Preventing Exploiters from firing Remote Events

Help and Feedback Scripting Support
#19

You can’t, sure you could get the client to have a randomly generated string but that only protects you against people that don’t know exploiting well.

That’s not how life works…
All you are doing is swapping a colon for a dot, and your doing that on the client.
Anything stored/ shared/ fired on the client is accessible to the client to read and alter;

example
You want to share data between client scripts, but you don’t want it to be exploited so you put the data in a string value and fire a bindable event with nothing to notify other local scripts you want them to read something… so the local scripts goes to this path of where the string value is and goes to read it by doing .Value, it can still be altered without touching the string value because the local script is trying to get data stored on the client.

#20

It’s secure tho, as stated - it doesn’t log with hacking software such as Synapse.

#21

what do you mean by “it doesn’t log”?

#22

He means that scripts which only detour __namecall aren’t going to pick up the .FireServer call, which is true. But I don’t think I’ve seen such a script for a year, they all use double hooks now.

#23

I dont quiet understand this part

Additionally, the first Argument for :OnServerEvent is the Player that fired it, what I do is make the second Argument the Player it should be.
#24

What are “Double Hooks” ? (30 chrrrs)

#25

A remote spy can still detect the :FireServer wont it?

#26

You can use something called nil parent to hide your scripts if that helps everyone. You could also try obfuscating scripts which might help out. Also you can’t really stop exploiters from firing remotes.

#27

what is a “nil parent”?

30 characters

#28

If you don’t script.parent = nil it will be a lot harder for exploiters to find your scripts

#29

Do you mean make the script parented to nil so I can hide my key? Or something also can you explain what you mean by obfuscating the script.

#30

Yes you can hide your script, a capable exploiter will be able to find it but it will be harder. Obfuscating is a technique of jumbling up a script so it’s hard to read just search Roblox obfuscator and you put your script in and it does that and it will be very hard to figure out what it means. I can give you a link to one when I get on my pc.

#31

Also this might be helpful if you want to hide your remotes Remote Objects Parented To Nil Never Fire - #3 by Dummiez

#32

After I fire it how do I retrieve it to fire it again?

#33

It will throw off some exploiters who just expect everything in the game to have an appropriate parent, but they can run getnilinstances() on the client to retrieve anything with a nil parent.

#34

you can’t entirely stop exploiters but you can throw off most of them

#35

to fire it you just run the function like foo() and it will fire your remote event if you have any other questions feel free to ask. If it helped mark it as a solution so others can find it.

local ReplicatedStorage = game:GetService("ReplicatedStorage")
local RemoteEvent = ReplicatedStorage.RemoteEvent

local function foo(data)
	RemoteEvent.Parent = ReplicatedStorage
	RemoteEvent:FireServer(data)
	RemoteEvent.Parent = nil
end

RemoteEvent.Parent = nil
#36

That method isn’t caught by namecall, but it is still dumb idea to prevent exploiters from abusing remotes.

#37

This is a myth. All modern place stealers and related tooling save the instances with no parent. No exceptions.

#40

can they get the object of other players from their memory? i mean it is not the UserId what is prepended as first argument to remotes, but the instance of class Player