This is wrong, you’re just not writing good code. If he is making serverside scripts, you either have a backdoor or an unprotected remote. Go fix ur code and stop spreading misinfo.
1 Like
Externals pretty much insert their code into the roblox’s coreScripts but you only get 3-4 level exec by that.
1 Like
there is basically no way for an exploiter 5o get into the server, if they have, it’s through remotes or a back door. If you validate everything on the server, they can’t do anything
1 Like
im a ex-developer of exploits, and exploits parent their guis to coregui and their scripts are non exisistent, they parent it to nil & the script source is heavily obfuscated often loaded using loadstring:httpget(“example url”) but the injection happens in the lua vm so its impossible to detect any injections unless the executer messes up by creating a visible service or script, or a notification via playergui or some other vunerability like crashes or lag can be used to detect injection but however infinite yield & dex have been detected multiple times.
they dont inject code into the corescripts, they just hook into the memory and create a handle, they use readmemory() and writememory() functions as their main source, they run in c#/c++
for real lol no exploits inject into dev allowed places
this is the most accurate explanation of a exploit i’ve seen in this whole fourm, i can confirm this is exactly how it works but no anticheat is stopping the best exploiters
4 Likes
Some of them, for example xeno/solara and the now obsolete incognito, do. Refer to the comment close to the top explaining how external executors work
Also externals don’t explicitly have to be implemented in C#/C++, you can make them in any language that allows you to open handles and read/write memory
1 Like
external executors find a vuln corescript (PlayerListManager) and then replace the bytecode and set the module state to not ran so when escape is pressed their bytecode is run instead so yes they infact do inject into corescripts
what ur on about is internal executors (level 8’s) where they inject into the game instead and use luavm::load (or luau_load)
atleast thats what i think ur on about
1 Like
lol what you’re saying is just simply not true. clearly you haven’t done any actual scripting
i oversimplified a few things because more accuracy would have atleast tripled the length of my post, but i would like to hear whats “simply not true” in what i said especially from you who is literally asking if infinite jumping can be detected. did you start learning a little luau and now you think youre on top of everyone with that attitude?
I’ve been scripting in LUAU for nearly a decade and I guarantee that with your experience you aren’t really worth my time to argue with, however I’ll be kind enough to feed into this. First of all, you don’t understand the difference between your “3 major types of exploits:”. First of all an External executor is an executor that is it’s own application rather than appearing inside of the Roblox window by modifying Roblox’s contents (so literally 99.99% of executors are external executors; usually the internal ones are mobile executors). Second of all, a client-side executor is technically every executor, the only difference is in the past, paid executors like Synapse had functions that were able to get in through server side. Some scripts used to do that as well by taking advantage of vulnerabilities that gave them access to control things from the server yet still was being done from the client, but of course now that Roblox is secure, this is really only possible when someone’s game is trusting the Client scripts and furthermore making their game vulnerable. Also, I don’t know what executors you did research on, but I don’t think you understand the impacts of RAM from exploits. Consistent & unusual RAM spikes from executors make it very obvious to detect exploiting and only poorly made executors would do this. The best way to make your game secure is make everything handled by the server & not let client-side handle the game, thats just normal game security. If you want to prevent things like walkspeed & jumppower hacks, then you need to create server-sided restrictions. This is all basic knowledge, but unfortunately many game developers don’t implement this hence why exploiting is always a big topic on the DevForum.
Now, based on what you said..
This is just embarrassing. First of all, you’re combining several exploiting tactics into one and confusing them. Yes, in Roblox Studio they may hide stuff as weld scripts in order to give themselves access to server-sided executors in games, but that’s because you’re literally in Roblox studio with a script giving access people to it. That’s common sense. If your game is vulnerable to backdoors, then that’s on you for not looking at the scripts being inserted into your game when you’re using the Toolbox tab in Roblox studio. I didn’t even have to go into advanced game security, as your post completely shows you don’t have any knowledge or experience on even basic game security.
You are literally wrong lol, @kwkxbxkdkdjjd is correct
everythin you said is bs
this frine me, you took the “gpt explain it like im a 10 year old” simplification from his most realistic statement
also wrong, tf you on about son
or a poorly coded unperformant game, memory spikes are not OBVIOUS to an exploit injection, never were
You can keep telling yourself that, not my problem.
cool fight
Though I have no idea what is happening
your response confuses me. while you are partly correct with a few things, some are so inherently wrong that it seems like you have no clue what you are talking about and used AI to try to argue with me. lets do this organized
Exploit does NOT equal Executor.
Never did I talk about an “External Executor”. Infact something like an external executor doesn’t even exist. When we talk about external and internal we talk about the way the exploit implements its ability to enable the user to exploit. To achieve arbitrary luau code execution you need some sort of internal stage in the target process. This is why all internal executors have a dll that injects into the roblox process while externals do not have such thing. this is also why externals are way harder to detect than internal execs.
this is absolutely wrong. a serversided executor that lies within a game or is achieved through extreme remote event abuse is not client sided. an executor is serversided as soon as it can run arbitrary luau code on the servers side.
what is this even supposed to mean? now we are getting into the era where Filtering Enabled (FE) was not fully enforced in every game but just an optional setting for games.
in this sentence alone are two mistakes.
- it wasn’t synapse-specific
it was game-specific. either the game had Filtering Enabled disabled or enabled. - it wasn’t serversided
the absence of FE lead to the fact that things that happened on the client often replicated over to the server. for example if a bad acting client unanchored a wall in the game before FE, this replicated to the server and then to all the remaining clients, unanchoring the wall for everyone in the game. this is what execs like synapse or rc7 could do when there was no FE. as we know, it doesnt work like that anymore but if you ever wondered why players can still fly and speedhack to this day, now you know why.
lol. i dont think i need to say anything about this…
agreed. partly. the client has to handle some parts of the game, but server validation is one of the best ways one can go to protect their game from exploits. by the way, i already mentioned this in my very first post:
onto the next wrong statement
yeah literally just a wrong statement i dont even know what you thought when writing this but its just wrong.
every game is vulnerable to backdoors. the toolbox is not the only way a backdoor can infest a game. and the fact you think it is shows me that you seemingly do not have any actual experience with game security. just to be mentioned that big games like arsenal and meepcity have been backdoored in the past so while rather unlikely it can still happen and if it does it often ends in a lot of trouble.
in conclusion your post is weird gibberish that gives ai slop. i hope you lied when you said that you had nearly a decade of experience in Luau, because if thats the truth im wondering what you did all these 10 years. its not “LUAU” but Luau btw lol
also please start working on the way you articulate yourself. bragging with scripting experience and talking down on others… extremely cringe
There is not a single bit of evidence to support the use of AI. You disagreeing with me ≠ me using AI.
I agree, and this is common sense. Not all exploits are executors but all executors are exploits (except ones that the developer builds in the game like admin panels, etc.)
You mentioned that there was a type of executor called “External Executor” and I went more into depth on that and corrected the many flaws in what you said.
I see where you’re coming from, but that isn’t true as anything on the client can be recorded from the device. Again, common sense.
Yes, of course. But the problem is you’re confusing and using several different arguments into one and changing the facts based off wrong perceptions on what’s being said.
So you’re basically repeating some of the points I made but with different wording
I said executors LIKE synapse meaning it’s an example
So you don’t have an argument.
Exactly what I said. So I taught you something.
So all of this is due to thinks like Roblox Studio plugins or/and models with infected code as well as developers who put them in the game themselves. If you know what each script in your game is doing and you ensure that everything is server-side validated, then you’re not vulnerable to backdoors.
Ad Hominem
I didn’t brag nor talk down on anyone, I simply used logic to disprove the misinformation on how Roblox exploiting works.
It’s really embarrassing when people only argue with insults and misinterpreted perceptions rather than actual facts. You haven’t mentioned any actual logic, you’ve only argued with insults.
You and @ChiDj123 have repeatedly said my argument was poorly articulated, however where I explained thoroughly, you just call it AI. Very contradicting, and people who think thorough thinking & writing is AI are people who don’t have any logical reasoning
flag them with hooking detections, simple.
“that it seems like you […] used AI to try to argue with me”. im not saying you used AI because we dont agree (even though this is a matter of facts and not opinions). im theorizing that you did because you are factually wrong with a lot of things you said.
here we got common ground
factually wrong. i never talked about an “External Executor”. fortunately the devforum keeps track of every post and makes it visible if they were edited. feel free to check my original posts, never talked about an External Executor.
yeah you can record the client on the device this has nothing to do with achieving arbitrary luau code execution. for that you have to modify the client! dont know where you’re trying to go with this
im not. this isnt even about arguments. this is about facts. also just saying that im wrong and not even being able to name what i said is wrong literally doesnt refute anything and is an empty assertion.
wrong again. you said every every executor is technically client-side which is factually wrong.
still, the actual substance was Filtering Enabled and not specific executors at that time. you dont seem to acknowledge this
using ram spikes to detect exploits is not reliable at all and as you yourself said that good exploits can also just work around ram spikes you refuted your own argument. when i talked about RAM in my original post this was about how externals work and achieve their exploit functionality by accessing the RAM instead of injecting into the roblox process. proof:
i never talked about the possibility of detection in terms of RAM, this was not an argument of my orginal post. this is the textbook definition of a strawman argument. nice try
no. i have nothing against you teaching me something but as i mentioned before i already talked about server validation in this thread long before you even created your first post in here.
in theory you are right, but if we are talking about a real world case where a studio is working on a game with several people access to it and a giant codebase then you will have a hard time having full control over everything.
no i theorized that youre whole post was written by or assisted by AI. i never said that it was.
what i said wasnt really against you but more against what you wrote.
i have mentioned plenty of logic, available for everyone to see.
I only argue with insults?
Talking about Ad Hominem and needing to present evidence that the post is AI, where is your evidence about your claims about me? Double standards?
Adding to all of this, you are cherrypicking on what to respond to and what not to respond to.
I’m not trying to play this game of cat and mouse but I will defend myself against your unwarranted attempts of discrediting me.
1 Like