Linusware 1.2 — Source Code & Engine Architecture

Reconstructed, Reverse-Engineered & Documented by tekkenbugatti
Target Platform: Linux x86_64 / Luau / Roblox Runtime Engine

---

Overview

Linusware 1.2 is a native Linux x86_64 runtime extension and execution engine for Roblox / Luau. This repository contains the complete reconstructed source code derived through binary reverse engineering of the ELF runtime components, including full reverse analysis of the virtual machine hooks, opcode remapping tables, privilege escalation mechanics, and standard Universal Naming Convention (UNC) environment APIs.

---

Architecture & Core Components

1. HookedLuaResume (0x3a21d0) — VM Thread Interception

Installed as an inline 14-byte 64-bit absolute jump hook with a trampoline on the Roblox virtual machine thread dispatch entry (lua_resume).

• VM Pinning: Identifies the primary game VM by reading lua_State->global_State located at offset L + 0x20.
• Identity Elevation: Automatically elevates execution contexts to Identity 7 (LocalUser unrestricted) by assigning 0x303fffffffffffff to the capability mask and writing 0x7 to capability flags.
• Job Drain Queue: Intercepts thread execution steps to synchronously drain and execute pending script payloads from the thread-safe job queue.
• Autoexec Synchronization: Automatically scans and launches background loaders for scripts placed in autoexec/ on initial VM contact.

2. HookedCapThrower (0x399900) — Security Check Suppression

• Intercepts the engine's internal capability verification routine (cap_thrower).
• Utilizes thread-local storage (tls_cap_depth, corresponding to %fs:ef8c) to dynamically suppress capability violation exceptions while executing user scripts.

3. OpcodeEncoder (0x399640) — In-Place Luau Bytecode Remapper

Roblox's VM scrambles standard Luau bytecode opcodes to deter static analysis. OpcodeEncoder re-encodes instructions in memory:

• Bitmask A (0x0829400003f02323): Decodes variable-length instructions (AUX dwords) for opcodes 7 .. 0x42.
• Bitmask B (0xfe7b): Decodes extended variable-length instructions for opcodes 0x4a .. 0x59.
• Opcode Translation: Replaces opcode bytes in-place using the extracted g_wire_for_opcode lookup table.

4. GrantProtoCapabilities (0x39a360) — Recursive Prototype Escalation

• Recursively traverses the compiled Luau prototype hierarchy (LuauProto).
• Writes the address of the global capability descriptor (&g_capability_grant) to proto + 0x38 on all root and nested child functions (proto->p).

5. UNC Script Environment (58+ Functions)

Implements standard execution APIs:

• Closures: hookfunction, hookmetamethod, newcclosure, clonefunction, isexecutorclosure, getrawmetatable, setrawmetatable.
• Memory & Upvalues: getupvalues, setupvalue, getconstants, setconstant, getprotos, setproto.
• Filesystem Sandbox: readfile, writefile, appendfile, delfile, makefolder, delfolder, listfiles, isfolder, isfile.
• Cryptographic Utilities: crypt.encrypt, crypt.decrypt (AES-CBC, AES-GCM), crypt.hash (SHA-256, SHA-384, SHA-512), crypt.base64encode, crypt.base64decode, crypt.lz4compress, crypt.lz4decompress.
• Network & Reflection: request, HttpGet, WebSocket.connect, decompile, cloneref, setclipboard, getfpscap, setfpscap.

---

Project Structure

linusware_src/
├── include/
│   └── linusware/
│       ├── linusware.h          # Core engine interfaces & public exports
│       ├── messages.h           # String tables, errors & logging constants
│       ├── script_environment.h # UNC function table registrations
│       ├── workspace.h          # Filesystem sandbox definitions
│       ├── crypto.h             # OpenSSL AES & SHA wrappers
│       ├── encoding.h           # Base64 & LZ4 compression helpers
│       ├── websocket.h          # WebSocket client interfaces
│       └── decompiler.h         # Luau bytecode decompiler definitions
├── src/
│   ├── linusware/
│   │   ├── hooks.cc             # HookedLuaResume, CapThrower, OpcodeEncoder, GrantProto
│   │   ├── linusware.cc         # IPC server (exec.sock) & job queue dispatch
│   │   ├── script_environment.cc# Implementation of 58+ UNC environment APIs
│   │   ├── workspace.cc         # Sandboxed IO implementation
│   │   ├── crypto.cc            # Cryptographic primitives
│   │   ├── encoding.cc          # Base64 & LZ4 implementation
│   │   ├── decompiler.cc        # Prototype decompiler implementation
│   │   └── websocket.cc         # Network socket layer
│   └── cli/
│       ├── linusware_cli.cc     # Standalone CLI payload sender
│       └── wayland_clipboard.cc # Wayland/X11 clipboard bridge
└── CMakeLists.txt               # Build configuration

---

Building

Requirements

• Linux x86_64
• CMake 3.20+
• Clang / GCC with C++20 support
• OpenSSL & LZ4 development packages

Compilation

cd linusware_src
cmake -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build -j$(nproc)

---

Credits

Reconstructed and reverse-engineered by tekkenbugatti.