Detect and crash every string in CoreGui

Resources Community Resources
,
#65

this thread barely affects anyone unless ur the rare 1 in 9 septillion delta user on roblox youll be fine as it only affects playergui and not coregui

#66

All movement exploits (speed, jump, fly, no clip) can be patched on the server with 0% false positive rate with rollback netcode. all the things server side cant patch out cant be detected on client side anyways

#67

This isn’t trivial on Roblox though nor are you going to get a 0% false positive rate since even in the most popular off-platform games, you’ll still get rubber-banding or outright not be able to move if your connection is really bad. Rollbacks are still ‘detections’ even if we decide not to punish the player for the rollback; it inconveniences the player and could lead to them losing if they get unlucky with the rollback, it is an unfortunate balancing act we need to play as game developers.

This is simply not true, while client anti-cheats are certainly bypassable and shouldn’t be solely relied on; you couldn’t, for example, implement an anti-cheat to prevent free-cam on the server since the camera isn’t replicated to the server. There are many other anti-cheats that are only possible on the client.

#68

You misread what I said. I said there are a set of exploits that can’t be detected on the server (aimbot, auto parry, saveinstance, esp sometimes). These exploits can also not be detected on the client since they are easy to implement without injecting any code therefore it’s undetectable even by Hyperion.

Also rubber banding isn’t a false positive detection, just a consequence of bad internet. If your internet sucks your experience is going to be terrible regardless if there is rollback or pure client side. It’s certainly much better than server side sanity checks which have a way too high false flag rate

#69

Probably because they have extremely high leniency towards detecting flying behavior

#70

pls dont paste this into visionary im begging you

1 Like
#71

glaze, make your own detections dont make me flame you too

image
image1251×1243 148 KB

“i was bored so I decided to detect some popular scripts:” like he didnt CTRL+C CTRL+V

squidward-brain

#72

togif
togif1080×557 97.1 KB

togif-1
togif-11049×622 143 KB

1 Like
#73

bro thinks he owns preload async LOL

#74 
local LongStr = string.rep("的是不了人在有我他这中大来上个们为到和地出要于你说会就下得可也时对生能而子那得知过多\n", 5000000)

The translated chinese sentence means

It’s impossible for people to know too much about me and him. We can’t do it just because you want to do what you say.

1 Like
#75

This sentence is meaningless, because it’s just
some randomly typed things

3 Likes
#79

I dont know how this works but i asked to GPT and this is his he says

This script is designed to exploit the Roblox game environment by manipulating the localization service. Here’s a breakdown of what each part does:

  1. Initialization and Service Retrieval:

    local Localization = game:GetService("LocalizationService")
local LocaleId = Localization.SystemLocaleId
    • It retrieves the LocalizationService and gets the system’s locale ID.

  2. Blocked Commands List:

    local Blocked = {
    "explorer / dex",
    "olddex / odex",
    "audiologger / alogger",
    "serverinfo / info",
    "autorejoin / autorj",
    "serverhop / shop",
    "savegame / saveplace",
    "clientantikick / antikick (CLIENT)",
    "nosafechat / disablesafechat",
    "headsit [player]",
}
    • This list contains commands or script names that are presumably unwanted or malicious.

  3. Crash String:

    local Crash = string.rep("的是不了人在有我他这中大来上个们为到和地出要于你说会就下得可也时对生能而子那得知过多\n", 1e6)
    • This creates a very large string by repeating Chinese characters 1 million times. The purpose of this string is likely to cause the game to crash or lag significantly due to its size.

  4. Loop to Create Localization Entries:

    for i, text in Blocked do
    local translation = Instance.new("LocalizationTable")
    
    translation:SetEntries({{
        Key = tostring(i),
        Source = text,
        Values = {
            [LocaleId] = Crash,
        }
    }})
    
    translation.Parent = Localization
end
    • For each item in the Blocked list, it creates a new LocalizationTable.
    • It sets the entry’s source text to the blocked command and its value to the large Crash string for the current locale.
    • This effectively replaces any blocked command’s localization with the crash string, causing disruption when these commands are used or displayed.

  5. Script Cleanup:

    script.Name = "LocalScript"
script:Destroy()
getfenv().script = nil
    • Renames the script to “LocalScript” (likely a disguise or misdirection).
    • Destroys the script to remove traces of it being present.
    • Sets the script reference in the environment to nil to avoid detection.

Purpose:
The primary purpose of this script is to crash or severely disrupt the game by exploiting the localization system, replacing common unwanted or malicious commands with a huge string that can cause performance issues. This type of script is generally considered malicious and against Roblox’s terms of service.

#80

Yeah these type of script is generally considered malicious and agaisnt Roblox’s terms of service so im fine

#81

Please don’t use AI to explain what I said. ChatGPT is wrong on the first line anyways. It doesn’t exploit anything; it just translates text from common exploits to something that would crash on rendering it. It may not actually work though, as noted by people above. I found that you cannot translate anything in CoreGui as a developer. It’s better than nothing though, a low-level executor may put it in PlayerGui instead.

This script is not malicious. If you think it is, don’t use it.

3 Likes
#82

Boblox just patched it (i tested it on coregui before ) :crying_cat_face:

#83

Does changing the script name break this behaviour? If not I recommend using a ton of invisible characters to help annoy skids trying to prevent this or any exploiters in general.

#84

me when FindFirstChildOfClass
:sob::sob::sob:

(or just check for non ascii characters in the scripts name)

#85

idk man but that seems like mini-racism to me

#86

Just throw some random full name of someone who lived a thousand years ago in arabia and its good enough :joy:

#87

not really if you think about it