Source Roblox Potassium Auth Bypass — JWT Crack Method

[byte_corvus]

Digging into the auth for Potassium lately? It turns out the protection relies on a local JWT verification that's easily spoofed if you have the signing key. This source allows you to forge a valid user.bin file, effectively bypassing the license check by simulating a legitimate server-side response.

Technical Breakdown
The method uses HMAC-SHA256 (HS256) to sign a JSON Web Token. The software expects a specific structure in the user.bin file containing the token and an expiration timestamp. By using the hardcoded key discovered in the binary, we can generate our own valid licenses.

Core Attributes:

1. Algorithm: HS256.
2. Dependencies: OpenSSL (libcrypto) and nlohmann/json.
3. Encoding: Custom Base64URL implementation to match JWT standards (replacing +/ with -_ and stripping padding).
4. Payload: Includes custom ID and long-term expiration (iat/exp).

#include <fstream>
#include <string>
#include <openssl/hmac.h>
#include <openssl/evp.h>
#include <nlohmann/json.hpp>

using nlohmann::json;

std::string b64u(const unsigned char* d, size_t n) {
    std::string s;
    s.resize(4 * ((n + 2) / 3));
    int l = EVP_EncodeBlock((unsigned char*)&s[0], d, n);
    s.resize(l);
    for (char& c : s) {
        if (c == '+') c = '-';
        else if (c == '/') c = '_';
    }
    while (!s.empty() && s.back() == '=') s.pop_back();
    return s;
}

std::string hmac(const std::string& k, const std::string& m) {
    unsigned char o[EVP_MAX_MD_SIZE];
    unsigned int l = 0;
    HMAC(EVP_sha256(), k.data(), k.size(), (unsigned char*)m.data(), m.size(), o, &l);
    return b64u(o, l);
}

int main() {
    json h = {{"alg", "HS256"}, {"typ", "JWT"}};
    json p = {{"id", "cracked by ZenithPulse"}, {"exp", "4071619885"}, {"iat", "1736064000"}};
    
    std::string k = "sorakasugano1337";
    std::string hb = b64u((unsigned char*)h.dump().data(), h.dump().size());
    std::string pb = b64u((unsigned char*)p.dump().data(), p.dump().size());
    std::string m = hb + "." + pb;
    std::string sg = hmac(k, m);
    std::string t = m + "." + sg;
    
    json o = {{"jwt", t}, {"expiration", "2099-01-09T05:31:25.0000000Z"}};
    std::ofstream("user.bin", std::ios::binary) << o.dump(2);
}

Spoiler: Implementation Notes

The secret key used in this snippet is sorakasugano1337. If the developers rotate the secret in a newer build, you'll need to re-dump the string from the binary to maintain the crack. The resulting user.bin should be placed in the same directory as the executor to satisfy the local auth check.

Has anyone found any other hardcoded keys in the latest builds, or are they still using the same secret?