Exploiting with textureId

You can write your topic however you want, but you need to answer these questions:

If making a mining game using meshparts for each ore, isn’t an exploiter able loop through all ore’s TextureID of the meshpart and get the desired block name and tp to it? How to prevent this on server?

I believe this topic is for #development-discussion

Secure the server, you could add anti-teleportion however there are issues with that such as false positives, you could make it that ores only appear if their near a player but for that you’d have to ensure the player can’t just teleport everywhere or such to spawn all ores.

You could make a client-anticheat but that only mostly combats against exploiters which are new/such but it can still somewhat help (Main priority is securing the server though, Client can help you detect stuff that cannot be detected by the server) (If you do plan on doing so, heres some basic information, make sure the localscript is within a Actor instance that is located within ReplicatedFirst which calls destroy on the parent and on the script itself (store variable to destroy and once destroyed, set variable to nil), using getfenv to remove the reference from there and such (Disclaimer that this is bypassable but can be made more difficult to bypass via detecting bad hooks and such created by exploiters), i’ve made a client-sided+server-sided anti-cheat which so far has detected over 2.5K Exploiters,

Something to keep in mind is that the server is what makes the final decision so it must be secured (sanity checks and such, example: if a user passes arguments which are impossible for normal users then log and ban them from the game).

You should still read/respond to what other people may say to your topic/post though (if any).

1 Like

Only way I can think of it is basically the same way it’s common to optimize gpu performance but much less of it and a bit different.
If it’s like Minecraft prison servers; Then you would only send the client the blocks at the top of the mine, and only when the player mines a block, the server will send the block below (other directions too further down) in a remote event. This way an exploiter would be unable to xray (assuming your server checks for telling the server a block has been mined are good).
So basically the server only tells the client the blocks it has to know, and the others are kept a secret until revealed

i think the other people said this, but i’m pretty sure the best way to combat this is to make the ores sort of non exist for the clients far away, only to the ones close by, and also add an anti tp system

let’s say i update player row in mine everytime it changes/player goes down, and i allow the player see max 10 rows at a time. Even then, the exploiter fly lower and check every second for a texture for every generated block in his currect spectrum of blocks

Not 100% sure I’m on page with what you mean, but I’d recommend not basing the blocks the players can see on their position or where their camera is, instead they would have to “legally” with legally I mean that the server has to accept that the client didn’t mine a block on debounce, from too far distance, multiple at the same time etc etc mine the block that would make it possible to see the next block(s).

Say the blocks are all in a multidimensional dictionary like local all_blocks = {} (including the whole dictionary would be extremely long) and you loop each block to x, y and z so you can access each block like all_blocks[x][y][z]. With this you can send the client every block on both x and z that has y=0 (y=0 being the top and 100 would be 101 blocks downwards etc). Then if the player mines say Mine(all_blocks[x=8][y=0][z=22]) then you would send the player return all_blocks[8,1,22] (if the player doesn’t already have it ofc). Then if the player mines the next block Mine(all_blocks[8,1,22]) then you would send return {all_blocks[8,2,22],all_blocks[7,1,22],all_blocks[9,1,22],all_blocks[8,1,21],all_blocks[8,1,23]} etc.
If done correctly then as far as I am aware there would be absolutely no way for an exploiter to “xray” from only client sided data regardless of teleporting around, flying through blocks etc, because if you teleport below the top blocks then there’s just air and nothing else below until a top block is legally mined.

Tried to keep it a little simple while explaining myself, if something is confusing just lmk and I’ll try to explain it a different way

If they tp to it that sounds like a great opportunity to catch a hacker with a lifetime ban… There could be a few just sitting there you could never get to unless you hacked a tp to get there and then you got them. You could also put a few out there that are not really for loot they are transparent, just fake leads.

1 Like

It can help more than the server and it does more than just somewhat help. I love to see a fellow client anti cheat developer :slightly_smiling_face:

1 Like