Prac - Little Anti Cheat

Resources Community Resources
#1

Hello developers :slight_smile: !

I tried to create a little anti cheat : GitHub - Progoblox/Prac: Program Anti Cheat

My first goal is to identify and preventing cheating activities in a roblox game.

If you find a vulnerability, something to fix / change etc. tell me here :>.

3 Likes
#2

It’s funny how people make anti-cheats even though there are some admin systems such as Adonis Admin and more that have a built-in anti-cheat.

1 Like
#3

in your checker script. I immediately noticed errors that would break the script; such as

local plr = game:GetService("Players") -- should be the localplayer, not the service
local mouse = plr:GetMouse()

it also relies on server-client communication which exps. can tamper the remote with

        if rs.isNoClip:InvokeServer(plr.Character) then
            rs.warnings:FireServer("3")
        end
        -- Fly
        if rs.isFlying:InvokeServer(plr.Character) then
            rs.warnings:FireServer("4")
        end
#4

Exploiting is pretty much done rn, but there are still a lot of bypasses made for Adonis’ Anti-cheat.

And besides, it’s primarily learning experience. Best anticheat is validating data in remotes on the server.

#5

Exploiters are going to keep trying, so eventually, they’ll come back.

Ask yourself: Will the anti-cheat still work as intended if the exploiter…

  • Deletes the script
  • Tampers with remotes
  • Prevents client sided kicking
  • Hangs calls to FireServer
  • Pauses connections
  • Uses a hack that isn’t visible (aimbot, esp, remotespy)
#6

Adonis anti cheat doesn’t exist, its just a type of joke

1 Like
#7

Yeah I know, going to fix today.

#8

It is visible (aimbot for ex) and they can not delete a script in ServerScriptService.

#9

You know, we learn that in EH (Ethical Hacking) but in my opinion you are not well aware: everything must be tested, from the most basic to the highest in terms of security.

#10

Thats crazy how you can get the entire anticheat bypass with a single google search.

2 Likes
#11

They actually have an anti-cheat, that’s not a joke.

Adonis → Client → Anti_Cheat.lua

Adonis → Server → Anti_Cheat.lua

2 Likes
#12

Clientside anticheats are always going to be able to be bypassed one way or another. I don’t understand why people continue to push these when the best thing you can do is just be smart with your remotes and quit relying on client data.

2 Likes
#13

Exactly, I said that in my first reply:

However, an additional anticheat never hurts. If your remotes are sanitized, why would it hurt to have a client-based anticheat alongside your current detections?

1 Like
#14

Clientside anti cheats aren’t that much of a bad thing. I don’t understand why people think clientside anti cheat shouldn’t exist at all.

They’re capable of detecting some common signs of an exploit loaded, and the average exploiter will have no clue how to magically kill a clientside script with whatever cheap exploit they found in a google search.

#15

Does it matter? He could be making this as a fun way to cool down and relax while getting practice for future projects. :person_facepalming:

1 Like
#16

You need to change FindFirstChild to WaitForChild. 90% of the time, it errors.

image
image994Ă—83 12 KB

Here’s the place file:
test.rbxl (400.0 KB)

And here’s a bypass I made in 3 minutes:

--!strict

local ReplicatedStorage = game:GetService("ReplicatedStorage")
for _, name in {"aimingAtPlayer", "isFlying", "isHealthHack", "isNoClip", "isSpeedHack", "kick", "warnings"} do
	local remote = ReplicatedStorage:FindFirstChild(name)
	if remote then remote:Destroy() end
end

local character = game:GetService("Players").LocalPlayer.Character
character.Humanoid.WalkSpeed = 123
--ect.
1 Like
#17

The only real use case for client side anti cheats being usefull are for those that are impossible to patch from the server like aimbot and such (latency makes it impossible to verify this from the server acurrately)

Asides from those, yeah people need to trusting the client.

1 Like
#18

It’s funny how you likely think that those same anticheats are better than anything else out there (They aren’t)

#19

Because they are practically pointless?

#20

Its a waste of time to open that can of worms. Clientside cheat engines will always be able to be stopped, and in my opinion its better to allocate your resources to actually hardening your game, because at that point you don’t need a clientside anticheat.

My reason for disliking executor detections is the fact that they rely on bugs in cheating software or make hacky workarounds that devs often fix fairly quickly, and they are also just like clientside anticheats, where they are able to be bypassed.