How do others make good anti-cheats

Help and Feedback Scripting Support
1

hello everyone!! hope you’re all doing great!

i apologize if i sound stupid or if this question has been asked multiple times before, but
how do developers make good and functional anti cheats? i’ve seen few video/s of a game having an anti cheat that immediately fires when an exploit is injected (?)

i just wanted to know what would be good ways to implement effective and good anti cheats that don’t get bypassed by little timmies, so that i can also experiment with punishes for the exploiter cause i think they would be funny

8 Likes
2

maybe detecting when player has more speed, jump power. when in game not meant to be. im interested as well, sorry if i didnt explain it correctly

3

Ive never made an anti-cheat before, but I would always check their properties on the client, have the client send it to the server to check their propwrties, and if it doesn’t match, ban them. Of course they could lie, so if the walkspeed matches, check if it actually lines up. Check how fast they are moving for example.

For flying just check if they are in the air and if they are check their velocity to see if they are launching or falling correctly and its not flying.

For double jumping, check if they jump in the air and if they do ban them immediately. If you want to code your own doublr jumping, make the second jump an upward force from the server and not setting state to jump on client so that you know 100 percent when someone double jumps this way they are hacking.

For noclip, attach a part to the character and if it goes through something its not supposed to, teleport them back to where they were and dont immediately ban them because it could be lag. Same with teleporting.

For auto aim this is tough, because the camera is completely client sided, but maybe have the client send camera info, and in case they lie, check how many of their hits are aimed to exactly where their target was in a row, especially for ranged moves that arent instant and take time, if it goes exactly to where the target was before a suspicious amount of times it could be auto aim. Personally I would not ban any player for this unless they show many other signs of exploitong as this could easily go off on innocent players.

If you wanna make exceptions, you can have the server tag the client when, for example, they are flinging from an explosion or flying with an ability and not exploits, but even then make sure to have max forces and speeds set and such.

Of course I’ve never made an anti-cheat before, so take what I say with a grain of salt, but if I were to this is how I would go about it. I think that this system could still be broken, but it would set the bar very high and deter a lot of noob to intermediate exploiters, and even the pros wouldn’t be able to get away with much.

4 Likes
4

I try to make it not worth doing in the first place. On others, I like the silent catches. Ones that wait and then, out of the blue, drop a lifetime ban. I really don’t check that much. It’s a bit random, but it only takes one time, and you’ll never be able to do it again. Passively brutal.

I hate going a mile out of my way to make something airtight. I’ll write it so it works best and have some other process randomly test the maximums. If one is over the line, so is the player’s time on the game… forever.

2 Likes
5

I personally do not know how to make one, but i work with someone who maintains the AntiCheat for a Roleplay game, as well as someone who developed his own Exploit Injector (yeah…)

As the other replies have said, its mostly checking client against server and if things dont match, removing them from the game..

Which that is a very simple way of doing it, but some exploiters use scripts to get around that.

What ive seen before with the person i work with who maintains an Anticheat.. doing research on the exploits and how they work, and creating a patch to check for the specific aspects what occur with the execution.

If you are smart enough, and have your own exploit Client…
you can test it yourself in your own game, see how the scripts function, and create your own Anticheat through Investigation…

Roblox Byfron/whatever the current anticheat for roblox themselves is Now. When it was originally released, shortly after they made an update on DevForum essentially saying, “exploits are prohibited, a lot do still exist though, but we wont ban you, or even warn you for testing/using exploits on a game/experience You own”

1 Like
6

Most try to make anti-cheat system, but you shouldn’t really focus on making anti-cheat you should focus on making your systems more secure, majority of the time when players do infinite money cheats its on you as a developer you failed on system security design. One really simple example is part that gives you money for completing the parkour, and then teleports you back to start of the parkour after giving you money. Cheater can just teleport itself to there constantly and get infinite money but if you add cooldown that consistent with best completion time, cheater still gets advantage but its less destructive, then you can implement sort of anti-cheat mostly I don’t want to call this really anti-cheat because when we talk about anti-cheats I often imagine we are talking about tons of security measurements but often times movement itself requires standalone security script. What you do is compare movement speed of player, if it suddenly so far away, teleport it back to where it was. Then they just slowly move towards the target part by clipping or flying, then you deal with all of that headache. You can implement security measures for those things though but have you considered thinking about that your game design might be flawed? the fact that you reward money through parkour as a side content might mean you need to reconsider it and maybe increase cooldown a lot higher to prevent everyone doing parkour. But if your game depends on parkour courses and its parkour game, then I recommend you grabbing one of the open source or publicly available movement anti-cheat systems. About banning those that cheat, I recommend you to not ban them, false positives can be headache to deal with and usually cheaters open another account when you ban them, so you can’t really prevent them from playing your game, unless you make your game paid, but even paid games have cheaters. Before I finish this I would like to state that often times as you put it “little timmies” use premade exploits from people that know how to write cheats properly, those who actually figure out your game’s security openings, often times I recommend doing Youtube search on your game to see if any new exploits released and try to patch them.

1 Like
7

I don’t think so, the server is the only source of truth, and client can manipulate scripts on Client, change & remove them. Server should always calculate players boosts, gamepasses and other stuff. And if something do not match on the Server, server bans them. Remember that client can be always be manipulated. And the Server is the only source of truth, and Server always needs to check information from client before doing anything, and make sure to always use cooldowns so players cannot spam the server or APIs. I hope you understood.

2 Likes
9

Good anti-cheats never rely on the client-side. A simple executor can bypass any client-side anti-cheat.

Most anti-cheats are movement-based, they usually check for these things:

  • Distance between last position vs current position
  • Player’s WalkSpeed vs Forward/Backward Velocity
  • Distance between all the limbs (careful if your game uses ragdolls or custom rigs)
  • Player’s JumpPower/JumpHeight vs Upward Velocity

An anti-cheat would run a loop on the server-side (RunService.Heartbeat, which is usually 60fps), record all of those things vs valid player positions, and if one of the checks fail, it would teleport back to the last valid position.

For latency, some anti-cheats also factor in the player’s latency (PlayerInstance:GetNetworkPing(), note that this returns seconds, not milliseconds!)

Some anti-cheats also run :SetNetworkOwner(nil) on critical unanchored parts, by default, an unanchored part is owned by the nearest client. By setting network ownership to nil, you force it to be controlled entirely by the server.

There are also measures anti-cheats make for RemoteEvents, an exploiter spamming a RemoteEvent is worse than an exploiter speed-hacking. Anti-cheats rate limit remotes and validate arguments passed to a remote, this alone can protect the server from exhaustion and abuses.

There is no perfect anti-cheat though, there will always be false positives, either from server overhead, player’s latency, Roblox’s engine misbehaving, etc. So you should not be assuming that when a player is detected they are cheating. This is also why you don’t get banned when you for example get flung by an exploiter, have a lot of latency, etc.

To catch actual cheaters, anti-cheats usually log detections, check for repeating offenders, then punish them. Never punish a flagged player just by one detection.

Tip: Some anti-cheat developers test their anti-cheats in Studio using the command line bar (not the F9 Developer Console, that runs server-side) or the properties tab while the game is running, never test your anti-cheat using an actual executor!

3 Likes
10

Yeah i know but having the client send data can insta-ban rookies if they forget to change it
Youd have to use the server for the bigger hackers

1 Like
11

I have some experience in making anti-cheats, yet I am not an expert in this field.

Before you even start making anti-cheat, you have to make sure that sensitive systems, that you absolutely do not want hackers to exploit, must be handled on server. Here is mentality worth acquiring: “Everything inside LocalScript can be viewed and/or changed by hacker”. It means you have to design your systems in a way that doesn’t mean that client can say (for example) “Hey! Add me 100 currency for daily reward!”, but rather “I want to claim daily reward” and then server should make necessary checks before actually awarding currency.

As for anti-cheat system itself (it also must be server authoritative obviously) there are multiple ways to implement it. Good way to detect cheaters is to look at their “behavior” (in movement context behavior is information about their positions and velocity). Then in server loop you calculate maximum possible “diversion” for player positions and movement (based on physics and positional information) and check whether actual player data is consistent. It is important to leave some breathing room in thresholds of diversion from approximation, because these approximations could not be always perfectly consistent with actual engine physics calculations and could result in false positives. Afterwards you can collect major diversions that in opinion of the anti-cheat “could not possibly happen” inside a “violation counter”. Every anti-cheat tick, you could lower players’ violation counter by small “cool down” amount for leniency. But if player reaches some violation count threshold you could start enforcing it with warnings, kicks and/or bans, but keep in mind that strong punishments (like kicks and bans) must be enforced if you are almost absolutely sure that your anti-cheat was right. Then it is a matter of tweaking thresholds and configuration to get better results for your game.

Also you can implement “passive enforcement” like resetting player position to previous valid position, if these will not negatively affect gameplay loop too much.

I hope my response was helpful :slight_smile:

3 Likes
12

It’s simple.

The best anti-cheat is NEVER let the client handle ANYTHING that is important, like stats, transactions, database related stuff. Also let your remote events be checked and have multiple checks to ensure there is no attempt at manipulating the events.

2 Likes
13

Honestly just let Adonis Admin do the anti-cheat for you, yes it’s not the best and perfect solution but it’s something.

I saw exploiters just fire remote events in my game. The whole flying, speed hacking is just bad as firing a remote event as an unauthorized player.

I’m not saying you should not make your own anti cheat, but what exploiters did in my game was did “view UIs” and they were able to grab serverside items, so adding extra security measures in your scripts is really nice.

Telling the script that something unauthorized was added from the user is also a good idea.

Like these guys in the comments above me definitely know what they’re talking about but always watch out for false-positives . It will HAPPEN.

1 Like
14

thank you guys so much for the feedback!!! now i’ve gotten somewhat of an idea on what to do, everyone’s help is very much appreciated!!

2 Likes
15

Yeah, and this is because move-speed, teleport, and no-clip cheats are something that server code can actually detect pretty reliably, and correct.

Unfortunately, a lot of the most problematic cheats in competitive games are client-only cheats like x-ray vision (aka ESP, wall hacks) and aimbots. Roblox’s default replication model for player-controller characters automatically updates everyone’s client with the locations of all other players’ avatars. Unless you take extreme measures in writing your own replication layers, you can’t have any kind of fog-of-war type of player-to-player awareness that’s needed to thwart x-ray cheats.

Aimbots are the hardest to deal with. Even client-side anti-cheat systems can’t fully stop aimbotting. Low-effort aimbots that have perfect timing and 100% accuracy are pretty easy to detect with high confidence just statistically. Aimbots that try to inject code, or use known cheat-engine processes are also usually caught by client anti-cheat. But if you hand code an aimbot that scrapes the screen and directly spoofs an input device, it’s impossible to differentiate between a skilled human player and very clever bot that mimics a skilled human. AI tooling is only making this easier too, with people who don’t have the knowledge now being able to vibe code stuff beyond their skill level.

3 Likes
16

adonis anticheat currently has a public bypass :scream: i wouldnt recommend expecting it to save ur gam e from any exploiting.

2 Likes
17

I do agree with @ROXAR0, on not focusing on anti-cheats. Also, always prefer an open-source as it’s more secure and tested by others.

Roblox Articles

Roblox has a good article on not incentivizing cheaters: Defensive design tactics | Documentation - Roblox Creator Hub

Always follow the best practices: Security and cheat mitigation tactics | Documentation - Roblox Creator Hub

Look at other articles they posted under the “Security” category.

How to combat cheating

Passive / Simple Barriers

Don’t actively try to combat exploiters by wasting compute on complicated calculation for movement-based exploits. Instead of check their position, like Y above certain value (height) every few seconds, check it when it matters like when they try to eliminate someone in a PvP game. Spawn camping? Don’t reward them, if the user they killed just spawned. This goes back to Defensive Design Tactics from Roblox earlier.

In-game Votekick System

Enlist your playerbase to help fight exploiters/cheaters. The human brain will out-detect any anti-cheat/exploit. Make sure, it’s at least a server ban. I do not recommend making this a permanent ban system. Add cooldown to votekick system to prevent abuse and/or lock it behind some trust barrier like playtime.

Accept the Risk

There is no perfect system. No system or person could prevent all exploits/cheats. The goal is preventing common cheats/exploits in your game by designing your game to not reward malicious actions. Then edge cases/outliers should be accepted or handled by crowdsource feedback (like reporting) or votekick.

1 Like
19

Anti-cheats on Roblox are most of the time actual waste of development time due to most game’s life-cycle being fairly short to justify any Real Anti-cheat development.

As most developers here mention it is very important to perform all necessary logic and checks on server as anything from client can and will be modified by exploiters.

However most people feel very defeated as they think that there is absolutely no way to do good anti-cheat - there actually is.

There have been many clever ways to actually detect anti-cheats and also to prevent their deletion.

One thing to keep in mind is to realize that anti-cheat is not forever, its only a matter of time when it gets broken despite anything you do.

Lets first talk about persistent anticheat.
Persistent anti-cheat can be achieved by having some kind of value which has to be periodically sent to server to verify that anti-cheat is still running.
Issue with that is the fact that exploiters can just find this code right? Not if we obfuscate it.
Obfuscation is very important as it allows for partially securing the code at the cost of performance.
Now most common way to approach this kind of code is to use counter and have math equation (which can be non-sensical as that would help in obfuscation part) and that would generate updated number.
More future-proof and somewhat more telemetry-heavy solution is to generate this number partially from said equation BUT also make it use replicated parts of space in-game so that server can try to generate same number and if it doesn’t match detect the player.

This is a way to create anti-cheat which has to run for player to not get banned.

Now lets get into some juicy detection methods:
Module script require detection:

Re-require detection method.

Whenever script requires module said return table gets saved to cache and whenever there is another require table from cache gets returned.

The way most executors work most of the time is require has to be executed again and cache cannot just be returned, meaning you can use this to your advantage.

By leaving some marker for example of execution and then incrementing it or modifying it in some way if it happens again you can detect re-require of modules.

If you can tie it well to anti-cheat which is persistent in creative way it can be used as detection.

Verifying caller.

You can actually return function in modules instead of a table, which means that you can use debug library.
Debug library is really useful as you can actually get identifier of the script running by doing debug.info(2, "s")
This can be used to check if its valid environment and to trigger a ban or to actually maliciously provide wrong data.

GetLoadedModules() honeypot

Exploiters know that requiring modules can trigger detection therefore they use this function to get loaded modules and then to get to loaded module.
We can exploit this by having honeypot module which uses metatable methods (such as __index __newindex)
And if they search for specific keywords in it or try to modify different values which should be protected we can achieve detection.

Exeuction time profiling

This is one of the less sure-fire way to detect exploiters but concept works on the fact that functions like hookfunction and hookmetamethod are used to wrap function with a very fast function. Even if this function is extremely fast it is possible to measure it against some base-line - it is measurable difference in performance.

You do this by calculating a ratio from empty for i loop and for i loop with something that can be hooked onto.

By checking this ratio it is possible to observe meaningful difference.

Issue with this is that it is possibly inconsistent but this is one of the best protections against hook functions.

Honey-pots are your friend.

Probably best solution is to just do fake and annoying to parse through, very similar to original functions which waste alot of time for exploiters and you can always update them somewhat easily to make it as annoying as possible.

Now there are some detections for script upvalues but debug library is very limited.
Note that most of these depend on how sloppy exploiter is.

“Shadow variable”
Most exploiters with set upvalues to obvious values but you can actually have another value to compare to in some set function and this can lead to detection.
frozen tables
Exploiters might try to change table which is frozen which should give them error, they might then try to change the whole table and you can detect if they replaced it by frozen one or not.
Table value honeypots
While normal upvalues do not keep their keys(variable names) tables still do which means we can either create fake tables which look exactly the same as real one.
This one also depends on how much effort and how skilled exploiter is.

Anti-cheats are very unrewarding because you spend unimaginable amount of time on them and they will get cracked at some point.

It is very important to mention that anti-cheats are best when tailored. When anti-cheat is specifically written for your game you can do specific prevention that will have maybe better effects than general solutions such as those mentioned above.

20

just dont go beyond sanity checks ever
If you are making a competetive or physics game just use server authority

2 Likes
21

client sided anti cheats are good too if you make em good, whoever says that client anticheat is useless cuz “client can do anything” they dont know what they are talking about, client sided anti cheats can stop majority of skids nowadays.

parenting local script with AC inside to nil already works against “little timmies” btw

2 Likes
22

well client side anti cheats do seem like a good idea, i’m just worried that it will be too easy to bypass (since again, it’s my first time making one and i don’t know how i would secure it)