Is this a working protection of the LocalScript from deletion?

Help and Feedback Scripting Support
#86

I don’t know why you deleted your answers, but I’ll still answer them

Okay, no scripts/videos.

at least explain in words how to read “:GetFullName” if you delete an object whose full path we are trying to read

This can theoretically be done in the studio as well

Video

#87

How do you answer an answer, anyways, I deleted them to prevent random roblox bots coming in my mailbox. And they asked me to install exploits to do that, which I won’t do.
Btw also just did in the simple console the fireevent with false information and it passed through

#88

What false information?
The server reads the location of the script on the server, and compares it to the location locally with the player, and since in my case I did not delete the script, but simply disabled it, everything works okay.
Kinda like what I said in the beginning

#89

what I meant by false information is basically what you did, sending the information of one script in another script

#90

You might as well add a waitforchild in “Script”, because you might error

#91

@commitblue There it goes, the anti-[anti-exploit] This would be an example of how it works, there’s classes that cannot be checked but I made this script just so you understand how it’d work

local exploitEvent = game:GetService("ReplicatedStorage"):WaitForChild("RemoteEvent")

function doExploit(localScript)
	if not localScript:IsA("localScript") then return end --Not needed, I just like it
	
	localScript.Disabled = true	
	localScript.Changed:Connect(function()
		exploitEvent:FireServer(localScript:GetFullName())
	end)
end

function onExploitStart()
	for i, v in pairs(game:GetDescendants()) do
		coroutine.resume(coroutine.create(function()	
			if v:IsA("LocalScript") then
				doExploit(v)
		    end
	    end))
	end
end

game.ChildAdded:Connect(function(child) --Not really needed unless the anti exploit makes new scripts after some time
	if child:IsA("LocalScript") then
		doExploit(child)
	end
end)


onExploitStart()
1 Like
#92

Are you kidding me? This is my script, which I showed above, but reworked
Secondly, I said it myself, I know it’s a workaround.

Please reread the topic, I added a clarification there so that there would be no more misunderstanding

#93

This is excluded if you mean the script on the server.
The server changes LocalScript’s name, and after that LocalScript’s event is triggered
(script:GetPropertyChangedSignal(“Name”):Connect(function()
event:FireServer(script:GetFullName())
end))
And after that the server checks it, but for the script not to move by accident at this point, the server has this command:
event.OnServerEvent:Wait()
Before moving the script.
Believe me, I tried to make it so that accidental kicks were not at all. But yes the script is not perfect, but it does not change its essence (as it is possible to perfect it, but why?)

You tell me, you understand that this protection is not bypassed?
On the condition that you can only delete the script, NOT disable, namely delete.
You can download the file I left right now, go into the studio, and make sure that the command (Object:GetFullName) won’t work if you delete that object

#94

that doesn’t change the fact that it can be exploited, and that’s what we are talking about, exploiters can also create an instance (localscript) identical to the real one, same name same parent same everything but no code in it and bypass it with getfullname

also I’m fixing my script because there’s services that don’t allow security checks

#95

Bullshit, it’s not possible.
You can’t create a local object and tie it to a real one

#96

for the client it’s real, which is what is important for the remote event, lol

#97

We need to stop talking about the same things
One more time:
Yes my protection is meaningless in a real game
Yes my protection is easy to bypass, just disable the script
Yes it is.
I admit it and don’t argue with it.
But the fact that my code protects LocalScript from removal is an undeniable fact

#98

So, you’re saying that you can create any object local, and substitute the real one for the local one
That is, if I from the server side constantly change the object name.
Can you locally force the server to change the name of an object that doesn’t even exist on the server, while the server will stop changing the name of the real object?
there is only “part1” on the server
the server randomly changes its name all the time.
And you can create “part2” locally
and make the server change the name “part2” instead of “part1”?

#99

I’ll check the server side later and I’ll tell you

#100

I don’t understand what you mean by real object

#101

You can not force the server to change the name of the “fake” part, because if it could be done, it would give huge opportunities

#102

what does the server have to do now? we were talking about the client

#103

ok so, apparently i saw that your local script is actually cloned from the server, which I didn’t realize until now, that’s the reason you are telling me it cannot be removed, the thing is, this is not a client-antiexploit anymore lmao, it’s just a server antiexploit at this point

#104

Well yes, it makes no sense to do protection on a third-party client (to create a local script, with some code, which should protect something)
because we all know that any local script, you can simply delete (stop it working)
That’s why I implemented the protection on the server

Here’s an idea on how to get around my protection:

Quote

but I’m afraid it won’t work, and here’s why:
let’s read the roblox wiki.
“Sets the Instance.Parent property to nil, locks the Instance.Parent property, disconnects all connections”
Apparently, after removal, the connections that were responsible for its location are disconnected from the object.
Yes, and it locks Instance.Parent
https://developer.roblox.com/en-us/api-reference/function/Instance/Destroy
If no one gets around my defense in the near future, I will write myself:
protection works, bypassing is not possible, and here’s why (and probably close the topic):
“text”
“roblox wiki”

1 Like
#105

I see this is still going, well I think I can end this for us. I quickly made a bypass script that an average scripter could probably make.

Simple form (don’t mind the messy code, it is just quick):

local player = game:GetService("Players").LocalPlayer
local playerGui = player.PlayerGui
local event = game.ReplicatedStorage:FindFirstChild("RemoteEvent")

for i, v in pairs(playerGui.Script:GetChildren()) do
	v.ChildAdded:Connect(function(obj)
		obj:GetPropertyChangedSignal("Name"):Connect(function()
			event:FireServer(obj:GetFullName())
		end)
		obj.Disabled = true		
	end)
end

and if you ever make it so you rename and not move just for some tricks, you could use this to bypass.


local player = game:GetService("Players").LocalPlayer
local playerGui = player.PlayerGui
local event = game.ReplicatedStorage:FindFirstChild("RemoteEvent")

for i, v in pairs(playerGui.Script:GetChildren()) do
	v.ChildAdded:Connect(function(obj)
		obj:GetPropertyChangedSignal("Name"):Connect(function()
			event:FireServer(obj:GetFullName())
		end)
		obj.Disabled = true

		for _, v in pairs(playerGui.Script:GetChildren()) do
			for i, obj in pairs(v:GetChildren()) do
				obj:GetPropertyChangedSignal("Name"):Connect(function()
					event:FireServer(obj:GetFullName())
				end)
				obj.Disabled = true
			end
		end
	end)
end

Try it yourself, run in the roblox studio command bar.