Can exploiters get local variables?

Help and Feedback Scripting Support
#1

So basically I have this local script:

local numb = 13819 + 1948914

Let’s assume the exploiter does not know how to do math, but is able to look at the script, is it possible for them to get the calculated numb variable?

1 Like
#2

If somebody is exploiting, I could only assume they wouldn’t check every script depending on how many there are.

#4

Anything available to the client will be able to be controlled by the client or stolen, there’s no fix to this. And yes, they can read that value through memory I believe, in theoretical ideology it would make sense since the Lua code in that script you gave is compiled whenever the client joins a game, therefor the Memory Address’s Value of that Datatype will be changed corresponding to the value with the operation (+) you have in your variable. Every Datatype Bool, Int, etc I believe they each have a memory address, which can be read / written to in a language like C++

1 Like
#5

I meant the calculated numb value is saved in the local script, but yet when they look at the script it still shows: local numb = 13819 + 1948914
Can they use :getreg() to get the already calculated numb value?

#6

I have a question of my own, will stealing games go so far as to be able to steal server sided scripts aswell?

#7

Unless you have a backdoor, they should not be able to get access to a server script.

#8

This is not exactly correct or in the ballpark, but the full explanation is also lengthy.
In short, the memory address isn’t static or related to the compiled bytecode; it’s almost completely impossible to predict.

Minor and unrelated but Lua optimizes this addition into a single number when it compiles, so decompiling would just yield the result.

But yes, local values can be inspected during runtime so long as they are in the scope of some function that is still around.

9 Likes
#9

Thanks for correcting me, I was pretty unsure on whether or not that might’ve been true with the Explanation on Memory Addresses :sweat_smile: However I was 100% sure about the Client explanation.

#10

I’m going to assume you’re not going to be storing references to addition of numbers very much in variables, so as a word of caution make sure you do not store any keys/codes, and other similar data in LocalScripts if you can help it. It’s very easy for some exploiters to view your LocalScripts, and as a result they’ll be able to access that data and use it in-game. Ensure you have proper server-side sanity checks for anything involving “authorization” for the client.

1 Like