Can exploiters change the values of other players, such as walkspeed?

Help and Feedback Scripting Support
#21

Yes that is the downside to checking for exploits

#22

Exploits allow clients to have full control over themselves, allowing them to run arbitrary code (e.g to change their WalkSpeed) and read LocalScripts under a container whose contents are visible to them (due to bytecode being decompiled on the client, it’s possible to decompile it into source code - that’s another story though) .

I urge you to read my response more carefully, in the logic I demonstrated, there’s not one instance of the server reading a Humanoid’s WalkSpeed but rather the server changing players’ WalkSpeeds after intervals regardless of their current WalkSpeed.

1 Like
#23

The server won’t see the walkspeed change if its done from the client, also, if its in a local script they can easily delete it

#24

This local script existing for even .000001 seconds will kick the player if their walkspeed is not equal to 16:

if script.Parent.Parent.Character.Humanoid.WalkSpeed~=16 then
	script.Parent.Parent:Kick("\n\n██████▒▒▒▒▒▒███▒▒▒▒▒▒▒▒▒█████▒▒▒▒▒▒▒▒▒█▒▒▒█▒▒▒▒▒▒██▒▒▒█████▒▒▒▒▒███████▒▒▒▒█▒▒▒▒▒██▒▒▒▒▒▒▒▒██▒▒▒██▒▒▒▒▒██▒▒▒██████▒▒▒▒██▒▒▒██▒▒▒▒▒▒▒███\n\nKicked for exploiting by Extreme Anti Cheat. ")
	print("[EAC] Found an exploiter [Exploiter kicked]")
	wait(.5)
	repeat until nil
end
#25

“Exploiters can still always change their own WalkSpeed, but if you set the speed back fast enough the increase in speed might not be too helpful.” - I assumed your talking about from the server because on the client it will be pointless to do so.

#26

You know that you don’t only have to change the walkspeed to speed hack, you can also use body movers.

#27

Here is a bit of one of my anti exploit code for checking walkspeed

local FastestVelocity = 200 -- able to change to what max velocity you would prefer (Lower = More Kicks on Lag)

local function onCharacterAdded(character)
	
	local player = Players:GetPlayerFromCharacter(character)
	
	while true do wait()
		if character then
			if character.PrimaryPart.Velocity then
				local Velocity = tostring(character.PrimaryPart.Velocity)
			
				local VelocityTable = string.split(Velocity, ", ")
			
				for i, v in pairs(VelocityTable) do
					if i == 1 or i == 3 then
						if tonumber(v) >= FastestVelocity then
							print("Kicked")
							player:Kick("Speed Hacking")
						elseif tonumber(v) <= - FastestVelocity then
							print("Kicked")
							player:Kick("Speed Hacking")
						end
					end
				end
			end
		end
	end
	
end

Players.PlayerAdded:Connect(function(player)
	
	player.CharacterAdded:Connect(onCharacterAdded)
	
end)
#28

Yes this is why you check for velocity

#29

Yes, I am aware. I am just starting with the basics for now.

#30

This solution is very flawed because it will incorrectly register lagging players as speed hacking and then kick them.

#31

Obviously.

“Well it will work” I suppose, is enough to imply my post was a response?

I also just read it completely now,

then it won’t work since it’s still a LocalScript that’s doing the work, it is more reliable to just in an infinite iteration, override the WalkSpeed to a preset on the server (getting a hold of the player through a PlayerAdded connection or something) even though this will get pretty expensive with more players.

#32

Yes this is why anti-exploit systems can kick people that are not exploiters. Server Side Checks are the only 100% way to safely check for exploiters

#33

This local script will be able to detect the player’s actual walkspeed, right?

#34

The best solution would be to create the anti - exploit based on the type of game your creating. What do I mean by this? Let’s saying your making a combat game, Each time the player gets a kill you save their position, then when they get a next kill you would check if they got that kill too fast based on there current walkspeed. This would be a much more full-proof method than @gameknight9992005’s solution.

#35

It is constantly being cloned and parented to the player from ServerScriptService.

#36

Yes but remember. They are able to destroy it right when it comes into their inventory

#37

The local script will still exist for enough time to prompt the if then statement to run, right?

#38

Yes but remember anything on the client can be deleted.

#39

Exploiters have COMPLETE CONTROL over their computer they can stop lua from running and delete the script before it can even have a chance to run

#40

The best solution would be the one i mentioned earlier, all the other ones here are poorly designed or will result in many false positives.