ROBLOX 2007 and 2008 RBXGS/RCCService leaks
Yesterday, multiple internal ROBLOX applications ranging from 2007 to 2008 were found and released.
Most of these are RBXGS, which is what ROBLOX originally used for their game servers. It requires a 2003 Windows Server with IIS (Internet Information Services) installed on it to run.
One of these (0.3.784.0, dated 5/13/2008) is another application called RCCService. It fulfills mostly the same purpose that RBXGS did such as rendering avatars and hosting games. RCCService is still used by ROBLOX today. It can be installed and run on your PC without modification.
After a little setup, I was able to render some avatars with it.
Here's a noob in 4k. We can render in any size we want.
This one is 64x64 large. We can modify any of the properties of the character.
A character with colors, a transparent arm, a missing leg, and a fucked up head. It's looking great! We can also add T-Shirts...
Fucked up faces (they weren't supported in 2008)...
And with a little bit of troubleshooting, hats.
We can render more than just avatars. We can render parts...
and Places. I could probably do entire models too.
You can do a lot with it if you mess around. You could also implement it into your own website to render avatars automatically and host 2008 games.
Using 2008 RCC to host games also results in more security over self hosted servers.
Player IPs are not exposed if someone attempts to grab them. It only shows the Server IP
Servers automatically shut down if a DLL is injected into a client
RCC checks the version of clients trying to join, and will refuse to connect if it does not match. This can be bypassed if you change the version of the client with a program, though
There are still RCE vulnerabilties in the client, however, so I'd be wary.
Another huge discovery in the RBXGS are PDB files. These files contain symbols (function names), where they are, and line information. Using this makes it much easier to reverse engineer. This means that we might see a reverse engineered 2007 or 2008 ROBLOX source available at one point, if someone decides to make it.
If you wish to check these out for your self, you can download them here.
kaledo-art
andulkaphoto
snowghoul
romaincrisis
