A Guide to Making Proper Anti-Exploits

[qwertyexpert]

@iGottic

don’t use os.clock() for finding time deltas

That’s exactly what os.clock is for. It’s used for high-precision benchmarking. It’s not useful for finding the time but it is more useful and precise than tick() for finding the difference between two times. So this is completely backwards advice.

[Reapimus]

the noclip check was an example, if you’re getting false positives you should increase the threshold.

[noahrepublic (Noah)]

It appears only the inside of object is printing, how much between casting should I wait before creating one? What else should I be doing

[Reapimus]

the cast should be running each physics frame for best results.

[noahrepublic (Noah)]

Is there a way to possibly help with performance, from my past experiences ray casting like this is commonly causes lots of lag.

[Reapimus]

In my experience, there shouldn’t be any performance issues as a result of this as raycasts are rather performant, I have little doubt that you would ever have near enough raycasts to cause even a small amount of perfomance issues because I am certain Roblox is already doing the best they can to optimize raycasting behind the scenes.

[ZRX_O (Jamie)]

I having problems with Anti Coregui place ServerScriptService, but not running it yet. Note: Discord service not logged in.

[DevHue (CranK)]

You’ve written a really intriguing piece, and I appreciate how in-depth you delved into each topic.

A truly fantastic resource for those such as myself who are searching for someone to assist me in developing an anti-exploit for the aim of widespread redistribution.

[bubshayz (bub)]

@Reapimus

The first step in checking for this exploit would be to check if they are on the ground, which would also need to account for the possibility that the player’s character might be of a none-standard height (such as is the case with R15 characters), which would be done by using the size of the root part on the Y axis and the humanoid’s HipHeight if it is R15, but if it isn’t R15, we know it has a static height and can return that instead, which would look like so:

local function getRayHeight(character)
    local R15 = character.Humanoid.RigType == Enum.HumanoidRigType.R15
    return R15 and character.Humanoid.HipHeight + character.Humanoid.RootPart.Size.Y/2 + 1 or 3.5
end

Now that we know what the height of the player’s character is, we can use it to cast a ray toward the ground to check if the player is on it or not, which would look like so:

local cast = workspace:Raycast(character.PrimaryPart.Position, -getRayHeight(character), playerRaycastParams)

local isOnGround = cast and cast.Instance.CanCollide

Since we now know that the player is on the ground or isn’t on the ground, we can save that they are either grounded, or if they aren’t on the ground, we save that they are not on the ground, with a timestamp referring to the last time they were on the ground.

This was previously done to reliably check if a player was on ground or not since previously Humanoid.FloorMaterial was calculated on the client and then replicated to the server, which was of course bound to be exploited. However, changes have been made to it’s replication and now it’s calculated separately on the server and client, so you can use just Humanoid.FloorMaterial.

[Gojinhan (HashCollision)]

I would definitely not recommend using this check:

local distance = ((playerState.LastPosition - character.PrimaryPart.Position) * Vector3.new(0, 1, 0)).Magnitude

if distance >= 0 and os.clock() - playerState.lastGrounded > 5 then
    print("The player triggered the anti-fly check!")
end

For detecting fly hacking, you could basically call that a heuristic. it’s plenty common for someone to be off the ground for more than 5 seconds and still not be fly hacking. In theory, you could change this up to a different set of rules that should work better and at least not detect genuine players.

I.e; while not grounded, player Y must always be on a decrease. Therefore, if it is equal or increasing and they have been grounded for a certain amount of time, we’ll do x.

local lastY = pos.Y

--// every so often
if pos.Y >= lastY and os.clock() - playerState.lastGrounded > 2 then
    print("The player triggered the anti-fly check!", "uwu")
end

lastY = pos.Y
--//

[Gojinhan (HashCollision)]

Note that as of that change, listening for the .FloorMaterial to change via event or indexing it every frame is a similar expense to raycasting every frame. But maybe it’s more convenient idk

[bubshayz (bub)]

Yup and do note that ray casting not that long distances is actually really cheap and Roblox has improved the expense of ray casting over much longer distances.

---

To OP and also others on why Humanoid.FloorMaterial should be used to determine the floor material or if the player is grounded or not:

Casting just 1 ray to determine if the player is on ground or not is not reliable for e.g what if the player is standing on an edge? – You would end up eventually falsely rubber-banding players in some edge cases which would disrupt user experience.

According to an engineer, a maximum of 9 rays will be casted to calculate Humanoid.FloorMaterial reliably (though there is an edge case of players standing on 2 different materials at the same time but that doesn’t matter since you’re going to be using the property to determine if the player is grounded), hence why this property should be used to reliably determine if a player is grounded or not.

A rule of is to always use what Roblox has given to you, and not reinvent the wheel.

[Reapimus]

That’s good to know, I have updated the guide accordingly to make use of this know!

@Gojinhan

I would definitely not recommend using this check:

local distance = ((playerState.LastPosition - character.PrimaryPart.Position) * Vector3.new(0, 1, 0)).Magnitude

if distance >= 0 and os.clock() - playerState.lastGrounded > 5 then
    print("The player triggered the anti-fly check!")
end

For detecting fly hacking, you could basically call that a heuristic. it’s plenty common for someone to be off the ground for more than 5 seconds and still not be fly hacking. In theory, you could change this up to a different set of rules that should work better and at least not detect genuine players.

You’re right in that this isn’t entirely accurate on its own, I’d personally recommend implementing a system alongside it to detect whether or not someone is falling or jumping alongside such a check.

[Rinpix]

@Reapimus

or the TimePosition and Playing properties of an existing sound object on the server.

Actually I don’t think this is possible, considering the RespectFilteringEnabled property of SoundService is enabled by default.

[Reapimus]

It may be enabled by default, but that still doesn’t reject the fact that the replication behaviour is there that the client can potentially control these properties, and that may be unexpected for a developer if they are unaware of this.

[Rinpix]

I get what you’re saying, but I don’t think any developer in the right mind would alter properties if they have no idea what they do. In my opinion, you shouldn’t be able to access RespectFilteringEnabled, in the exact same way that you can’t access the FilteringEnabled property of Workspace anymore.

[Reapimus]

The entire reason it exists is for backwards compatibility, which is understandable since what it enables isn’t even remotely as harmful as what FilteringEnabled off allowed. Some people might also have RespectFilteringEnabled disabled without even knowing it for some reason (perhaps their place file is just that old, or another user disabled it)

[Sandessat (Sandy)]

Excuse my ignorance, but what is playerState? I couldn’t find any resources on Google…

[Reapimus]

playerState isn’t a Roblox variable or anything, it’s put in the examples to represent a table you have that is storing state information in your code about a specific player, information that would persist across checks

EDIT: I have made an edit to the original post clarifying this variable so that nobody else has the same confusion

[Sinkl0z (sinkZ)]

this is an old thread : Powerful Anti-Cheat detection for any exploit script that modifies the behavior of your functions - Development Discussion - DevForum | Roblox

The one that you replied to, It eventually got patched by all known exploits. Just want to tell you that the thread was about checking for any overflows on the game.Instance, It wasn’t bypassable since it detected exploits on run-time injections. And I also read that you said it could cause false positives. No. It couldn’t. Stacks doesn’t randomly or constantly increase which means checking stacks wouldn’t cause any false flags, Atleast from that detection. No hate towards you, Just saying!

Really good thread though!