpoints to their modern Roblox counterparts.

• ServerReplicator: Enables ticket authentication by hooking ServerReplicator::processTicket and ServerReplicator::sendTop. Note that this has generally only been tested on 2011 releases.

• StandardOut: Detours StandardOut::print to a console window. This is only enabled if Lure is compiled as Debug.

Configuration

For finding subroutine addresses, x64dbg or IDA Pro is recommended.

Name	Expected value
ALLOWED_WILDCARD_DOMAINS	Domains that are allowed no matter the subdomain; i.e. if google.com was whitelisted, google.com, a.google.com, and a.b.google.com would all be valid.
ALLOWED_DOMAINS	Domains that are allowed only if the domain exactly matches; i.e. if roblox.com was whitelisted, roblox.com would be valid whereas test.roblox.com would not be.
ALLOWED_SCHEMES	URL schemes that are allowed; http, https, etc. This is only for proper URLs.
ALLOWED_EMBEDDED_SCHEMES	Don't modify this unless you know what you're doing! If a passed URI begins with this scheme, then the entire URL is valid; the data thereafter is irrelevant. This is only used for things like JavaScript and IE resources.
PUBLIC_KEY	The Base64 encoded public key for signature verification. Default is the Roblox public key.

Other preprocessor configuration is just addresses to subroutines. You may define RESOLVE_OFFSETS if the client obfuscates address locations on startup; Lure will find the addresses for you.

Tutorial for building the DLL.

For this tutorial we will need to use vcpkg.

Copy this into git.

git clone https://github.com/lrre-foss/lure

Write the classes and all that.

Once you're done, open Visual Studio.

Then, select Open a local folder and open the place where GIT cloned Lure to.

Visual Studio will already detect Lure.sln and open vcpkg.

Set your build configuration type to debug.

Finally, build the dll.

Tutorial for hooking the DLL.

• Copy the output DLL file to where you are keeping the Roblox executable (usually named RobloxApp.exe)

• Open the Roblox executable with StudPE (File -> Open PE File)

• Go to the Functions tab

• Right click in the left panel and click Add New Import.

• Click Dll Select and browse to Lure.dll in your Roblox folder

• Click Select func. and select import from the list that appears

• Click Add to list, then click ADD at the bottom

• Close the program by clicking OK. This will also save the patches to the executable file