Is it possible for an exploiter to gain access to variable data in a client script that isn't theirs?

I’m wondering if it’s possible for a client to access variables that are already inside of a local script or module that was made by the developer.

For example, let’s say I have a module script like this:

local module = {}

function module:func()
   print("function")
end

return module

and inside of the local script that required the module, I have:

local module = require(script.Module)

local adr = tostring(module.func)

Would it be possible for an exploiter to get the exact hexadecimal address of the function by gaining access to the variable itself?

I’m not very knowledgeable in this kind of stuff, but I think they can. If the module was required by the exploiter’s client, then they could access it’s contents (since the client needs the code to run it). That means that they would have the address as well.

I think they can just look in memory and try to find it

Edit: Every variable is stored In memory

I believe that requiring a module script again returns an entirely different environment, so the function wouldn’t have the same address, so it wouldn’t make sense for them to get it that way

1 Like

The first time a module script is required the code is ran the second time it will return exact the same value

When a client requires a module, it creates it’s own copy of the module’s contents. They wouldn’t be able to directly change the module itself, but they can change the code in their copy to whatever they want.

It is 100% possible, and easy, to access localscript variables, modulescript variables, or anything else that happens to be on the client, even if they are marked as local variables.

tl;dr: yes

1 Like

If you have an global variable, things may get worse…

When a module script isn’t first required in a environment the code is ran and whatever the module script returns is returned, the next time the module script is ran in the same environment, the same thing is returned (the memory addresses will be the same)

And the client and a the server both have separate environments.

Yes every value is stored in memory, but has there ever been a case of an exploiter accessing memory from scripts that aren’t the ones they injected?

Every LocalScript is ran by the client thus, variables created by that LocalScript are stored in the client computers memory

The exact address doesn’t really matter, since exploiters use lua which means they only need the function reference, not its address.

And yes they can easily grab any local variables that you use within at least one function defined outside of it (it’s called an upvalue). Same for table values and global variables.
Locals not used in any function are slightly harder for them to obtain, but not impossible.


Also

this is wrong. ModuleScripts only run the first time they are required. Next times they only return their cached return value.

1 Like

Why do module scripts work like that? Wouldn’t making them return different values every time they are run be more secure for games?

Modules are supposed to be a sort of container. It wouldn’t make sense if different scripts received different copies of the container, and it surely wouldn’t boost the security significantly.

2 Likes