Extracting and Analyzing Roblox libroblox.so

• Reverse Engineering

Step-by-step technical process for extracting Roblox native library and locating purchase prompt functions using Ghidra.

1. Locate APK Files

Find Roblox APK files in Sober installation:

find ~/.var/app/org.vinegarhq.Sober/ -name "*.apk" -exec sh -c 'echo "=== $1 ==="; unzip -l "$1" 2>/dev/null | grep libroblox' _ {} \;

Results:

=== /home/user/.var/app/org.vinegarhq.Sober/data/sober/assets/base.apk ===
147180128  01-01-1981 01:01   lib/x86_64/libroblox.so

=== /home/user/.var/app/org.vinegarhq.Sober/data/sober/packages/com.roblox.client/split_config.x86_64.apk ===
140479136  01-01-1981 01:01   lib/x86_64/libroblox.so

2. Extract Library

unzip -j ~/.var/app/org.vinegarhq.Sober/data/sober/assets/base.apk lib/x86_64/libroblox.so -d /tmp/

# Verify extraction
ls -la /tmp/libroblox.so
# -rw-r--r-- 1 user user 147180128 libroblox.so

3. Ghidra Analysis

  1. Import /tmp/libroblox.so into new Ghidra project
  2. Run auto-analysis (default settings)
  3. Wait for completion (Make some coffee, walk the dog, go fishing... it will take a while)

4. String Search Method

Search for purchase-related strings in Ghidra:

Window → Defined Strings
Search: "InsufficientRobux"
Search: "SetPurchasePromptIsShown" 
Search: "PurchasePromptShown"

5. Function Discovery

Right-click on string → References → To find usage locations

Key function found at 02f35a00:

void FUN_02f35a00(long param_1, int param_2) {
if (param_2 != 0) {
FUN_02f359b0(param_1 + 0x188);  // show_purchase_prompt
return;
}
return;
}

6. Function Identification

Rename functions based on analysis:

  • FUN_02f35a00 → set_purchase_prompt_shown_handler
  • FUN_02f359b0 → show_purchase_prompt

Call chain discovered:

GUI Service → set_purchase_prompt_shown_handler → show_purchase_prompt → Queue System