How to Printsploit

Good Morning, skids.

 

Today we learn how to call and find a simple function in Roblox.

 

Requirements -> IDA Pro and anything that is able to reconstruct the imports (such as Scylla or PE Tools).

 

 

 

Step 1 - Dump Roblox

 

Dump Roblox.

 

Step 1.1 -> Select Roblox's Main Process (the process that uses more resources, the other one is yara).

 

https://cdn.discordapp.com/attachments/972845808678490146/996309033793372161/unknown.png

 

Step 2

 

Open IDA Pro 7.7 -> Disassemble a new File -> Select your dump of RobloxPlayerBeta.exe.

Edit -> Segements -> Rebase Program : Set it to 0x1000.

 

https://cdn.discordapp.com/attachments/972845808678490146/996309176802344970/unknown.png

 

Let IDA analyze, depending on your CPU this can take up to 3 hours

 

 

Step 3 - Find the Print Function

 

IDA fully analyzed? Good now for the fun part.

Hit Shift + F12 on your Keyboard and filter for the string "Invalid BrowserService Command %s"

 

https://cdn.discordapp.com/attachments/972845808678490146/996309402703376444/unknown.png

Double click the result

 

 

Highlight "aInvalidBrowser" with your cursor and hit X.

Click the first Xref and it you will see something like in the picture below

https://cdn.discordapp.com/attachments/972845808678490146/996309506881507378/unknown.png

 

Now decompile the call (sub_3FBE50) by double clicking it and then pressing F5.

https://cdn.discordapp.com/attachments/972845808678490146/996309579086450719/unknown.png

 

Congrats you can call yourself an Reverse Engineer now (don't actually please)

 

 

Step 4 - Writing the Printsploit

 

Open VS2022, create a new Dynamic Link Library.

 

 

Config the Project however you want but make sure you select Release and X86.

 

 

Since I cbf with explaining every single line in this poorly written text editor I'll just explain it with comments

 

#include <windows.h>
#include <iostream>
#include <thread>

enum rbx_ptypes : uint8_t // enum with all types
{
	print,
	info,
	warn,
	error
};

bool __stdcall DllMain(HINSTANCE lib, uint8_t reason, void*) //is called when dll gets injected
{
	DisableThreadLibraryCalls(lib); //msdn: Disables the DLL_THREAD_ATTACH and DLL_THREAD_DETACH notifications for the specified dynamic-link library (DLL). This can reduce the size of the working set for some applications.

	if (reason == DLL_PROCESS_ATTACH) // self-explanatory
	{
		static auto mod = reinterpret_cast<uintptr_t>(GetModuleHandle(nullptr)); //gets base of roblox

		using rbx_print_t = void(__cdecl*)(uint8_t, const char*, ...); //type alias
		const auto rbx_print = reinterpret_cast<rbx_print_t>(mod + 0x3EB4E0); //mod + print address

		//supports formatting if u didnt know
		rbx_print(rbx_ptypes::print, "%s %p", "some string", &FreeConsole); 
		rbx_print(rbx_ptypes::info, "%s %p", "some string", &FreeConsole);
		rbx_print(rbx_ptypes::warn, "%s %p", "some string", &FreeConsole);
		rbx_print(rbx_ptypes::error, "%s %p", "some string", &FreeConsole);
	}

	return true;
}

 

Goodbye skids