Helios
I wasn't planning on writing another blog about Helios, but SK keeps asking me for proof, so here it is. Keep in mind that this blog is gonna be a bit different from the others.
After the last post, SK told me that he copied over the OpenSSL library from the Opiumware folder because he was "too lazy to compile it" himself.
He also pushed back against my claim of almost every dependency lining up with Opiumware exactly. He said that TinyHook is what most people would use, which he's right about, but he hasn't explained all the other libraries and dependencies matching up.
Since none of my evidence satisfied SK, I went back to look for more. The first thing I looked for was the WebSocket implementation. I thought this would be a quick and cheap thing to check, and it was, and it paid off.
Helios and Opiumware both use IXWebSocket, which by itself is standard, but the connection objects they built around it also match. Both of them are 192 bytes, with the connection iD, lua thread, status, error, state flags and more things that are also in the exact same order.
Both Opiumware and Helios use those fields the same way too. For example, both of them put the connection status at offset 0x90, the error at 0x98 and the open/connected flags at 0xB0 and 0xB1. When the socket opens, both Opiumware and Helios change the status from 0 to 1 and set the 2 flags together. Both of them also store their message and close events under the exact same names.
In the last post, I said that SK did change a lot of stuff, like the error strings, but he missed this one:
Failed to connect to WebSocket (connection closed or timed out)I don't know why he didn't replace that one, maybe he thought it was some default error that came with IXWebSocket (its not btw) but he just missed that one I guess. Another thing that matches up is the closing, both of them wait up to 250 ms for any leftover messages to be sent and they both check every 1 ms before closing.
Helios did make some changes, for example instead of waiting up to 1 second after requesting close like Opiumware, Helios waits up to 5. I don't know why, maybe it was to throw people off but it didn't work since the implementation is basically the same.
HTTP stuff also matches up, for example both return nothing if there's economy.roblox.com or auth.roblox.com anywhere in the URL. They also both look for a colon followed by a space when parsing response headers (Alterra just trims the space) and again, they share the exact same errors "Must provide a URL for request" and "Invalid HTTP method".
The deeper I look the more errors overlap. I hadn't noticed these in the last post since I just took a quick glance, but now I found more errors. In writefile both Opiumware and Helios return these exact same errors:
blocked dangerous file extension: %s
failed to create directory: %s
failed to open file for writingHelios's filesystem stuff is different, the overlap is smaller here and a lot of things have been changed in this part.
I'm honestly tired of all this, every time I dig up something SK just finds another excuse, so I'm done. I'm hoping this is the last blog I'll ever have to write about this. I don't even get paid for writing blogs, I only get paid for working on the executor itself.
Just as a reminder, this all started because SK claimed that Alterra was built on top of the Opiumware source code. He still has NOT provided any evidence for that. He's doing the exact same thing he accused us of doing, which is hypocritical. I said this in the last post too, but he kept giving me different reasons, like "I only used the build for detections", which doesn't explain the code matching up here. or sometimes he says he only used the src as a base, which is what he accused us of doing, so I don't understand why it's okay if he does it.
I've also heard a bunch of contradictory stories. For example, Waddo came into Alterra and said that SK didn't copy from Opiumware because "he was asking me everything". Then I mentioned that to SK and said he got help from Waddo, and SK claimed that he didn't. So one of them is lying.
There was also another person defending SK who said that he built on top of the Opiumware src but "the strings are his". Those are his exact words. I don't understand why replacing a bunch of error strings is something to be praised about.
SK also claimed that I got help with detections from Falrux. Falrux has me blocked and we haven't been friends for months, so I don't know where he got that from.
While talking to SK he randomly asked me "whats a qword". I ignored it because it wasn't relevant to what we were talking about, and he said "u couldnt even answer what a qword is". He did this a second time too. It seems like his little ace up his sleeve or something, because he keeps bringing it up when he has no answer to what I'm saying. It seems like he watched a YouTube tutorial, memorized qword and keeps repeating it. This would be like me asking other programmers what a boolean is when they ask me something I don't understand.
One last argument I've heard is "if SK copied Opiumware he would have released it in a week". I don't see how that helps. SK used to "rewrite" Helios every other week. I wasn't in the server for all of this, but the last time I was there I read through the announcements and most of them were just him saying he was rewriting Helios. I also had another person confirm this. There was another rewrite happening around a week before Helios released, so that matches up.
You of course don't have to believe me in all of this, you can verify it all yourself. Here's a download link to the Opiumware and Helios dylibs I compared. During these comparisons, I also took a quick glance at other executors and the default behaviour of the libraries and dependencies used to make sure I didn't include anything like that. Click here to download the dylibs.