Anti-Dupe Exploit Patch

Resources Community Resources
#1

I was recently informed about an exploit and I don’t really understand how it works, only that it involves a Roblox Security vulnerability and that I seen it in action in my game.

Since I don’t know understand it works, it’s best to let the man explain it himself (blurred out bits of the code so exploiters can’t use the full script):

image
image1572×653 104 KB

If you’re an expert in this, feel free to sum up how it works in the comments and I’ll mark it as a solution. In the meantime, I figured out how to put a “band-aid” on it.

14 Likes
#2

Man, another exploit released to the forum

There is a chance that synapse x person can see this and bypass it

3 Likes
#3

Good point. I’ll edit it to blur out bits of the code.

2 Likes
#4

Stuff inside the Player object can be reparented while the Character is nil so this is no exploit but rather some oversight by Roblox or intentional.

#5

Altough if the crashing server part IS true then that would be an exploit which you should probably make a bug report about.

#6

Update on my first post:
I think it is only possible to reparent them to nil.
Altough about the setting the Parents of tools part, I don’t think that’s true.
The only time reparenting a tool replicates is when it is the Players backpack, workspace or Character.
If this is true then why would it only be possible to reparent tools? I just don’t think this is real to be honest.

#7

It’s real, and works in about any game that doesn’t have some type of patch like mine.

1 Like
#8

What would the point of doing that even be? You can’t make your own tools and neither should you be able to move tools to StarterCharacter.

#9

What patch? I asked my friend to test it on your game, it worked.

#10

They take their own tools and are somehow able to parent them to StarterPack and/or StarterCharacterScripts.

1 Like
#11

Can you provide more information on this? Last time I checked, it worked.

#12

Add <>, what’s your <>? I’ll show it working

1 Like
#13

He was able to show it worked locally, but it would not replicate to the server. This is still a viable solution.

I created a test/control place to ensure it was none of my personal scripts allowing them to do it:

It is uncopylocked.

1 Like
#14

I’m gonna be completely fair with you, it replicated to the server, how do you think he was able to sell 9000 caiks and get noob lord in your game?

#15

It’s very much not that, your Character is still there when you parent it

1 Like
#16

I see, thank you. He showed me that he was using his own StarterGear to dupe tools. I updated the original post with a link to the model with a working anti-dupe.

1 Like
#18

This really isn’t that bad since this doesn’t even replicate to the server. Also that change only shows on the Client meaning that you can’t detect it from a Server script. Also person in the Screenshot made it sound like it replicates, which it doesn’t.

#19

why you hiding raknet methods lol. ez network exploitation that can replicate (some stuff can) to the server with some stuff until roblox decides to switch from raknet

#20

It does replicate to the server, though. That’s the issue.

1 Like
#21

Anything with-in the player’s character replicates, this means exploiters can give themselves objects that shouldn’t even exist in-game.

1 Like