| 1 | # rblxtool |
| 2 | |
| 3 | A performance-first Roblox API toolkit: a native Rust core that does all of the |
| 4 | networking, and a WinUI 3 desktop shell that never touches the network itself. |
| 5 | |
| 6 | ``` |
| 7 | crates/rblx-core engine: http, auth, api surface, ops, encrypted account vault |
| 8 | crates/rblx-cli rblxtool / rblxtool.exe - full featured command line client |
| 9 | crates/rblx-ffi rblx_core.dll / librblx_core.so - C ABI for the desktop shell |
| 10 | ui/RblxTool WinUI 3 (Windows App SDK 1.6, Native AOT) desktop application |
| 11 | ``` |
| 12 | |
| 13 | ## Why it is fast |
| 14 | |
| 15 | - **Pooled HTTP/2 over rustls.** One `hyper` client, ALPN negotiated h2, adaptive |
| 16 | flow control windows, keep-alive pings, connection reuse across every Roblox |
| 17 | host. No per-request TLS handshakes. |
| 18 | - **Header driven rate control.** Every response is inspected for |
| 19 | `x-ratelimit-limit` / `x-ratelimit-remaining`; the per-host token bucket |
| 20 | retunes itself to the quota Roblox actually granted this IP and this session. |
| 21 | That is the difference between 2 of 40 requests succeeding and 40 of 40. |
| 22 | - **SIMD JSON decoding.** `simd-json` with a `serde_json` fallback: ~690 MB/s and |
| 23 | ~25 us per 60 item catalog page on a single core. |
| 24 | - **Pipelined ops.** The sweep runs catalog paging, 120 item detail batching and |
| 25 | purchasing as three independently bounded concurrent stages joined by channels, |
| 26 | so scanning never waits on buying. |
| 27 | - **mimalloc**, fat LTO, one codegen unit, panic abort. |
| 28 | |
| 29 | ## Accounts |
| 30 | |
| 31 | Three ways in, in order of capability: |
| 32 | |
| 33 | 1. **Session cookie** - paste `.ROBLOSECURITY`. Full purchasing surface, no |
| 34 | captcha, survives restarts. This is the recommended path. |
| 35 | 2. **Username, password, 2FA** - `auth.roblox.com/v2/login`, then the two step |
| 36 | challenge and `v3/.../two-step-verification/login`. Roblox frequently answers |
| 37 | with a FunCaptcha challenge, which the tool surfaces (challenge id, Arkose |
| 38 | public key, data blob) instead of pretending it succeeded. |
| 39 | 3. **OAuth 2.0 authorize** with PKCE - Open Cloud. Works, but the granted scopes |
| 40 | are read only, so sweeps, snipes and group claims stay disabled on these |
| 41 | accounts. Included because it was asked for, not because it is useful here. |
| 42 | |
| 43 | Accounts are stored in an AES-256-GCM vault, key derived with Argon2id. Supply a |
| 44 | passphrase or let it use a `0600` local key file. |
| 45 | |
| 46 | ## Command line |
| 47 | |
| 48 | ``` |
| 49 | rblxtool account add-cookie [cookie] [--label name] |
| 50 | rblxtool account login <user> [--password p] [--code c] |
| 51 | rblxtool account list | use <id> | remove <id> | verify |
| 52 | |
| 53 | rblxtool sweep [--dry-run] [--no-buy] [--max-price 0] [--categories Accessories:Hat] |
| 54 | rblxtool snipe --targets 1234,5678:750 [--under-rap 0.7] [--watch-releases] |
| 55 | rblxtool groups hunt [--start 1] [--end 200000] [--claim] [--min-members 1] |
| 56 | |
| 57 | rblxtool item <assetId> | search <keyword> | user <name> | group <id> | me |
| 58 | rblxtool bench [--rounds 12] [--parse-rounds 20000] |
| 59 | ``` |
| 60 | |
| 61 | Every command takes `--json` for machine readable output. |
| 62 | |
| 63 | ## Building |
| 64 | |
| 65 | Core, CLI and the shared library, on Linux or Windows: |
| 66 | |
| 67 | ``` |
| 68 | cargo build --release |
| 69 | cargo build --release --target x86_64-pc-windows-gnu |
| 70 | ``` |
| 71 | |
| 72 | The desktop shell needs Windows with the .NET 8 SDK and Windows App SDK 1.6: |
| 73 | |
| 74 | ``` |
| 75 | pwsh ui/build.ps1 |
| 76 | ``` |
| 77 | |
| 78 | `build.ps1` compiles the Rust core, drops `rblx_core.dll` next to the app and |
| 79 | publishes a self contained Native AOT build. |
| 80 | |
| 81 | ## Rate limits you will actually hit |
| 82 | |
| 83 | Measured from a datacenter IP, unauthenticated: |
| 84 | |
| 85 | | endpoint | quota | |
| 86 | | --- | --- | |
| 87 | | `catalog.roblox.com/v1/search/items` | 1 request / 60 s | |
| 88 | | `groups.roblox.com/v2/groups` (100 ids per call) | 1 request / s | |
| 89 | | `users.roblox.com/v1/users/{id}` | 30 requests / 60 s | |
| 90 | |
| 91 | Signed in, from a residential IP, these open up substantially. The limiter reads |
| 92 | the headers and adapts either way; the sweep is close to useless anonymously and |
| 93 | works properly on a real session. |
| 94 | |
| 95 | ## Notes |
| 96 | |
| 97 | Automating purchases and group claims against your own account is at your own |
| 98 | risk: Roblox may rate limit or action accounts that behave like bots. The tool |
| 99 | defaults to conservative concurrency and honours every throttle it is told about. |