I’m looking to create a script using a StringValue (I assume it would work by setting Script.Source). For some context: I am well aware that it is impossible to stop geometry stealing for the client, because it’s in memory. However, to at least irritate the majority of exploiters that steal my map, I’d like to use a script to delete the map/crash the game/otherwise annoy them to the point that they’ll just give up on using the map. Is this possible, and if not, is there a feasible way to do something similar without enabling loadstring or other properties that could enable other exploits to operate more easily?
2 Likes
Looks like there is a function that runs code in string form. It’s called loadstring. It basicly returns a function that runs the code passed in when called
local runCode = loadstring("print(1+1)")
runCode() -- prints 2
Oops. I didn’t see that
I wouldn’t use load string really at all anymore , as it is depreciated for the most part ( I believe, correct me if I am incorrect)
@Jaycbee05 Huh.
Other than loadstring, I don’t see a way to run scripts from strings.
Maybe just hide the script in empty models and stuff and hope exploiters don’t find out.
Add decoys too, like, lots of them
Nvm, I made a mistake, i believe i was thinking of loadlibrary( as that is going to be depreciated), Have a Great day!
Thank you! I thought about loadstring, but decided against it because ultimately it’s too much of a security risk for me.
If found something on stack overflow
It says:
Function loadstring is deprecated. Use load instead; it now accepts string arguments and are exactly equivalent to loadstring .
It is deprecated…
Oh, hmm… , I didn’t know that, but is the version that it is referencing, the one the current “Roblox Lua” utilizes? ( just curious)
In a Roblox Wikia post:
The latest stable version of Lua is Lua 5.3.5, but Roblox uses Lua 5.1.4
loadstring is deprecated in Lua 5.2, so its not deprecated in Roblox Lua… Roblox ought to use the latest version of Lua. It’s so confusing…
1 Like
The two more common methods of doing this, which you can also see done in admin scripts, is either by setting LoadStringEnabled to true anyway or using a Lua-in-Lua VM (or I think, rather than a VM, an interpreter).
It’s worth noting that LoadStringEnabled doesn’t necessarily enable exploits to operate more easily. This is only a problem if you have a vulnerability in your game in relation to loadstring that allows arbitrary code to be run. Note that this is not a backdoor though: a backdoor would imply that a way to run arbitrary code is inserted into your game as opposed to exploiters taking advantage of bad structure in your game (hence the term exploiter).
See:
3 Likes
To answer the OP’s main question:
No there is absolutely no way to only let an exploiter get a destroyed map without also applying that destroyed map to every other player in the game as well. You nor the game will never know when the exploiter has gained control of the map, so unless you spontaneously destruct the map on everyone in the game, there is little chance for you to even stop and exploiter from getting your map.
1 Like
I think you might have misunderstood my intention: I want a script to be created, say, if the CreatorId of the game is not mine, and for that script to do something insanely annoying for the exploiter.
2 Likes
Ah. I see now.
In that case I feel like you could also just hide LocalScripts that just destroy the entire game if the CreatorId doesn’t match, since exploiters who steal maps will not be able to get the source of the ServerScripts in the game. However, this will also mean that if the exploiter actually checks the scripts, it can just as likely be found. However, all the aforementioned loadstring() methods also work just as effectively.
Best of luck and sorry for the misinterpretation! 
1 Like
Try this, it’s super easy. Just require it,
local Loadstring = require(Path.To.Loadstring)And run code!
Loadstring("print(\"Hello world!\")")() -- Returns a function
1 Like