How would I go about making an "Exploit Client Sensor"

So, I’ve always wondered if it’s even possible to create this, is there a way for you to find 3rd party clients injected into your game? I think there is, but how would I specify if it’s an exploit of not? Because if someone might be using a shader, I wouldn’t want them to be kicked or whatever but if they were using “Synapse” or “KRNL” for example, how would I specify that without specifying any names but just the injection part of it and exclude any shaders.

Update: So I’ve read all of your informed replies and most of them have helped a-lot with what I am planning on creating, I get that it’s almost impossible to detect everything since exploits are getting constantly updated. But now apparently after Roblox’s Byfron “Anti-Exploit” it’ll be almost impossible for exploiters to inject their scripts. However, I am still yet concerned on how skilled exploiters could probably if-not definitely bypass Byfron, so I’m in a pickle on how I should continue moving forward I.E Making the detection or Just leaving it to Byfron.

Also please do not criticize one another, I’ve seen the replies and that does absolutely nothing to help my case, just ignore them if you will and I’ll be the judge of everything. Take care, and I’m looking forward to seeing what you have to say.

3 Likes

It depends on what exactly they’re doing and if they’re not doing it right. Properly hacked clients are undetectable, even by Roblox.

2 Likes

Would it be possible to detect a “DEX”?

1 Like

Yes, it has multiple detection vectors

2 Likes

Dex has been loading a lot softer with little to no lag spikes recently. Memory would probably still be going up though.

1 Like

100% possible, I even have a detection for it right now.

1 Like

There is, but it’s not really worth it, focus on your server anticheat instead.

100% hookable and bypassable.

2 Likes

Dex is barely getting any updates, detecting that is kinda free at this point and is something you should still include in your game. Just because it could hypothetically be hooked and bypassed doesn’t mean you shouldn’t implement it.

2 Likes

Ok so??? Just detect the hooks.

1 Like

no lol, dex is parented under coregui, where its impossible for user made scripts to reach as they lack level 4 access, so if the dex is outdated and is placing under starter gui then perhaps but dark dex will be placed under coregui making it effectively undetectable, also, there is no way to detect script injections accurately. The most you can do is the record if the memory spikes a lot in a short amount of time but that is prone to a lot of false positives and i wouldn’t recommend it. If you are afraid of your game getting exploited on, just make it secure.

1 Like

You should stop pretending like you actually know what you are talking about, there are ways to reliably detect the latest versions of Dex.

1 Like

There are certain ways you can use to detect some, but I’d rather suggest that you should instead focus on server-related anti-cheats rather than client-sided ones since they are most of the time easily bypassable.

Theres a dex script called “Safe Dex”. I’ve looked at the source code of what makes it so safe, and it turns out its not even parented to the CoreGui, but a custom service that behaves like the StarterGui and CoreGui (Please correct me if I’m wrong)

The “bypasses” that make safe Dex safe are actually making it easier to detect.

1 Like

Also, you won’t find any answers here. Most developers that have a detection won’t just simply drop the solution here, sorry🙁

you don’t even have to detect the gui you can just detect what it hooks

one thing I will give you is this:

script.Parent = Instance.new("FunctionalTest")

this’ll hide localscripts from dex and getnilinstances(), you put it at line one of your scripts and not sure if it only works for localscripts in ReplicatedFirst

1 Like

Go to youtube and look up “CodeGnome” He recently made a video that goes in-depth on a few ways people might exploit, and how he detects them. He even mentions how someone might avoid being detected. There is way too much information in that video to really post it all here but the main point is exploiters are lame. hahaha

I’ve skimmed through it and it just seems like the basic server speed and flight checks, doesn’t go in-depth at all about all the other stuff an exploiter could do also that’s all serversided

Hooks will most likely make the function in question return what you’re script considers ‘not hacked’. So you can’t detect this directly.