How do people create anti exploit scripts?

Help and Feedback Scripting Support
#13

If an exploiter has your bytecode, they can decompile it. You can put hurdles in the way, but if the code executes, it can be decompiled. Never assume it can’t be.

Edit: Actually let me expand on this more.

There have always been a few open source Lua decompilers out there, and generally when an exploiter is decompiling scripts, they’re using one of those decompilers but repurposed for Roblox bytecode. Decompilers like this are usually known to have bugs and edge cases where putting certain things in your scripts will outright break or confuse the decompiler.

However now in 2018/2019, more and more cheaters are writing their own decompilers. That or the cheats they’re using are growing more advanced. They tend to have decompilers built into them that were written specifically for Roblox. They get updated when something doesn’t work correctly. Vulnerabilities in the decompiler don’t stay like they did before this became more common.

Always assume the people cheating on your game have access to tools that surpass anything you can do to slow them down. It is possible to make a game that’s exploit-proof with proper client/server code. You don’t need to prevent decompilation or write a good anti-cheat. There are no secrets. Just trust the server foremost and validate everything coming from the client.

2 Likes
#15

It doesn’t matter if they have local scripts, never trusting the client is the only thing you should care about when it comes to security.

#16

Even if it doesn’t actually affect the gameplay if they have the localscript, it would still be nice if all the work you put into making the UIs aswell as camera manipulation and other client-sided things wouldn’t be instantly stolen by someone.

#18

As far as I know, the script sources are sent to the client where they are compiled, meaning it should be readable. Although it’s possible that it’s the bytecode which is sent, which would align with @bmcq_12 's explanation.

Also, if I was him, I wouldn’t release either.
It’s like calling for exploiters.

#19

Byte code obfuscation (with debug data removed) would prevent someone from getting the direct source code of a script, but a determined exploiter could still just re-assemble the source from viewing an assembler of the byte code. (ie reverse engineering)

There’s lots of projects that do this kind of thing, the most notable one I can think of is LBI:

#21

Its sad that localscripts can be stolen so easily and there is literally no way to fully block it, there is some amazing client-sided stuff I’ve seen that just really doesn’t deserve to be stolen at all

#24

I thought it was against the rules to use v3rmillion?

#25

If you really want to prevent your localscripts from being stolen do some research on what luadec and unluac is and learn how they work. If you can learn how they work then you can find flaws in how they work. Find the flaws and abuse them to the fullest extent possible

#26

I didn’t say use it, I said just read some of the open source scripts to see some of the concepts that exploiters use to make their scripts.

#27

Reading it piece-by-piece and gsubbing would probably do the trick.
Although, would have to be exploit’s function rather than a script.

#28

It’s not against the rules. It’s against the rules to exploit.

#29

Which is why you just make your own custom byte code format and run it in a VM.

Again, given enough time someone could still undo this, but It’s not worth the effort.

#30

Sort of adding on to other responses, don’t focus on anti exploits. What I think really matters is that you have good remote communication. Say you have a remote event that lets a player buy a weapon. On the server (and NOT the client), you can do checks such as

  • Do they have enough money?
    • Give them the weapon
  • Have they sent legal information?
    • Ignore the request or do something
1 Like
#31

I see. wow thats a lotta code

#35

I never realized how dedicated people are to exploiting roblox…

7 Likes
#38

I wouldn’t say its difficult, I would say its more different then difficult as you just have to get into the habit of making your scripts less vulnerable to exploits just by habit, rather then having to go back and edit them later on.

#40

if you’re right, that’s why I always do a test of my scripts in studio but going back to the topic is difficult to create scripts for anti-exploits since the creators of exploits always find a way to cheat that system and what I still do not understand is there people make scripts for their exploits :face_with_raised_eyebrow:

#41

Exploits control anything on the client, including your anti-exploit scripts.
Some exploits have specific functions to combat anti-exploits.
Making a client anti-exploit is a waste of time, it’ll catch the few cheaters who don’t know how to bypass, but all it takes is one exploiter releasing a bypass for everyone to start using it.
It’s a cat and mouse game, and a waste of time. Keep your remotes sanitized and you’ll have no problems, (mostly).

2 Likes
#42

I made an edit earlier talking about this in more detail further up in the thread, but exploiters have their own decompilers now. Open source tools like luadec aren’t used the way they used to be. It’s now proprietary decompilers built into cheats that exploiters pay for.

#43

All the exploits currently use unluac / luadec. They’re changed a bit to support Roblox scripts, that’s it. There are still many flaws in them that people can use to stop decompiling, however the issue can be fixed and your “anti-decompile” is no more.

1 Like