Patching Hitbox Expanders (HBE)

[cwiinder (cinder)]

Hey everyone,

I made a server-side fix for hitbox expanders (HBE) and figured I’d share it, since the main post on HBE is from 2020 and I couldn’t find anything newer that walks through fixing it. That post says:

@Matrice

This one’s tricky since it’ll rely on client-side protection typically to detect if the client is expanding other player’s hitboxes.

Further down that thread NachtHemd quoted PhantomVisual’s idea for doing it on the server instead:

@NachtHemd

I will be quoting @PhantomVisual from his PVEye module (which is a decent client side Anti HBE and a very good spectate tool) for a possible server side solution:

DEVELOPERS:
I DO NOT RECCOMMEND USING THESE [client side] METHODS TO STOP EXPLOITING
I want to tell you the correct way to actually do it:
Store positions of players on the server with a time stamp
Once someone lands a shot, send the time stamp to the server
The server will compare the shooter’s position and the hitPerson’s position to see if the shot was possible
The server will register the damage based off this information

This wouldn’t help against lagswitches but it’s a good start.

Matrice replied to that with:

@Matrice

no one’s ever implemented what he stated because it’s way too difficult, if there’s at least a simple example out there about a simple gun utilizing his method then aimbot and HBE might be put to rest.

So I made one, for HBE at least, built on a good ole RCL (the raycasting gun system clanners still use to this day, me included) with some improvements.

How it works

HBE only exists on the exploiter’s screen. The server still has everyone’s normal hitbox, so instead of trying to catch the resize it just checks if the shot was actually possible.

The only thing I changed from PhantomVisual’s idea is the client doesn’t send a timestamp, because an exploiter could just fake it. Instead it sends where the part it hit was on its screen. The server then checks two things:

• The hit has to land within 0.5 studs of that part’s real size. An HBE hit lands on the outside of a fake box a few studs away, so it gets thrown out straight away
• That part has to be within 1.5 studs of where it really was at some point over your ping, so you can’t just make up a position

It never asks the client for .Size, so spoofing it with a metamethod doesn’t help either.

local Bounds = HitPart.Size / 2 + Vector3.one * 0.5
if Seen:PointToObjectSpace(HitPosition):Abs():Max(Bounds) ~= Bounds then
	return
end

local Offset = Root.CFrame:ToObjectSpace(HitPart.CFrame)
local Valid = false

for Index = #Records, 1, -1 do
	local Record = Records[Index]
	if Record[1] < Now - Window then
		break
	end

	if ((Record[2] * Offset).Position - Seen.Position).Magnitude <= Tolerance then
		Valid = true
		break
	end
end

The server saves where everyone was for the last second and looks back as far as your ping x2 plus 0.2s (max 1s), so laggy players can still hit normally. It also checks the shot came from near your character, is in range and didn’t go through a wall. Bad shots just get ignored instead of kicking, so nobody gets false banned for lag. Ammo, fire rate and damage are all handled on the server too.

Testing it:

• Press H to turn on fake HBE on your screen. Shots that only hit the fake hitbox do no damage and play no hit sound
• Leaderstats show your kills/damage on the bot and what the bot did to you, reset button is bottom left
• To test with lag go to File > Studio Settings > Network and under Network Simulation set Min Inbound Delay and Min Outbound Delay to 150 each (about 300ms ping)

Place file: HBE.rbxl (110.6 KB)

Free to use in your own games. Don’t re-sell it, credit is appreciated but not required. If you find a bypass or want something added just reply and I’ll look into it.