Just the above question I have to ask, do I need to add extra precautions in my game so that exploiters can’t just edit my code or do they not have the ability to do this? Or can I just write code like normal? I’ve heard Roblox has really upgraded their security recently so this can’t happen, but I am not sure. Thanks.
3 Likes
They cannot directly edit localscripts but they can edit any values onto it. like numbers in functions or tables mainly from getgc(). Keep in mind that THEY still can read it.
6 Likes
It’s hard for exploiters to “edit” a script on the client, however it doesn’t prevent an exploiter from just deleting a client script, or delete a client script, and re add the same script with the changes they want to make. (At least this is what I know, but I do know Roblox again has up Security recently, but I know that this was possible before)
You mean like this?
local ExploitScript = Instance.new("LocalScript")
ExploitScript.Source = VictimScript.Source
VictimScript:Destroy()
2 Likes
Exploiters can modify & delete local scripts the same way local scripts can but NOT server-side scripts (they cannot read any server-side scripts unless if it’s not on ServerScriptService or ServerStorage). This is why you should focus on making server-side anti-cheat and never trust the client.
this is literally the equivalent of VictimScript:Clone() and then VictimScript:Destroy()
Yes I know. Speaking off creating scripts. I genuinely do not know if this is possible or not.
local LOL = Instance.new("Script")
LOL.Source = "for _,v in game:GetService("ServerScriptService"):GetDescendants() do print(tostring(v)) end"
LOL.Enabled = true
LOL.Parent = workspace
I tried in-game but it threw an error.
Executor scripts are more powerful than local scripts & the command bar, as they have access to functionalities reserved for only CoreScripts (including editing Script.Source)
2 Likes
I’ve heard that you’re no longer able to edit scripts on the client anymore. Also, how can they add values to a script that doesn’t use any of the value instances? Thanks guys.
I mean, if they can edit local scripts then that makes remote events and functions useless because they can just do something like: access == true and it would override everything so I don’t think they can edit local scripts.
1 Like
Im guessing you’re talking about the new anti-cheat “Byfron” which is still not released worldwide (meaning theres still exploiters on roblox).
why would an exploiter want to make the game unplayable for himself 
No, you’re missing my point. Let’s say if the local script needs to check if the player’s car is legitimate it checks their inventory and returns a true value if it’s there. Well if you can edit the local script you can just delete that line and just add “access = true” or something like that.
This is why server-side checks are always important. The exploiter could do “access = true” to presumably gain “access” to that car but that only tricks the client and NOT the server. Meaning that you should make a server script where if an exploiter tries to get into the car without actually having access then you should kick him out.
1 Like
Yes, for that instance it can probably work, but its more complicated with inventory systems since these are almost 100% based on the client. There would be logically no way to stop an exploiter if he can edit local scripts to change the values in there to what they want. And plus I hear a lot of people say that old school exploiting is gone and you can’t edit local scripts anymore. That is the only answer I need… can the edit local scripts? I am 99% it’s no but I wanted to check for sure.
EDIT: Actually you can check if its legitimate when you send a server event to place the furniture so nvm
Inventory systems are easy.
There is a folder inside of the Player (like leaderstats folder) containing the items (those items being a BoolValue or anything really).
The job for the server is to handle anything related with inventory (such as equipping an item, creating an item and placing it to the player’s inventory and etc)
Whereas the job for the client is to send the message to the server and to show the player what the server returns (such as displaying the inventory)
Yes, or you can just check if the item is in the player’s saved inventory every time you try to place it ALTHOUGH clicking too many times too fast will create traffic in save requests… also I just did my research and everyone says you can’t edit the code inside the local script anymore but I will add some precautions just in case. A few lines wouldn’t hurt anyway. Thanks.
EDIT: Actually you wouldn’t cause traffic if you just copy the saved data into a separate table in the script and do some additional simple math after. Lol.
Exploiters can not access any server-sided services such as ServerStorage or ServerScriptService. This is why your script threw an error.
When Roblox rolled out Luau it made is somewhat difficult for exploiters to read client code due to variable names being stripped, but it is still possible.
This is wrong, by the way.
The client cannot access any server script, regardless of where it is located. Server scripts run only in the server, and therefore are unaccessible to the client.
1 Like
Exploiters are able to see the instance itself if placed in a service the client is able to access, but cannot view whats inside it.
1 Like
Exploiters can actually read server scripts that are in workspace (which is why it’s never recommended to parent scripts onto parts in workspace)
For instance, this is how the workspace looks like on exploiter’s side:
You see it?
Yes they can see the scripts. But not what’s inside + if they delete it, it would only affect the client. As example the client checks if a serverscript still exists. But the serverscript will always do it’s work.