Our game's servers are getting crashed by exploiters - "Player has been removed from the DataModel"

Help and Feedback Scripting Support
, ,
#21

That I know. I mean none of the remotes are hooked to delete the map or anything close even.

#22

Itā€™s likely itā€™s a backdoor then. Try searching for stuff getting set to nil and destroyed with the tab I talked about.

#23

Nothing., //////////////////////

#24

Exploiting is the client communicating with the server, so try looking for any RemoteEvents or RemoteFunctions associated with manipulating the Player instance. If you want to search for a list of all remote events or function, you can just search RemoteEvent or RemoteFunction in the explorer for a list of all of them.

Let us know if there are any suspicious remotes associated with the Player instance.

(Player instances can only be removed on the server as well.)

(Also, search for Script in the game for backdoors. Ctrl + Shift + F for require)

#25

There are no Remotes that can delete anything. It most likely is a backdoor, we just donā€™t know how to find it cause we did everything by now.

#26

If you didnā€™t find any require()s and there are no remotes, then try searching for an obfuscated function or Player:Destroy(), Player.Parent = nil, or anything of that sort.

#27

Search ā€˜c:Scriptā€™ in the explorer and read every script manually

#28

Try searching for RoSync. Itā€™s very common in plugins. Also search getfenv if you havenā€™t already. Ctrl+shift+f.

#29

Searching stuff like loadstring, setfenv, getfenv, require etc weā€™ve done millions of times now (this includes rosync)

#30

Didnā€™t find anything. /////////////

#31

Didnā€™t find anything either, have checked many times before too

#32

Try to make a script to detect what exploiters run so you can trace the backdoor from there.

#33

It is likely a vulnerability with your remote events. Have you completely secured them?

edit: nevermind. do you have filteringenabled on? do you have the real HD admin? since you have no remotes, there is definitely a backdoor in your game or your game simply is broken

#34

Im pretty sure you canā€™t disable FilteringEnabled anymore even. And itā€™s the million dollar question if its a remote or a backdoor. We got no idea.

1 Like
#35

I donā€™t think that is possible.

1 Like
#36

Update. Found this in the console and after a quick search I see people were also dealing with backdoors.
image
So basically now I just need a way to find this backdoor (or potentially malicious remote)

1 Like
#37

Wait! If thereā€™s no require stuff in the console then the backdoor is probably built into the game. This means you can search for the code of the backdoor. Try searching for that user id you saw! Also search for stuff like permissions because the backdoor probably isnā€™t free lol.

EDIT: Where does that text that says: ur not the owner noob. come from? There should be a script trace on it.
EDIT 2: Wait nvm itā€™s probably studio exclusive
EDIT 3: Try searching things like UserId == or OnServerEvent if you havenā€™t already.

1 Like
#38

This actually isnā€™t by using :Kick() this is done by just using :Destroy() to get rid of the player. Iā€™d suggest trying to search for anything in your code that may be Destroying the player instance (not their character)

1 Like
#39

I suggest experimenting, try deleting some scripts, there is a possibility that this infection is hidden in them (of course, make a backup copy of the scripts) btw you checked every models ?

#40

Can you press ctrl + shift + F to open Find All/Replace All
after that type in require( and if you find something that you did not make that uses require then you should check what it is
usually its numbers but they can be hidden in diffrent ways to prevent from being seen and removed
if most of the results are not your peice of code i would recommend send it to find out if it is a backdoor or not

1 Like