Hyperion

Hyperion (also referred to as the Byfron anti-cheat by the community) is anti-tamper software built into Roblox Player as part of countering exploiting on Roblox. Hyperion is developed by Byfron Technologies, a subsidiary of Roblox Corporation since October 2022. Hyperion was released as a part of the 64-bit client version production release on May 3, 2023. On September 15, 2023, A/B testing began on the Microsoft Store (UWP) client with some users receiving Hyperion and others not.
As an anti-cheat solution, Hyperion detects software interacting with the client and crashes the client if it identifies bad software, also known as "badware". Although the technology aims to counter cheating, Roblox ended compatibility support for 32-bit users, as well as blocked the use of Wine, essentially disallowing Linux users from playing Roblox, although it was later supported again. There were also crashes reported by users as bugs with Hyperion being the cause around the time of release. 
Because Hyperion only works with the 64-bit client, methods of avoiding Hyperion were also found at the time, such as using a 32-bit client or the client from the Microsoft Store, or using a modified mobile client which is available on both iOS and Android. Since then, most of these issues were being mitigated by both Roblox pushing Hyperion to more platforms and developers taking action by banning or isolating users with 32-bit clients.
== History ==
According to Pitchbook, Byfron Technologies, the company that develops Hyperion, was founded sometime during 2021. In July 2022, Hyperion was added to Fortnite as an anti-cheat system, along with EasyAntiCheat and Battle Eye as the other two anti-cheats, and was also added to Apex Legends. On October 11, 2022, Roblox announced that they have acquired Byfron Technologies and introduced anti-cheat measures.
== Technology ==
Hyperion is anti-tamper software that detects software interacting with the client. Hyperion does not scan the system and instead looks for software known as "badware". Hyperion crashes the client if it detects badware directly interacting with it. , a Roblox staff member, listed cheat software, malicious software or badly written drivers as a form of badware, as well as "any software, ranging from seemingly harmless ones like Process Monitor to malicious software or even virus scanners". Bitdancer also articulated that bad drivers are "known to have bugs and are being used as a launchpad for exploits and other unwanted software". Hyperion determines software to be potentially badware if a process is not digitally signed. Hyperion allows write access for digitally signed processes; however, writing to the client will most likely trigger Hyperion and cause it to crash the client. Hyperion also crashes the client if it finds that the client is being executed on a virtual machine.
Hyperion's telemetry is anonymized; core dumps from crashes are anonymously sent.
== Beta ==
On April 27, 2023, the 64-bit version beta client was released with Hyperion built in, and was rolled out to users with the "zwinplayer64" channel, different from 32-bit clients that were in production release at the time ("LIVE" channel). As part of testing, the channel is specified for each user. Users can check if they have the 64-bit client by viewing their channel in the About page of the client, below the options. Alternatively, users can visit https://clientsettings.roblox.com/v2/user-channel?binaryType=WindowsPlayer, or use Task Manager to determine if their client is 64-bit.
== Release ==
On May 3, 2023, the 64-bit client version was released on the "LIVE" channel, affecting all users on Roblox. Because Hyperion is only built into the 64-bit client, the release would also mean the end of compatibility support for 32-bit users. Roblox also blocked the use of Wine, essentially disallowing Linux users from playing Roblox. Roblox announced that there are plans to support Wine again.
At the time of release, 32-bit clients or the "ZIntegration" channel would be used to avoid Hyperion. Roblox would eventually prevent those clients from playing on Roblox servers. Other methods of avoiding Hyperion were found such as using the client from the Microsoft Store, or using a modified mobile client (including iOS and Android) which may include a script injector.
On August 11, 2023, a staff member published a DevForum post with an attached screenshot of Roblox running on Manjaro as a shoutout to the Grapejuice community.https://devforum.roblox.com/t/why-did-roblox-stop-supporting-linux-users/2444335/61 Later, "zintegration" and "zcanary" channels were supporting Wine as part of testing, allowing Linux users to play Roblox again,https://www.gamingonlinux.com/2023/08/roblox-support-is-coming-back-to-wine-on-linux/ and this would soon be moved to the production release.https://www.gamingonlinux.com/2023/08/roblox-support-returns-to-linux-with-wine/
On September 8, 2023, it was announced at RDC 2023 that Hyperion was successful in stopping most exploiters,https://www.youtube.com/watch?v=emoTyQBBHdk&t=5221 and that Hyperion will be launched on the Microsoft Store client as well as exploit detections on Android.https://www.youtube.com/watch?v=emoTyQBBHdk&t=5305
On September 15, 2023, A/B testing began on the Microsoft Store (UWP) client with some users receiving the 64-bit update with Hyperion and others not.https://www.reddit.com/r/robloxhackers/comments/16jni4e/hyperion_is_now_on_uwp_god_save_us_all/https://twitter.com/Bloxy_News/status/1702780882824679814 However, many users simply did not update and continued to use the older version. In response, some developers isolated or even banned users still on 32-bit clients by using a script that determines their bit architecture.https://devforum.roblox.com/t/a-way-to-block-hyperion-bypass/2592103 There are rumors that the client is a honeypot, with Roblox detecting exploiters, and eventually HWID banning them.
On March 1, 2024, WINE support was removed. The exact reason for this sudden decision is unclear, but Bitdancer stated that WINE support had been abused by malicious actors to cheat & reverse engineer Hyperion.
== Bugs ==
Around the time of release, there are bugs often leading to crashes on the 64-bit client that were attributed to Hyperion and reported on the Developer Forum. Roblox staff recommended users encountering crashes related to Hyperion to post crash dumps for analyzing.
=== Crashes ===
Users reported that the client crashes after around 3 seconds to several minutes of launching.https://devforum.roblox.com/t/roblox-games-load-for-about-3-seconds-then-instantly-crash/2309871https://devforum.roblox.com/t/64-bit-client-crashing-after-a-couple-minutes-of-play-every-time/2315314https://devforum.roblox.com/t/roblox-windows-crashes/2321961 The staff responded and linked crashes to "badware" detected by Hyperion, and recommended performing a clean boot. At the time of release, similar crashes were widespread, with users complaining being unable to play Roblox.https://www.reddit.com/r/roblox/comments/136byt8/cant_even_join_a_game/
A user also reported that Wireshark and NetLimiter, both of which are monitoring software, are causing Hyperion to crash the client. A staff member linked the software to a form of badware where the software opens a read/write handle to the client and responded with a question: "Why would seemingly harmless and innocent software need to require read/write access to another process, and what does it do once access is granted?".
A user posted a workaround which is opening Disk Cleanup and selecting all files (except for system files) for deletion.
Users have also reported a more long term, seemingly unfixable type of crash associated with Hyperion. After a period of between one to twenty minutes in-game, the client will always hard crash for the user. This issue persists even when run in a safe boot environment, beyond any program or OS reinstall, leading some users to suggest an increasingly critical error with Hyperion's database.
=== RAM usage ===
Users reported that the 64-bit client is using more RAM than the 32-bit client. A staff member stated that this is expected because of innate differences, such as "64-bit pointers being twice as large as 32-bit ones, struct alignment, etc...", as well as additional memory overhead due to Hyperion. 
== Impact on exploiting ==
Majority of previously exploiting teams have discontinued their products, with one even joining Roblox to fight cheaters on their side. With the increased difficulty of process injection & reverse engineering, as well as the downfall of a major part of the leading cheat developers, the anti-tamper lasted about 221 days (April 27, 2023 - December 4, 2023) with no public, easily accessible & affordable bypasses being released, about 293 days (April 27, 2023 - February 14, 2024) without a reliable & undetected bypass being released.
There are currently no known public methods to bypass Hyperion which would allow for the easy creation of a cheat, with the only option being purchasing a product from cheat developers. Only a single exploit stands undetected, but is likely unaffordable for majority of the exploiting community. All but one attempts to launch a full-scale internal script executor to the public have gotten detected & their users banned.
So far, Hyperion had only been rolled out on Windows, with plans to roll out on Android. 
== Reference ==
Category:Roblox software