Hey everyone!
I recently started r/PitchYourIdeas, a community for anyone who enjoys brainstorming, building, and improving ideas.
Whether you're working on:
📱 An app
🎮 A game
🤖 An AI project
🌐 A website
🚀 A startup
🛠️ An invention
💡 Or just a random concept you've been thinking about
...you're welcome to post it and get constructive feedback from other creators.
The goal is to create a positive space where ideas are discussed, refined, and encouraged—not just posted and forgotten.
Since the community is brand new, I'd really appreciate any feedback on the subreddit itself, and if it sounds like something you'd enjoy, feel free to stop by and share your first idea.
Thanks for reading! 🚀

For Showoff Saturday, I want to share a project I've been pouring a ton of deep-engineering time into: Potassium Obfuscater.
Instead of just doing basic variable renaming and string hiding, I wanted to build something that actually counters modern Abstract Syntax Tree (AST) decompilers. It relies on a polymorphic engine that changes on every single build.
How it works:
Custom Virtual Machine: Your JS decoder logic runs inside a randomized, client-side VM. The opcode tables and structure are completely shuffled each execution, meaning there is no obvious decode()function for reverse engineers to hook into.
Polymorphic Engine: Every build dynamically redesigns the underlying math expressions and VM structure. If a reverse engineer figures out the pattern for one build, that knowledge becomes instantly useless on the next deploy.
Runtime Self-Healing: The script uses cryptographic checksums to verify bytecode and VM integrity. If someone tries to tamper with the code or inject a debugger, it triggers a "Nice try buddy" state and stops execution.
Control Flow Flattening: It destroys the natural execution path by turning it into a giant switch-statement state machine packed with fake clone blocks and dead code paths.
Since this relies heavily on complex state management and VM bytecode execution in the browser, I need help testing edge cases.
Try pasting some of your complex frontend logic, heavy async/await loops, or framework snippets into it.
Did the obfuscated output execute successfully without breaking your app?
How did it impact your runtime performance?
Check it out here: https://potassiumobfuscater.netlify.app/
Give me your thoughts on the VM architecture, and I'm open to any brutal feedback on the output code!
Also i made it client side, because i can’t afford a server.

With Roblox constantly escalating its anti-cheat infrastructure, relying on basic "anti-ban" claims from executors will get you rolled. If you want to actually protect your hardware and network, you need to understand exactly how client-side fingerprinting and server-side telemetry operate.
Here is an advanced, deep-dive breakdown of how Roblox tracks your environment across every platform, how to sanitize your system, and the specific tool architectures used to mitigate detection.

🧠 1. The Core Telemetry: HWID vs. Behavioral Telemetry
Roblox uses two primary vectors to issue bans:
Client-Side Fingerprinting: Scrapes hardware serials, system files, and memory hooks to identify the physical machine.
Server-Side Telemetry (Heuristics): Analyzes packet data sent from your client to the server. If your player coordinates change too fast (teleporting) or your physics packets don't match the server's expectations (flying), the server flags or autobans your account via the BanAsync API, regardless of whether your executor bypassed the client scanner.

🪟 Windows (Platform Risk: Critical / Hyperion 64-Bit)
Windows features Roblox’s most sophisticated defense: Hyperion. It operates with deep user-mode and kernel-level observation, looking for unauthorized process attachments and memory modifications.
Advanced Tracking Vectors: Motherboard UUID via WMI, CPU-ID, Hard Drive Volume Serial Numbers (Volume IDs), MAC Addresses, and hidden tracking structures written into the Windows Registry and the Global AppData folder.
Maximum Mitigation Methods:
GPU Passthrough Virtualization: Do not use native Windows. Run a type-1 or type-2 hypervisor (like VMware Workstation or Hyper-V) with a dedicated GPU passthrough. Hyperion will only see the virtualized motherboard UUID and CPU structure, which can be wiped and re-allocated in minutes.
Manual Registry & Guid Scrubbing: If executing natively, you must change your hardware GUIDs between ban cycles. Use tools to rotate your Windows HWGUID (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware Profiles\0001), change your Volume Serial Numbers via command line (VolumeID.exe), and scramble your network adapter's MAC address.
Deep File Sanitization: Delete the tracking directory at %localappdata%\Roblox and clear your web browser's IndexedDB and tracking cookies where Roblox web sessions leave tracking tokens.
Executor Architectures: Traditional DLL injectors are heavily monitored. The community focuses on External Memory Readers (which read memory addresses without writing to them, evading basic process hooks) or specific, heavily obfuscated tools like Solara or Wave strictly during verified "post-patch stability windows."

🍏 macOS (Platform Risk: High)
While Mac doesn't have the Windows flavor of Hyperion, it utilizes Apple's robust system APIs to log device signatures and leave persistent tracking artifacts.
Advanced Tracking Vectors: Hardware Serial Numbers via IOKit, BSD network interfaces (en0), and tracking .plist configuration keys buried in hidden Library subfolders.
Maximum Mitigation Methods:
Dedicated macOS Sandboxing: Navigate to System Settings > Users & Groups and configure an entirely isolated Standard User Account solely for scripting. This keeps all Roblox cache generation completely separated from your primary user profile's Keychain and application data.
Terminal Network Spoofing: Before opening the Roblox client, force your Wi-Fi interface to cycle to a random MAC address using the Mac Terminal:
sudo ifconfig en0 ether $(openssl rand -hex 6 | sed 's/\(..\)/\1:/g; s/.$//')
Strict Property List Purging: When an alternate account is compromised, use a script or an app cleaner to completely wipe hidden configuration strings from ~/Library/Preferences/com.roblox.Roblox.plist and ~/Library/Caches/com.Roblox.RobloxCrashReporter.
Executor Architectures: The native Mac native space is highly unstable. Free injection tools like Olim/Madium or premium wrappers like Cellware are used when active, but the safest Mac users rely on running mobile executors inside high-performance ARM-optimized Android emulators like MuMu Player Pro (for Apple Silicon M-series chips).

🤖 Android (Platform Risk: Medium)
Android is highly targeted because side-loading modified .apk files bypasses standard app store barriers, but Roblox tracks mobile clients aggressively through OS-level identifiers.
Advanced Tracking Vectors: Android ID (Settings.Secure.ANDROID_ID), Google SSAID, build property fingerprints (ro.product.model), and Wi-Fi MAC addresses.
Maximum Mitigation Methods:
Virtual Machine Environments (VMOS/Parallel Space): Run Roblox inside a virtual Android container app. These apps act as a root-level sandbox, allowing you to intercept Android system queries and feed Roblox completely fake device properties without rooting your actual physical phone.
Emulator Instance Rotation: If using a PC, run Android Emulators (BlueStacks/MuMu). Use the Multi-Instance Manager to clone clean templates. If a ban hits, delete the instance completely. The emulator's built-in device manager lets you randomize the phone model, IMEI, and network operator in one click.
Storage Clearing Sequence: Never just tap uninstall. Go to Settings > Apps > Roblox > Storage, select Clear Data, and then Clear Cache to break down localized security tokens before removing the binary.
Executor Architectures: Modified Android clients like Delta and Arceus X Neo dominate this tier.

📱 iOS & iPadOS (Platform Risk: Low HWID, High Apple ID Linking)
Apple’s severe application sandboxing makes it impossible for standard apps to read hardware serials (like CPU or motherboard IDs), meaning true HWID bans are impossible on a non-jailbroken iPad/iPhone. Instead, they track you via ecosystem data.
Advanced Tracking Vectors: Apple’s IDFV (Identifier for Vendor) token, iOS Keychain credentials, and linked Apple ID tracking tokens.
Maximum Mitigation Methods:
The Global Vendor Reset: The IDFV token is assigned by iOS to all apps from a single developer. If you get flagged, you must delete every single application on your device created by Roblox Corporation. Once the device contains zero Roblox-authored apps, iOS automatically purges and regenerates a brand-new IDFV, making your iPad look like a completely different device to Roblox.
Keychain and Credential Purging: iOS apps write persistent tokens to your system Keychain that survive standard uninstalls. Go to Settings > Apple ID > iCloud > Passwords & Keychain, and ensure all saved Roblox autofill or session credentials are deleted.
Network and Background Lockdowns: Turn off Background App Refresh and revoke Local Network permissions for Roblox in your iPad settings. This blocks the client from uploading ambient crash telemetry or scanning your local router for other connected devices.
Executor Architectures: iOS execution depends on sideloading modified .ipa binaries. Mobile clients like Delta iOS or Codex are the standard.

🌐 Universal Network Isolation Rules
No matter your platform, your local router's external IP address can link your accounts.
System-Wide VPN Architecture: Run a standalone, high-tier VPN protocol (OpenVPN or WireGuard via services like ProtonVPN) directly on your host operating system. Never trust an executor’s built-in proxy layer. Activate the VPN before launching the client, and force-close the game entirely before disconnecting.
Behavioral Dampening: Do not run loud or easy detectable scripts as they will
Strict Session Separation: Keep your main account active only in a private/incognito window on an entirely separate web browser to prevent tracking cookies from bleeding into your testing sessions.
Warning: I’m not forcing you to use these executors, I’m just saying they are the best executors right now. Or maybe not, you can tell me in the comments other methods.

With Roblox constantly updating its anti-cheat systems, there is a lot of confusion about how Hardware ID (HWID) bans work, how the game tracks your device, and how to safely isolate your environment.
Here is a complete technical breakdown of how Roblox tracks you across every major platform, how to lower your detection risk, and what executors the community currently uses.

🛡️** 1. What Actuall**y is a Roblox HWID Ban?
A Hardware ID ban happens when Roblox flags the unique physical identifiers of your machine. However, how they do this depends entirely on your operating system. On desktop, they scan deep system components. On mobile, strict privacy laws prevent them from reading your physical hardware serials, so they rely on tracking tokens and account linking.
If you don't properly wipe these traces after a ban, any new alternate account you log into will be automatically chained and banned instantly.

🪟 Windows (Platform Risk: Critical)
Windows runs Roblox's most aggressive 64-bit anti-cheat, Hyperion (Byfron). It takes deep snapshots of your registry and processes.
How they track you: CPU serial numbers, motherboard UUIDs, MAC addresses, and hidden tracking tokens left in your global AppData registry.
How to lower your chances:
Never run scripts on a native Windows client if you care about your hardware. Run Roblox inside an Android Emulator (like BlueStacks or MuMu Player) instead. Hyperion cannot scan your PC through an emulator.
If you get banned, clear your cache by pressing Win + R, typing %localappdata%, and deleting the entire Roblox folder.
Community Executors: Traditional Level 7 injectors face near-instant detection cycles. The community currently relies on External Overlays/Menus (which read screen pixels rather than injecting code into memory) or tools like Solara and Wave during verified "safe" periods right after an update.

🍏 macOS (Platform Risk: High)
Mac lacks Windows Hyperion, but Roblox still leaves highly persistent tracking files hidden deep inside Apple’s library directories.
How they track you: Mac hardware serials, network interface cards, and plist configuration files.
How to lower your chances:
Go to Mac System Settings and create a completely separate Guest or Standard User Profilepurely for testing scripts. This sandboxes your main files.
Manually rotate your MAC address via the Terminal application before booting the game.
Use an uninstaller tool like AppCleaner to completely scrub hidden files in ~/Library/Caches and ~/Library/Preferences if an account gets flagged.
Community Executors: The Mac landscape is highly volatile. Free native injectors like Olim/Madium are rotated when online, while some users use paid subscription layers like Cellware. Most safe Mac users choose to bypass macOS entirely by running Android emulation.

🤖 Android (Platform Risk: Medium)
Android is the most heavily targeted platform for mobile exploitation because it allows third-party .apk side-loading easily.
How they track you: Android ID, Google Advertising IDs, cached device tokens, and behavioral server-side telemetry.
How to lower your chances:
Do not play on your physical phone. Use a PC-based Android emulator; its multi-instance manager lets you delete a banned device and generate a completely fresh phone model/IMEI in seconds.
If using a real phone, run Roblox inside a virtual environment app (like Parallel Space or VMOS) to sandbox the client.
Community Executors: Android has the most active mobile options, with Delta Mobile and Arceus X Neo being the most widely used community clients.

📱 iOS & iPadOS (Platform Risk: Low HWID, High Account Link)
Apple's strict privacy rules completely sandbox apps. Roblox physically cannot read your iPad's CPU or motherboard serial numbers, meaning traditional HWID bans do not exist on iOS.
How they track you: Apple's IDFV (Identifier for Vendor) token, Apple Keychain data, and iCloud account linking.
How to lower your chances:
The Nuclear Option: The IDFV tracking token only resets if every single app published by Roblox Corporation is deleted from your iPad. If you get flagged, delete all Roblox apps, restart your iPad, and reinstall.
Turn off "Background App Refresh" and "Local Network Search" permissions for Roblox in your iOS settings to block background telemetry logs.
Never link your testing alts to your personal Apple ID, iCloud, or Keychain.
Community Executors: iOS requires sideloading modified .ipa packages. The iOS versions of Delta and Codex are the main options. Never install these via sketchy web certificates in Safari; always desktop-sideload them safely via your own USB cable using AltStore or Sideloadly.

🌐 Universal Rules to Protect Your Main Network
No matter what device you use, you must follow these rules to prevent an IP ban or a main account termination:
Always use a standalone VPN (like ProtonVPN, or NordVPN) activated before you open Roblox to hide your true residential network.
Never cross-log. Do not log into your main account on a device or browser session that has touched an executor. Keep your main account strictly on a clean browser in an incognito window.
Make sure scripts are up to date, Server-side anti-cheat catches irregular movements (flying/teleporting) instantly, and human player reports are highly effective. Use a non loud script, or a non detectable script.
(I made another prompt, because reddit flagged my earlier one)
Paid scripts are less likely to get you banned and i know most people don’t have money but, Paid scripts are less likely to not be detected, because they are not well known.
Use a trusted HWID spoofer Now i know that there is scams, rats, adware on the internet, claiming to be a “HWID Spoofer” when in reality, its just logs ur shi. Research for some Trusted HWID spoofers out there.

Roblox has rolled out HWID bans, which is basically device bans. If you want to use executors, and scripts without worrying that much, use these instructions.
Remember, this only lowers ur chances, it doesn’t bypass it completely

For IOS players

Use a VPN on the App Store (e.g Proton VPN, NordVPN)
Of course, use a alt account
Offload and Reinstall: To completely clear the device's local cache, delete the app, restart the iPad/iPhone completely, and then reinstall your testing client.
Rotate the IDFA (Identifier for Advertisers): Go to Settings > Privacy & Security > Tracking and toggle off permission for Roblox to track you, or reset your advertising identifier.
Turn off "Sign in with Apple": Avoid linking your Roblox accounts to your Apple ID, iCloud, or Game Center, as this creates a permanent digital paper trail.
The best executors right now for IOS are Delta, and Arceus X Neo

For Mac

Create a Dedicated Mac User Account: Set up a separate "Guest" or "Standard" user profile on your Mac solely for testing scripts. This isolates the cached storage files (~/Library/Preferences and Caches) from your main macOS user profile.
Rotate MAC Addresses: Use the macOS Terminal to manually change your Wi-Fi spoof address before launching the game:
sudo ifconfig en0 ether [new-mac-address]
The most reliable way to lower your ban chance on a Mac is to avoid Mac executors entirely. Instead, download an Android Emulator optimized for Mac (such as MuMu Player Pro or BlueStacks) and run mobile executors inside it. If the emulator's hardware ID gets flagged, you do not need a complex spoofer. You can simply delete the virtual device instance inside the emulator settings and generate a fresh one with a brand-new virtual IMEI and Android ID in seconds.
Right now, the best executors are for Mac are, Olim / Madium.

For Windows

Run Inside a Virtual Machine (VM) with GPU Passthrough: Run Roblox inside a VM tool like VMware Workstation or Hyper-V. If Roblox flags the HWID, it only flags the virtual hardware, which you can delete and recreate in seconds.
Use HWID Spoofers via Command Line: If you do not use a VM, clean your system registry and use open-source MAC address changers and volume ID changers between testing sessions.
Clean the Global AppData: Roblox stores unique tracking IDs in LocalAppData\Roblox. Completely delete this folder before logging into any clean account.
If you use a native Windows executor (like Solara or other active community tools) and an alt account gets banned, Hyperion leaves unique identifier tokens hidden in your system files. If you log into a clean account while those files exist, that account will be automatically banned too.
Clear out these hidden tracking folders completely before logging into any other account:
Press Windows Key + R, type %localappdata%, and press Enter. Locate the Roblox folder and delete it completely.
Open the Run window again, type %appdata%, press Enter, and ensure no developer executor folders or script logs remain.
Use a VPN
If a connection drops, flush your system DNS via the Command Prompt (cmd) to clear cached communication strings:
ipconfig /flushdns
Avoid using loud scripts
Using loud scripts, or high detection scripts, will most likely get you device banned on a game, or from the platform entirely.
Right now, i can’t find any good executors other than Velocity / Xeno for windows.

For Android

Utilize Device Emulators (On PC): Instead of your physical phone, use PC emulators like BlueStacks or MuMu Player. You can use their built-in "Device Manager" to instantly generate a fake phone model, random IMEI number, and new Android ID.
Use Virtual Spaces / Cloners (On Phone): If playing on a real phone, run Roblox inside an app cloner or virtual environment (like Parallel Space or VMOS). This sandboxes the modified Roblox client and prevents it from reading your device's actual hardware IDs.
Clear Storage, Don't Just Uninstall: Go to Settings > Apps > Roblox > Storage and click Clear Data before removing the app to destroy cached device tokens.
And of course use a VPN
Probably the best Android executors are Delta.

For all devices.

Always use a VPN
Use a alt account
Fire up the VPN before launching your script environment. Keep it running the entire duration of the game. Once you are done, completely close Roblox and clear it from your device’s multitasking memory before turning the VPN off.
Don’t use easy detection scripts, or Loud scripts.
And Potassium, or Opiumware, is easy detection.
And Mac, and Windows are more targeted, than Android, or IOS.
Or you can you use a Hardware ID spoofer, but on IOS, or Android, you would have to root your device. And plus, your would have to research Hardware ID spoofers, cause there is a lot of scams out there.