RealClone

• Injection into the live client. Manual map + thread hijack, the client survives and stays responsive.
• The injection method of the original product is verified, not guessed. An ETW trace of the original injector (Microsoft-Windows-Kernel-Audit-API-Calls) shows it opens the target with PROCESS_ALL_ACCESS, opens ~280 threads with THREAD_SUSPEND_RESUME and never calls NtCreateThread — it hijacks a thread. RealClone does exactly that.
• Luau execution inside the game process. The executor compiles and runs scripts with a vendored Luau VM and talks to the injector over \\.\pipe\realclone_<pid>.
• Hyperion countermeasures. No foreign threads, no unwind table registration, no vectored exception handler unless asked for, the pe header of the mapped image is wiped after the runtime is up.
• Analysis tooling. ETW traces, minidump parser, call and reference scanners, memory dumper, reliability and stability harnesses — all in tools/.

1. Manual map. The image is copied section by section into a private allocation, DIR64 relocations are applied, the import table is resolved against the target's module bases and the section protections are restored. NtCreateSection(SEC_IMAGE) is blocked on this machine (the kernel answers 0xC00000F4 for every variant, even for signed system dlls).
2. Thread hijack. A thread is suspended, its context is rewritten and it is resumed so that it jumps into a stub inside the mapped image. The stub aligns the stack pointer, the kernel rejects a misaligned stack pointer when a hijacked thread returns from a system call.
3. C runtime. The module uses the static CRT (/MT). The CRT cannot find its own module with GetModuleHandleEx(FROM_ADDRESS) because a manually mapped image is not in the loader lists, so that import slot is redirected to a stub that answers with the mapped base. The CRT keeps per module state below base + 0x4000, so the first pages stay writable.
4. Executor. The module entry runs, the CRT is initialised and the worker serves the named pipe. The injector sends EXEC <source> and gets the output of the script back.

WORKING ON the bridge into the Luau VM of the client, so that the scripts see game, workspace and the rest of the game, like the original product.

What is known:

• The client is packed. Its image is mapped twice, once by the loader and once into a private writable region — the live code, the Luau VM included, runs from the writable copy.
• The base of that copy is found at runtime by searching for the instruction pattern of lua_getfield (41 B9 EE D8 FF FF, the index of the global table) and subtracting its rva 0x2619780.
• lua_getfield lives at base + 0x2619780 and compares its table index against -10002 (globals), -10001 (environment) and -10000 (registry).
• The compiler of Luau is not in the client: the parser messages are in the image and are not referenced by any code, so the client only executes bytecode it receives. A script has to be compiled elsewhere and the bytecode version has to match.

Still open: the lua_State. The states live on the heap of the client and their layout is version specific, so they have to be found at runtime and validated against the api.

cd realclone
cmake -S . -B build/project -DCMAKE_BUILD_TYPE=Release
cmake --build build/project --config Release --target RealClone
cd injector && cargo build --release

# inject into a running client and run the smoke test
.\injector\target\release\realclone.exe run --pid <roblox pid> \
    --dll build\project\Release\RealClone.dll --script tests\smoke.lua

# reliability harness
powershell -File tools\reliability-test.ps1 -Runs 12 -Retries 1 -Wait 25