Exploiting Explained

Some advice to prevent audio asset stealing is to use random numbers that only you know instead of naming it.

Thatā€™s absolutely false and will just be a ā€œeye soreā€ for anyone checking the name of the Sound instance. An easy fix for exploiters would be:

for i,v in next, game:GetDescendants() do
      if v:IsA"Sound" then
            print(v.Name,v.SoundId)
      end
end

Is there a way people patch exploits in a certain way that it is easy or is it complex? I am just curious because some games patch it within a week.

No. Exploits cannot generally be patched by developers, however individual scripts can be patched by skilled developers.

My other question is how does apocalypse rising owned by gusmanak patched all of them a year later? Also I heard roomers if your game isnā€™t FE they basically can take the whole game is it true?

  • All Games are ā€œFiltering Enabledā€ now, so no, that is false.
  • Gusmanak hasnā€™t patched any exploits from running in their game, they simply patched vulnerabilities in their own code that enabled exploiters to do things they shouldnā€™t. There are no ā€œglobalā€ patches to exploits.

Any public games are automatically switched to filtering enabled. That being said, it is most definitely possible to download/decompile an entire game IF somehow it were to not have filtering enabled.

3 Likes

It is not entirely possible to do as much - Server Scripts are not accessible to client decompilers.
And Filtering Enabled has nothing to do with that.

3 Likes

Well, thatā€™s interesting to learn. Previously it was my belief that any server-side scripts and models could be accessed by the client which is what allowed exploiters to copy and release entire games on exploiting forums. The more you know I guess.

I can quote on that @Xecular because so many people been mentioning it which explains most of the popular games in past which didnā€™t have FE got leakedā€¦

Filtering Enabled has nothing to do with game leaking! There is no difference between what you can leak if the game was Filtering Enabled, or if it was not.

Filtering Enabled is a tool for achieving a more safe client - server architecture. It has nothing to do with preventing place stealing, even causally.

4 Likes

Never mind, I was confusing the filtering enabled update with the Luau update which changed how exploits could see server-sided content

LuaU also didnā€™t change anything about how exploits could see server sided content.

LuaU just strips variable names from Local Scripts, so itā€™s marginally harder to decompile them.

Example:

local Hello = true
local Hi = "Yes"
local Cool = workspace:FindFirstChild("Ice")

will be decompiled as something like:

local variable_1 = true
local variable_2 = "Yes"
local variable_3 = workspace:FindFirstChild("Ice")

Same content, just no names.

2 Likes

I am still wondering what does the new beta functions do to help reduce exploiting or does it not?

New beta functionsā€¦?

They donā€™t. There is no secret patch for exploits.

1 Like

Then what does the difference between regular LUA and LUAC? Could be more effective to prevent exploits or not?

There is no such thing as ā€œLUACā€ - I think you mean LuaU. You can read more about it on Arsenyā€™s article titled Faster Lua VM Released.

In regards to security, it holds zero benefits against exploiters.

2 Likes

Itā€™s unfortunate that this cat and mouse game will never end. Itā€™s practically impossible to terminate exploiting, especially when thereā€™s multiple types of exploits. However Iā€™m glad to see ROBLOX never fail to stop it.

Is it possible to store everything in Server Script Service and Server Storage to prevent the map being stolen. When I mean putting everything in Server Storage I am referring to loading from the Server storage itself.

No; you still need to send the map to the client so they can actually render and see it.

2 Likes