Is this a working protection of the LocalScript from deletion?

Help and Feedback Scripting Support
#21

It can be, they can create their own local scripts to replace them, causing them to still pass the check but remove the script.

local script = Instance.new("LocalScript")
script.Parent = blabla
script.Source = 'while wait(1) do print("HI") end'
2 Likes
#22

If I read this simply, you have a local script that you send to the client from the server, then the server generates a random ID, and updates the name of the script to the random ID, and the local script sends the full name back to the server once it detects a change.

Yeah, this won’t work. An exploiter could just create a client side script that waits until the local script is added disable it, wait until the name is changed and then create a spoofed event back to the server which looks (real) but isn’t. The server won’t be able to tell because the server cannot tell where client side data comes from.

In essence, yes, you have wasted your time.
Because this has been said so many times.
You cannot trust the client.
And it has been this way for decades.

I will say this, and I cannot stress this enough:
you CANNOT create a fool-proof client side anti-exploit

People, way way way smarter than me or you have tried, and they haven’t succeeded, because it’s literally impossible.

#23

All functions are stored in a metatable when called. If you know where this is going, you’ll know what I’m going to say next.

Even if you connect events that detect changes of the parent and name those can easily be unhooked by the exploiter! basically a forced “:Disconnect()” without using the original script.

And yes you can also spoof all the information that the server requires by simply replacing the function you called with a spoofed version using metatables.

This can be easily bypassed by very popular exploit script writers. :+1:

1 Like
#24

They can’t do that.
For by this logic, they create a script (object) that only exists locally with this player, but then tethered to it real? By literally changing the script on the server itself, so you can change the local script to any player, and manipulate the game of other people. This is nonsense and definitely not possible.
It’s impossible to create something locally, and make that local object, be linked to the real one, so to speak, replacing its original.

#25

I get the feeling that I’m not making myself clear, or you’re trying hard not to understand me
I will repeat 100 times what I wrote in the post itself:

I said from the beginning that this protection does not make sense, as my script can simply be disabled.
Once again: I never said it would protect LocalScript in general, I said it would protect it specifically/only from deletion.
You can disable LocalScript, and give a fake signal, but you can’t REMOVE LocalScript.
Just in case, one more time:
Disable, and signal artificially - YES
Delete/Replace, and signal artificially - NO
Yes, the protection has no practical use, but I didn’t say it made sense to use it in the game.
It was purely an experiment, which although it has results, it doesn’t make sense.
I hope you’ll stop explaining/proving to me what I admitted in the beginning
Yes, since the defense has no real application, you could say that I wasted my time anyway.
But so far, no one has been able to remove LocalScript, and continue to report the right data to the server.
That is, my protection really works, but meaningless in the real game

#26

How do they disable all server-side checks? The local script only tells its location.
I don’t know what metatable is (probably in terms of terminology)
If you mean they can disable the local script and signal artificially, then read my answer above

#27

I mean they can replace the script by changing the code in the local script.

1 Like
#28
  1. read the script, and understand that the replacement is not possible (delete/transfer the original, and replace it with another that was locally created)
  2. is it fun for you all to respond without reading the topic/responses, but by reading only the title?
    To quote my reply:
Quotle
#29

I think an exploiter can switch local scripts and delete the real one

1 Like
#30

Just skimming through the server code, but I’ve just noticed that if someone has a ping spike, they could get kicked because a remote could end up firing late, AFTER the server has already changed the location of the localscript.

An exploiter could totally just stop the actual code of the localscript from running and just have the part of the code that stops them from being kicked run, so it’s still the same localscript, just with different code, no deletion or use of .Disabled

#31

What do you mean switch?
if you mean that you can create a local script, and replace it so that it would go from the fake to the status of the original, it is not possible
I explained why:

Qoute
#32

But the thing is that the “real” local script is still a local script. The firing of remotes can be messed with and the server can think the fake local script is the real one by the exploiter. So the server will never actually know the “real” local script.

1 Like
#33

By the way about what you said (now that you mention it) how can you leave some code on the local script without disabling/removing/moving it?
This is just for the sake of example:
here’s how do you stop data being sent to the server?
How do you stop a function from running, or anything else?

#34

Tell me honestly, have you read the code?
Do you realize that in my case it is not possible to forge the original script
The original script must exist, otherwise the player gets kicked.
try to remove the original, and make it so that you do not get kicked, it does not work

#35

The client is in control on localscripts, which means they can just stop it from running (or never run certain parts of it) and make the server think it still is because the server needs to ask the client.

The client can stop replicating data of it’s own accord.

This is apparently really easy to do with function hooking, where everytime the localscript tries to call a function, the call gets redirected to one the exploiter defined.

1 Like
#36

Btw, I’ve heard that there are hacks that delete local scripts before the event even fires

1 Like
#37

The server sends the client the localscripts data, so the client doesn’t know any localscripts exist before the server sends it to it, not to mention players can’t join a server before it’s loaded.

#38

Sorry I meant to say the firing of the event

#39

So it’s still just “.Disable = true”
because the script will disable on the client, but not on the server

That is, the client can literally know what is currently running in the local script, and when, say, there will be this line of code

--Original local script
local x = 1

local function xadd()
	x += 1
end

xadd()

print(x) --because the fake code will be triggered, the output will be 0

--Fake code

if xadd() then
	function xadd()
		x -= 1
	end
end

the fake code will be executed?

#40

Yes, if it’s in a local script they have full control of the code

Also they can change the information of the remote event being fired, so it’ll be bypassed

It will be like the remote event never even fired and then they will delete without getting kicked.