As someone who spent a considerable amount of time making and improving client-sided anticheats (still the best open source anti-cheat), I can tell you that none of this is new.
- Script Detection - This was found in 2021-2022 and worked on every executor, Synapse included, it worked like this:
- Store the current instance count (
Stats.InstanceCount) - Create a game.DescendantAdded & game.DescendantRemoving connection, in which you listen for (local/module)scripts
- Wait for a spike in Script memory (
Stats:GetMemoryUsageMbForTag(Enum.DeveloperMemoryTag.Script)) - When a spike occurs and no scripts were inserted into the DataModel, compare the new and old instance count
- If the instance count increased, flag the player
Why did this work? Because executors like Synapse had to somehow populate the script field, and they did that by creating a new script inside nil, we detect the new script with Stats.InstanceCount and script execution via the memory spike, to prevent false positives we don’t flag the player if a script was recently inserted (or removed) into the DataModel
- " In-Game Detection Trigger Delay" - Been used in other anticheats for years, most notiably in the clanning genre
-
UserInputService.GetFocusedTextBox… that’s it…
- Hiding the script (“With custom sandboxing techniques, hiding itself,”)
- I’m not too sure if this has been already released on devforums but this is well known in the exploiting community.
- If anyone is interested in replicating this, i’ll give some hints: Garbage collection & References
As for your other detections, your friend was using Solara (first of all, a stupid idea as Solara is ratted) which isn’t exactly known for it’s undetected scripting environment, for example it’s Drawing library is made purely in lua, and as you can guess it’s made out of the same Frames, ScreenGuis, TextLabels that you use to develop your own games. And the other detections can be just faked, like how are we supposed to know that the anti-cheat broke the script and not you removing sections of code? Even if it’s former it’s still nothing special