Hello! Today I’d like to openly share my research about functionhooks and how to protect a function from a function hook attempt.
What Are Function Hooks?
They’re basically part of the exploit-level library that is inaccessible to Roblox Studios level LUA code. Functionhooks are used to hyjack functions and make them return an augmented value.
For example, a functionhook would be used to set the taser receive function of Prison Life’s localscript to nil and allow the player to become immune to being tased.
What a Functionhook looks like:
Below is an example of a higher security context level functionhook:
--FunctionHook
--Grabs the target function from the garbage collector,
--locates the localscript => function => name of function => hooks it and returns nil.
for k,v in pairs(getgc()) do --loops in the garbage collection for the functions and lScripts
if type(v) == "function" and getfenv(v).script == (game:GetService("Players").LocalPlayer.PlayerGui.LocalScript) then --targetting a function method in a script path
if debug.getinfo(v).name == "antifunctionhook" then --targets our function's name
hookfunction(v, function(...) end) --hooks that function & sets it to return nothing
end
end
end
What an Anti-Functionhook looks like:
To protect a vulnerable function, you’d want to integrity check it.
--Victim Function
--Our function that is getting function hooked by the cheater
function antifunctionhook() --the name of the function being hooked
local x = 19 -- the expected/normal output
return x--the normal value being returned when function's called
end
--Anti FunctionHook
--Integrity check the vulnerable function:
coroutine.resume(coroutine.create(function()
while wait(1) do
if antifunctionhook() ~= 19 and typeof(antifunctionhook()):lower ~= "number" then --integrity checking the returned value
game.Players.LocalPlayer:Destroy();--welp they hooked it and it's not returning what it should return, it's hooked
end
end
end))
After detecting you can kick, destroy, crash, delete the script itself if it’s a core script, etc.:
Disclaimer: Sanity checks and server-sided anticheats are always preferred and should be your most powerful, important and, final line of game security. The above method is possibly bypassable regardless as it’s done on the client.
**It’s advisable to keep your client-sided anticheats embedded in a core/integral localscript so that if that script is tampered with, that’ll also impact the cheater’s capabilities too.