How exploits work and how to combat them

Resources Community Tutorials
, , , ,
#21

What anticheat? I haven’t posted an anticheat, just examples of detection methods.

Sometimes doesn’t work for some games and normally abused by players.

I have no idea what you mean by this

#22

Quite literally saying make the votekick restricted to people that have been playing for more than one month, and have been playing this current server for a specified amount of time, to prevent spam.

1 Like
#23

what i usually do for combating exploits is basically just anti decompiling
first, i disable my localscript, and defer its deletion (prevents localscript decompling)
for the assets i usually put it in the localscript and i make a new fake replicatedstorage environnment
and finally, i check whether if the player gets kicked (saveinstance SafeMode kicks the player)
to fully delete all the assets and halt script usage

#24

This doesn’t prevent save instance or decompilation. It’s impossible to prevent save instance or decompilation, you are just preventing ultra skidded attempts

#25

The localscript doesnt exist whenever you defer destroy it, its basically not in nil but now running on memory.
Also the assets cloning is not an foolproof way to prevent saveinsting but its to make it harder (as getnilinstances is hard to implement)

#26

From what i know, exploits cant copy localscripts code that are running on memory (basically dont exist but run)

#27

The scripts bytecode still exists in memory, otherwise it cant run. Since it exists in memory you can easily find it and read it

#28

Or make it hard to read via obfuscation.

#29

Only problem with obfuscation is makes your code much slower and also can still easily be read through dynamic analysis

#30

You can just spam getfenv() in your script. Not the best solution but it works against decompiling as it makes most decompiliers error.

#31

A good decompiler will never error when decompiling compiled luau

#32

Thats the thing, theres only flawed decompilers right now
Spamming getfenv is a good work around

#33

and, also make it more confusing fixing a bug, if that script errors, lol, and, if Roblox removes ‘getfenv’ then what? it will just break lol

#34

me when {Barrel = {Position = Vector3.new(–[[whatevz]])}}

The actual checks you want to do are:

if not gun then return end
if typeof(gun) ~= "Instance" then return end
if not gun:IsA("Tool") then return end
-- and lastly
if gun.Parent ~= player.Character then return end

You want to do this for every single instance you get from the client
otherwise you end up with a shop which sells you fake items for negative infinity coins

#35

Why would roblox remove getfenv lol? Also the error handler works properly anyway even if you do that.
The only true way to prevent your localscripts from getting decompiled is via
script.Enabled=false
task.defer(game.Destroy,script)
Hero battlegrounds does this (probably)

#36

This only prevents decomplication for garbage exploits. There is no true way to prevent decomplication of local scripts. If it runs, it can be decompiled

#37

Oracle couldnt decompile it (currently the best paid decompiler), not even Delta or Fluxus Mobile, which keep in mind, these all have 100% UNC (Unified Naming Convention or exploit functions) which means they are basically just synapse X.

#38

Public decompilers are garbage which cant even resolve basic control flow. Its very easy to make a foolproof decompiler but Roblox exploiters are not known for their competence