User blog:MiXiPixel/Proto-Pasta: "Gotta Go Slow"

Hello.

This all started back when I was in my prime of playing Roblox - 2016. I just now built up the courage to tell people about it.

Chapter 1 - Gotta go... slow?
It was a normal day in 2016. I woke up to see nothing much new, apart from the fact that my friend sent me some weird game and I had 60 tix instead of 50.

I clicked on the game my friend sent me. It was a fanmade sonic game - but it was off, and kinda creepy. Not like Sonic.exe, but just... it felt... Well, the best way to put it - It felt "wrong".

Soon, Tails (the character I was playing as) started slowing down, and yawning a lot. She then fell asleep. I then got kicked from the game because of an "invalid instruction from emulation line #F73A", whatever the heck that means. I told him that it felt very strange, so we went back to playing Make A Cake: Back for Seconds.

I spent all day trying to forget that weird emulation thing, and wondered if I could join back.

I eventually joined back, and yes - it let me! However, on the selection screen, Tails was gone. Not dead, not covered in blood, just GONE. A blank spot. I selected what used to be tails, and then I got kicked again, for the same error.

So I rejoined, this time choosing the man himself, Sonic the Hedgehog. He didn't run though, like he did before - instead he just casually walked and wouldn't roll into a ball if I pressed S.

There were also no enemies. It was actually very peaceful - I got to explore all of Green Hill Zone while casually walking and not dealing with any hazards. But then at the end of the zone, there was meant to be a fight with Dr Robotnik.

Instead, he was asleep, in a bed. The game took control from me and then displayed a cutscene where Robotnik wakes up and throws Sonic into a fire. I then get kicked for that emulator thing that happened before.

So, is that what happened to Tails? I rejoined and no, it was different. Sonic was still an option, but he was charcoal colored, and honestly looked sad.

Chapter 2 - The Realization
I selected Sonic and I got kicked from the game, this time saying "Sonic must recover first."

Okay then...? So the game's just telling me to let him rest or something. I leave the game, then notice the guy who sent me the link blocked me."Why did he block me?", I wondered. I clicked on his profile. Nothing seemed off except for his avatar, which was now dull, and his bio.

"I must rest first."

Rest to do what? Why rest? I was super confused and it was 2 in the morning, so I went to bed.

I woke up to a friend request from him. His avatar was once again brightly colored, and the weird bio was gone. I accepted and asked him why he blocked me.

"He BURNED me."

Suddenly I realized what was happening. The game was sort of controlling him... it's hard to explain. I then play the game as Knuckles, and once I make Knuckles walk, I get flung out of my chair and start walking until my hand flies off the D key.

"Oh my...", I thought. The game was indeed controlling us. The first person to play must've been my friend who is now controlled by Sonic, the second person was now Tails, and I was controlled by Knuckles.

My friend then told me something.

"I once invited another guy here, and he chose tails. But he just randomly disappeared last night..."

I decide that this needs to stop. I report the game, and sure enough a moderator eventually deletes it. I had a friend who was an expert hacker - sadly he's banned now, but he was able to copy the code from any Roblox game, and essentially bypass copylocks.

I had him copy this Sonic disaster.

Chapter 3 - The Investigation
I've been an expert in Lua scripting for years, even back in 2016. I decided to look in the game's files to see where my mutual friend could possibly go. Looking at the code, I figured out how it controls people - it uses exploits with cameras, variables, and heat sensors, which nowadays is impossible.

Long story short, it stores US in a variable - as an ObjectValue. From here it can literally do anything to us - this game could literally just have done PLAYC:Destroy and killed me. But it didn't. I figured out what it did with tails in a little script called "DeathConsequences".

It was a modulescript with 1 function with 2 arguments: Player, and Name. Name can either be Sonic, Tails, or Knuckles.

If Name is Sonic, it adds a fire particle and then removes it 15 seconds later... That's what happened to my friend.

If Name is Tails, it parents the player to another roblox game.

If Name is Knuckles, it does breakjoints on a random part every 10 minutes, and after 60 minutes it does :Destroy.

So I would have literally fallen apart and then be destroyed. Yikes. Anyway, I decided to check out this Roblox game.

The game was named "Permanent Residence". I had an idea - Roblox has an admin console for the game's creator. If I somehow take ownership of this game, I can parent the guy who was Tails to the real world.. somehow.

I asked a developer to do this - the most he was able to do is to tell admins not to ban me if I hack this guy.

So here we go.

Chapter 4 - The Recovery
I ask my nerd friend to hack him. 3 days later, I wake up and he says "yo i hacked 'em, his password is SNCBRTILSTKNUKI". I realized the password was a cryptic message - "SNCBR" is Sonic Burn, "TILST" is Tails Stuck, "KNUKI" is Knuckles Killed.

I logged in and freed his friend. Well I would have, but I wanted to be safe and looked in the code. Sure enough, there were 12 files named "Protect(num)".

Long story short, using an old Connect exploit that was fixed in 2018, scripts can run regardless of the game being run or not. I experienced this exploit later in 2017 when downloading free models. One of them was able to spread while the game wasn't running, and once even spread between games like my account itself was hacked.

So it checks if the scripts are modified at all, including editing and destruction, and does a whole bunch of stuff which, at its core, runs arbitrary code execution in Roblox to get into Windows, which deletes your MBR and corrupts your BIOS, then bluescreens your computer. This effectively fries your PC.

Not to mention I didn't even know how to parent something to the real world. I tried using game.Parent.Parent on a part, but that didn't work, it stayed in the game.

Anyway, we need to destroy every one of these 12 destruction scripts, as they also run if the game itself is run.

Then I have a spectacular idea - this chain of killer scripts may not be destroyable and the game may not be able to run, but I can use the Connect exploit myself to run code.

So that's the first part done, now I need to figure out how to get him out of there. Long story short, I program a camera, use an ACE hack to make Roblox read from it, and then get the parent of the parent of the parent of the image, which should go drive > PC > world.

Sure enough it worked.

The next day on the news, it was announced that a roblox Sonic Fangame developer was arrested. Probably the same one as this guy....