Search for a command to run...
How we used Roblox Studio and Lua to build a 3D cybersecurity CTF game for students — and what we learned from bugs, refactors, and live demos.
Self-taught Software Engineer from Singapore (that eventually goes to school for it). Passionate about building new stuff that helps people save time!
No comments yet. Be the first to comment.
My stint with Apple Music has come to an unfortunate end. I’m not trying to make it sound like a huge breakup note reveal. I’m actually writing this to reflect on my time with both services. It was an
Why my RAG system failed using ChromaDB and local embeddings — and how better context and data structuring fixed retrieval accuracy.
Is Swift worth learning for React Native developers? An in-depth comparison of SwiftUI, SwiftData, DX, performance, and ecosystem maturity.
How I built a personalized graduation website with Next.js, Redis, access codes, and a server-side countdown to stop cheating.
I want to extend my special thanks to the team members that I’ve met, Russell, Bryan, Dinie and other team members who helped out too! Along with the wonderful and friendly Republic Poly lecturers that I’ve met (especially Nona, Firman and my favorite photographer – RJ).
Dinie: https://www.linkedin.com/in/muhammad-dinie-bin-baharudin-7a1680213/
Russell: https://www.linkedin.com/in/russell-low-b94b44210/
Bryan: https://www.linkedin.com/in/bryan-chan-146a1820b/
We have reached the end of the life of our game. Our game life has extended beyond just the open house in January 24'.
Recently, on May 20th, 2024, we concluded the final session for secondary school students to introduce them to the Diploma in Cybersecurity and Digital Forensics (DCDF), formerly known as the Diploma in Information Security (DISM).
This blog post recalls the timeline from when I started entering the project until the end. I am not from Republic Polytechnic, and my involvement in this project is not on record (i.e., I don’t receive CCA points for this; I’m doing it of my own will).
Back then, I was in the middle of my internship, towards the final stages where we were supposed to finalize the last features of our mobile app, get it built, shipped, packaged, and sent to the app stores. I knew I had some free time, so I said yes.
I said yes for two reasons.
First, Dinie was admirably convincing, and the idea he pitched was awesome. Second, I had the opportunity to learn about Lua, Roblox programming, the Roblox game infrastructure, and game development design practices. Game development had scared me away for the longest time, but I figured that it's just Roblox—what harm could it bring?
I joined the project at a later stage (in November), let's hear it from Dinie, Russell and Bryan who has been there since day one (and are in the same school)
Back in the first half of year two, Dinie, Bryan, and I toyed with the idea of creating a Roblox game for our final year project (FYP). While the concept was exciting, I secretly doubted that our school would ever allow us to make a Roblox game, thinking it was too far-fetched.
As time passed without much discussion between us, I joined another FYP group, believing that the Roblox game idea was just a pipe dream.
Soon after, at the end of the half of year three, and after our FYP projects were done for, Dinie invited me to work on his (separate) game for the RP Open House 2024. This time, I didn't hesitate. I gratefully accepted the offer to be part of this exciting project.
– Russell Low, Team Member
Back in April 2023 when this project began, some people doubted our ability to create an interactive 3D cybersecurity capture the flag game, claiming it had never been done before. Despite these doubts, we not only made it happen but also demonstrated our capability to bring this CTF game to life, proving them that nothing is impossible.
– Bryan Chan, Team Member
I asked Dinie, "What I could bring to the team?"
He answered, stating that he was the sole developer for the game and wanted me on board to create a really cool functionality for the game.
The functionality is the ability to 'trip' the room of another player, causing their room to lose power. This would halt any progress they were making in attacking other players. The affected players would then have to either shoot the person who tripped their power or solve a puzzle on the laptop in their hotel room.
As he explained each detail, my brain couldn't help but create a mental diagram of how this would work. I knew I would need several things: a 'lever' for the player to pull and a state system for the rooms to keep track of which rooms are 'tripped.'
But then I stopped myself. I had obviously forgotten that this was my first experience in game development and that I needed to learn.
Yes, I would say that my fundamentals in programming are strong – not just concepts such as conditionals and loops, but also design patterns. Learning Lua was not that hard. Sure, the syntax is much different than what I am used to – but isn't that what Google is for? However, the one thing that caught me was the Roblox ecosystem.
It's the idea of data storage and persistence via DataStores, server scripts that run on the server, local scripts that run on the client, properties and attributes of items, modifying the properties and attributes programmatically, and many more. These ideas are hard to grasp, so I took it slowly, asking Dinie for a little leniency as I explored and learned about Roblox.
The first thing that came to mind as I searched for a solution was the fact that I wanted to establish data persistence. That's when I asked the group chat for assistance. I drew what I wanted in Excalidraw and messaged the group chat asking for the best way to store this data.
Upon further research, I found that using a DataStore is the best method for my use case. Between starting the feature and finishing it, I hopped on calls with Dinie to clarify and gain his thoughts, because I've got to respect him as a Roblox game developer. These back-and-forth ‘meetings’ are what I call productive meetings because each one has a goal. We lay down our thoughts, mix both of our thoughts, and the cycle continues.
At this point in time, we have reached a milestone; most of the features are done, and the game is at its most playable state. We need to attend a showcase for the Operations/Business side of the school. Dinie asked if I could come along, and I agreed. I wanted to meet the lecturers who put in their time outside of work to mentor the team. But uniquely, I have to play a guise. I can’t let them know that I am a student from Singapore Polytechnic.
That day, I met the cutest lecturer, Nona. She reminds me of my grandma. The way she was enthusiastic about her ‘escape room’ and showing where she hid the ‘scroll’ was just way too cute. Her enthusiasm, chuckle, and her pause, waiting for our reactions to her genius-ness, was cute!
I went with Dinie to the showcase, and along with us were the projects from other diplomas, such as a VR simulator for a server room and a blockchain exchange website by the Diploma in Financial Technology. These projects really opened up my eyes to the people with all their eagerness to showcase their projects!
At the showcase, we were given some feedback regarding the playability of the game and how players might find it confusing – especially when we need to stick with 20-minute sessions on the day of the Open House itself. We took this feedback personally but constructively too. Dinie and I brainstormed ideas and went back to the drawing board.
We relayed the feedback and the ideas to the team, where the team gladly gave their input. The power of teamwork, am I right?
In a future iteration, Dinie added an introduction cutscene to the game, which is mind-blowing because it has cool camera animations (that even measly Nabil couldn’t do).
Have you ever encountered a scenario where you have to refactor code, but after refactoring, new bugs are introduced, creating a vicious cycle? It sure as hell happened in this project.
For instance, we had a play-test between the 4 team members over Discord, where we actually put the actual gameplay to use. A short session of 1 hour harvested so many gameplay issues and bugs that I needed to fix (because it was my fault).
Mind you, this was way past the time of me coding the project, so I had to open up the project and look at the mess of the code I had written. This is where the refactoring part comes in. I refactored most of the code to use RemoteEvents – remote events are self-explanatory; they are events that can be called from server to server and vice versa. There is also another concept called BindableEvents where it can only be called client to server and vice versa.
This cycle continued until I got it to a stable state. Other than that, we just have to lay low and wait for the day of the open house
The day has come; all the hard work our team put in has led to this moment. For three full days, we showcase our project at our course booth, promoting the DISM (now known as DCDF) booth.
At first, I found it strange. I am not a student from Republic Polytechnic. Heck, I’m not even from the same course. I am from the Diploma in Information Technology. I build apps and websites for a living – sure, I do have some experience in cybersecurity, but not much. I was nervous.
But my nervousness quickly died as I reached our booth, just in time for the briefing. Everybody had one job: to keep the booth alive. Our Roblox game was held in sessions in the lab room, but meanwhile, we took care of our mini booth dedicated to showcasing the game.
I took on a different role in the open house; I helped out in the escape room booth that Nona made.
It was fun. I learned about steganography and discovered that you can hide text in images. Having to put on a facade to the prospective students and parents of the students, saying that there is an ongoing attack in RP and that we need to find the date and time of the attack, was both tiring and really fun. I engaged with a lot of prospective students, so much so that I lost myself in the sauce; I literally told them to join RP DISM. What was I doing? Is this the purest form of betrayal? Shouldn’t I be promoting my school instead?
This goes on for all three days of the open house.
As I said, we held game sessions in the lab. Like the saying goes, 'anything that can go wrong, will go wrong' – Murphy's Law. That is exactly what happened. For three days, six (or more) sessions were filled with the game breaking. Dinie and I fixed the game in 30 minutes during our lunch break. It was intense, more intense than the time we spent building the game. This time we were constrained by time: 30 minutes to fix the game before the session started for the day. I am, however, pleasantly surprised by Dinie’s quick thinking ability. He converted what was already a broken game into an engaging one by changing the rules of the game to be based on the maximum number of points instead of attacking/defending.
These people are the friendliest I've met in RP (not that I have many friends from RP anyways). We slacked when nothing was going on and talked about the most random stuff. They were an absolute delight to be around.
After three tiresome days, we ended with a debrief led by Dinie, where we discussed the future of the game. I also extended my thanks to the team members for forming a connection, a friendship that I’ll remember despite meeting only for these three short days. The immense amount of pressure, time, and all the fun things we did in these three days!
The open house ended on January 6th, 2024. Between then and around April 2024, we didn’t touch the game at all. We led our lives until recently. We somewhat went back to the drawing board and fixed what needed to be fixed. To my surprise, the game is being used outside of the open house. Our game, which shamelessly was broken, is being used to promote the diploma. I never got that opportunity in my own school. Being able to do that in another school felt both wrong and empowering.
In a recent Discord call, we gathered all four team members: me, Dinie, Bryan, and Russell, and we discussed and talked for a bit. The main point of the call was to discuss what needed to be done in preparation for May 20th, when a group of secondary school students will come to RP for a tour.
This is too much to conclude. Six months, to be precise. But it opened my eyes. I learned a lot from kids on YouTube, teaching me Roblox Studio to the team members who are determined, to learning about soft skills from Dinie and the other team members – and lastly, to forming a friendship between me, Bryan, and Russell. This is one of the projects that I will never forget. From being a total noob in Roblox and game development to coming out confident about the ins and outs of Roblox game development.
Let's hear it from the OGs again for their conclusion of the project
I am grateful to be given this opportunity to develop an interactive 3D cybersecurity capture the flag game together with my teammates Dinie, Joharie, Nabil and Russell.
Developing a game from scratch presented numerous challenges, including defining game concepts, gameplay mechanics, target audience, development timelines, and marketing strategies.
Throughout the development process, challenges were encountered where things didn't always go as planned. Despite these obstacles, we persevered, ultimately bringing the game to life.
Our effort, dedication and hard work paid off when our game was selected to showcase at GovWare 2023, Republic Polytechnic open house and secondary school students.
This game wouldn’t be possible without the collective effort from the team. I would like to extend my heartfelt thanks to everyone for their contribution in making this game project possible.
– Bryan Chan, Team Member
Working on the game has been a wonderful experience. I had the privilege of collaborating with amazing people, including Nabil from Singapore Polytechnic, an extremely skilled programmer who significantly contributed to the game's success and was just in general an incredibly fun dude to be around.
As the person spearheading the project, I am extremely impressed by Dinie's ability to lead the team in achieving his vision for the project, think on the fly, and keep a level head in fixing issues despite the immense time constraints and pressure.
Bryan, who designed the 3D assets for the game, made the game look unbelievably stunning with his meticulous attention to detail and artistic flair. The vibrant and immersive lighting in the environments he created added a level of polish that truly brought our game to a new level.
Outside of our team, the open house also afforded me the opportunity to connect with many other people outside of my cybersecurity discipline who shared a common interest in application development. It was inspiring to see the diverse projects and innovations from students across different fields, and it gave me a broader perspective on the possibilities within tech development.
Looking back, I'm glad I seized this second chance. Being part of this Roblox Capture the Flag game has not only been fulfilling but also a testament to following one's passion and approaching new opportunities with an open mind.
– Russell Low, Team Member
