lu - unsafe luau methods library

*zune-first support

important note

this library is made only for educating purposes. i do NOT support using this library for anything malicious, including breaking roblox TOS. also this library is highly experimental and may be unsafe (well, the methods it implements are actually considered unsafe), so use at your own risk i would also consider disabling file system, as there might be an escape method

why did i create it?

well, it started with my attempt to reverse engineer some random serverside in roblox. as some code was obfuscated, i though it'd be great to have exploit apis (such as debug.getconstants) directly in studio/lune, so i could just dump code. i tried using xAPI from lune, but failed fast enough because it uses roblox-specific methods that need a translation layer and i was lazy to make them (yet i made lu..). so this is how this library was born do note that old code may be based off xAPI and other existing pentest libraries, but custom implementations are planned later on

TODO

• find or write a very fast and optimized signal module. currently using SignalPlus

• detect lune/lute/zune/studio/exploit environment for requires. alternatively add a flag for compat. low priority

• use luadoc and document everything

• add function whitelist/blacklist (w switch) that works on path strings (like "crypt.hash" + blacklist to disable whole crypt.hash lib)

• think of some overloading system that allows to use different implementations of the same function for compatability (see crypt.encode and crypt.encode issue)

• use a separate console for rconsole API

• Stuff (please rename me)

  • API
    • Exploit API (UNC)
      • cache
      • closures
      • crypt
      • debug
      • drawing
      • filesystem
      • input
      • instances
      • metatable
      • misc
      • rconsole
      • scripts
      • websocket
    • Roblox API
      • Methods
        • Workspace
      • Properties
        • Workspace
  • Intellisense support
    • Exploit API
      • cache
      • closures
      • crypt
      • debug
      • drawing
      • filesystem
      • input
      • instances
      • metatable
      • misc
      • rconsole
      • scripts
      • websocket
    • Roblox API
  • Asserts
    • Exploit API
      • cache
      • closures
      • crypt
      • debug
      • drawing
      • filesystem
      • input
      • instances
      • metatable
      • misc
      • rconsole
      • scripts
      • websocket

• Tests

  • Exploit API (UNC maybe?)
  • Roblox API

• Compats

  • Lune
  • Zune
  • Lute
  • Roblox Studio
  • Roblox Exploits

Credits

• zune - awesome luau runtime with FFI support and a lot of built-in libraries
• lune - luau runtime with roblox APIs support
• lute - official standalone luau runtime
• UNC documentation - useful information about unsafe methods, commonly used in roblox exploits (archived)