Sources
Every source we compile to match functions in the clients, plus what we still need and cannot find. A function counts as matched only when source compiled with the client's exact compiler produces byte-identical machine code. These sources are where those bytes come from.
Client source list select client
Exact version means binary evidence identifies it. “Source present” means local, compilable code exists; it still must byte-match before it counts.
| Source | Version / build | Source code | Notes |
|---|
Roblox's own source biggest win
Real Roblox code. No library ships it; it has to come from a leak or a community decompilation.
| Source | What it gives | Status |
|---|---|---|
| RBXGSdecomp | RBLXDecomp/RBXGSdecomp — a matching decompilation of RBXGS 0.3.634.0 (Nov 2007), VS2005 SP1. App (v8kernel, v8world, humanoid, reflection, script), Network (Replicator, Player, Server), RbxView (Part, meshes), RenderLib, and its patched G3D fork. Recipes rbxgs, rbxgs-net, rbxgs-view, rbxgs-render, rbxgs-g3d. | used |
| RCCService decompile | verify-stack/rccservice-decompile — May 2008 server source using the same Boost/G3D/RakNet/Lua stack. Experimental client fingerprint run produced two matches (2008-06, 2009-06); not a full client tree. | experimental |
| 2016 leak forks | Roblox's forks of G3D 8.00, Lua 5.1.4, libjpeg, libpng and RakNet from the 2016 source tree. Recipes rbx2016-g3d, rbx2016-lua, rbx2016-jpeg, rbx2016-png, rbx2016-raknet. Code unchanged since the client era matches byte-for-byte. | used |
Open-source libraries
Third-party code statically linked into the clients. Pinned by SHA-256, preprocessed, compiled across a flag grid, then fingerprinted.
| Library | Versions | Status |
|---|---|---|
| zlib | 1.1.4, 1.2.3 (deflate/inflate) | used |
| libjpeg | 6b | used |
| libpng | 1.2.5 – 1.2.44 (16 versions swept) | used |
| Lua | 5.1.0 – 5.1.4 | used |
| G3D | 6.09 (source) + 6.10 prebuilt VC8 .lib | used |
| boost | 1.34.1, 1.35, 1.36, 1.38, 1.40, 1.44, 1.47 (+ shared_ptr / function / signal template instantiations) | used |
| RakNet | 3.0 (RBLXDecomp/raknet) for early RBXGS clients; public 4.081 and Roblox's 2016 fork for later clients | used |
| LAME | 3.98.4 and 3.99.5, named in 2011–2012 client copyright manifests; statically linked libmp3lame | recipe added |
| SDL | 1.2.11 (headers only — the rest is in SDL.dll) | headers |
| Ogre | 1.4.9, 1.6.4 and 1.7.0 SDKs. PDB paths identify 1.4.9 in 2009-06 and 1.6.4 from 2009-12 onward. The engine is in OgreMain.dll; only inline/template Ogre code is in the exe, plus Roblox's own Ogre::Rbx* subclasses. | partial |
| Scintilla MFC wrapper | PJ Naughter v1.20 / Scintilla 1.76; the exe carries the wrapper (CScintillaCtrl, CScintillaView) while SciLexer.dll holds the editor. | recipe added |
| Wild Magic | Magic Software Wild Magic 2 core, named in 2009 client copyrights; local-only source due license terms. | recipe added |
Hard limits
Functions that cannot be matched no matter what source we find.
| Limit | Effect |
|---|---|
| VMProtect | The later clients import vmprotectsdk32.dll and virtualize selected anti-tamper functions. Virtualized code is a VM bytecode blob, not real x86 — no C++ source reproduces its bytes, so those functions are permanently unmatchable. A small set (license / integrity checks), not the bulk. |
Compiler runtime & UI toolkits
Code the Microsoft toolchain and the UI library compiled into the exe. Matched from the exact installed compiler or the toolkit source.
| Source | What it gives | Status |
|---|---|---|
| MFC | 8.0 (VS2005), 9.0 (VS2008) — the static MFC that ships with each compiler | used |
| Codejock XTP | Xtreme Toolkit Pro 11.2.2, 13.2.1, 15.2.1 (the CXTP* UI classes), built on MFC | used |
| ATL | ATL 8.0 and 9.0 headers/source from the matching Visual Studio installs | recipe added |
| STL templates | Explicit instantiations of std::vector/list/map/set/string etc. from the VC headers (templates-boost-*, STL grid) | used |
| libcmt / libcpmt | Static CRT/STL (msvc-crt). 0 matches — the clients link the DLL runtime (/MD → msvcr80/90, msvcp80/90), so the static CRT objects are not in the exe. | 0 — /MD |
Techniques (no external source)
| Method | What it does |
|---|---|
| mass fingerprinting | roc mass compiles every configured source recipe with matching old MSVC builds and flag grids, compares machine code byte-for-byte against every client, then re-analyzes and runs auto-matching. |
| cross-client copy | Every matched source is recompiled against every other client; byte-identical functions shared between clients (and duplicate functions inside one client) match for free. Run separately with roc xcopy; mass does not invoke it automatically. |
| auto shapes | Trivial compiler-stereotyped functions (thunks, forwarders, small accessors) matched from their assembly shape. roc auto. |
| AI workers | A local code model drafts C++ for one function, compiles, diffs the assembly and retries — with a Rev.ng hint and the 2016 source for the class. roc worker. |
Download recovered sources
All available recovered functions, including partial and unfinished sources, are available in Findings. Browse code in RoConstruct-findings or download the source ZIP. Function scores on the Clients page distinguish exact matches from partial candidates.
Needed, but not found
Sources that would unlock more matches. If you have any of these, drop them in the Discord.
| Source | Why it would help | Status |
|---|---|---|
| G3D 8.00 / 8.01 source | The 2010–2012 clients link G3D 8.x. The official source zips were deleted from SourceForge and never captured by the Wayback Machine or mirrored to GitHub. The 2016 leak has a partial copy (used), but a clean 8.00/8.01 tree would match more of the rendering code. | missing |
| Client PDB / MAP | Symbols for any client exe would give exact function boundaries and real names — a huge boost to the AI workers and to unit assignment. None exist: the RBXGS installers carry only WebService.pdb (the grid service, a different binary), and the only leaked Roblox PDB is from 2022 (wrong era). | missing |
| Roblox's Ogre subclass source | ~950 Ogre::Rbx* functions per late client are Roblox's own Ogre subclasses (RbxSceneManager, RbxEntity, RbxCluster…). Ogre was dropped before the 2016 leak, so this source exists nowhere public. | missing |
| Exact per-TU compiler flags | Roblox built different translation units with different optimisation flags. We sweep a grid, but the real per-file flags (from a build log or project files) would match the functions the grid misses. | partial |
| More community decompilations | RBXGSdecomp covers Nov 2007. A matching decompilation of a later build (2009–2012) would directly supply RBX source for the newer clients, where the 2007 source has drifted. | wanted |
Checked, not useful
Leads that were investigated and ruled out, recorded so they are not chased again.
| Lead | Why not |
|---|---|
| VS2005/2008 CRT ISOs | Only provide static libcmt/libcpmt — 0 matches against /MD clients. |
| rccservice-decompile | RCCService is the server binary and uses gSOAP, which desktop clients do not link. One isolated run still produced +2 incidental matches; not a broad client source. |
| ODE / Open Dynamics Engine | Not linked — no ODE RTTI classes or version strings in the clients. Roblox used its own physics. |
| RomkoSI/G3D, elfprince13/G3D10 | Both are G3D 10 (2016+), far past the 6.x–8.x the clients use. |
| 2022 RobloxStudio PDB leak | Right artifact, wrong era by a decade. |
Full write-up: SOURCES.md.
Recipes live in roc/libs.py.
Have a source we are missing? Join the Discord.