Exploiters and CoreGUI

My friend made an exploit for my game to show me how exploits work, and how I can improve my anti-exploit for my game. Right now, I’ve made a script which can detect whenever an exploiting panel has been added to StarterGui, and kick the player using it.

One method he used to inject a GUI is by putting it into CoreGui. Is it possible at all to detect an exploit menu being put into CoreGui, so I can prevent players from inserting exploiting menus into the game?

If there isn’t a solution or way to detect an exploit menu people put into the CoreGui, is there anything else I can do to prevent exploiting menus from being added to the game?

2 Likes

preloadasync can be used to check for guis in coregui, there are posts on here about it, but people will insult you for trying to make a client anticheat because they have an underlying lack of self confidence and take out their hatred on literally anyone else
it’s probably best to just look at posts that people have made about preloadasync and ignore any replies here because they will be very rude

8 Likes

Ok, I appreciate the honesty lol

1 Like

People don’t insult others for doing client side anti cheat. It’s just the fact that they don’t work, so why bother. Don’t think trying to help people is an underlying lack of self confidence

4 Likes

they can work if you do them properly, the problem is people throw insults at anyone who even tries so nobody cares to figure out how to do them properly

3 Likes

No, they cannot work. Any and everything done on the client can easily be messed with. There’s 0 reason to do any form of anti cheat on the client. It’s not about trying to figure out how to do them properly. There’s no such thing as proper client side anti exploit

3 Likes

it is not easy to mess with them if you know what you are doing, there is no reason to entirely give up the moment it gets challenging, it is just an opportunity to learn and nobody wants to take it
The server code should be strong, but there are things you can’t detect on the server but you can on the client, if you are smart about how you send data to the server, you can incredibly easily detect scripts.

It looks hard but it really isn’t, you can literally hide scripts from getnilinstances with script.Parent=nil;script=nil and there are only like 3 exploiters who know how to get around that and it can be easily detected

It is cat and mouse, yes, but you can either go for it and ban 99.999999% of exploiters, or you can give up and unintentionally cover up the fact that it is worth at least trying

Most exploits are very limited, with how many RCE vulnerabilities they have, they limit very useful functions for bypassing client anticheats because they were abused to manipulate CClosures

­

It is a balance between the client and the server, you would be surprised how many people exploit compared to legitimate players.

4 Likes

I’ve looked at some devforum posts on this, I’m still a little confused
What is content provider, how is PreloadAsync able to be used on it, and what are the 2 variables in the function’s parenthesis?

game:GetService("ContentProvider"):PreloadAsync({game.CoreGui}, function(CoreGuiID, _nil)

Parameter 1 is the id that was loaded in coregui, almost every gui uses the same asset ids so its fine, Parameter 2 isnt required

This method is useless on most exploits, because Synapse X has patched it! Just for the new people here

And now Byfron is here, forcing every S kiddies to basically use a much inferior version of their stuff! Because of that after Byfron was released I got tons of PreloadAsync detections and most of them actually have an Asset ID of exploiting hubs, sometimes even from their stuffs themselves :face_with_hand_over_mouth:

EDIT: Adonis Admin is a great reference for how this thing works.

1 Like