Securing events | Anti event exploit

What are you working on currently?
working again on a system that prevents from firing events.
How does this exacly work?
local script that checks if its fired by itself or not and if it does then it punishes the exploiter
How can it prevent from the exploiter bypassing this?
there is both an event and a anti exploit (released) that checks if player has a humanoidrootpart
if player has a part in his character then it deletes it to get him kicked (since it replicates)
else it will use every other way possible to kick him out of the game.
**It will also have a countdown to a event from firing (server with client together work) to keep the player updated if he exploits to delete the event in case
also if there is no data sent back while script is active then it will punish the exploiter instantly.
Released anti cheat for humanoid root part

game.Players.PlayerAdded:Connect(function(Player)
	Player.CharacterAdded:Connect(function(Character)
		print("Started checks") -- Use in case script errors
		Character.ChildRemoved:Connect(function(Child)
			if Child.Name == "HumanoidRootPart" then	
			wait(0.05) -- Delay if player fell in void so it doesnt detect falsely
			if	Character.Humanoid.Health ~= 0 then
		Player:Kick("YourKickMessageForDecetion")
				end		
				end
end)
end)
end)

Little note that this is copied from myself when replying to someone so it might have instructions
When will the actual anti event exploit will be released
dont know yet. i need to make sure it works and is made
this is simply testing for now.
Do you think anything of this wil relate to a bypass or a bug tell me on the poll or below

Any bypasses?
  • I dont see any type of bypass
  • there is for sure a bypass
  • i feel like there is a bypass

0 voters

2 Likes

Exploiters can easily modify the script as they like and kicking on the client is just useless as they can catch that event and return

1 Like

this is just in case they forget to activate anti kick on client is the use of that
but also they will be teleported if both of those 2 things dont work
also to replicate so they cant spoof it the humanoidrootpart will be deleted (replicated) so the server will check on the humanoidrootpart and kick them. also this includes crashing and more with the client. (with new script spawning)
also please note that the code will be obfucated so exploiters cant crack it.

also this use is to make client anti cheats to become real

why would you obfucate code? , it’s funny how you think “exploiters can’t crack it”. furthermore they can still see the kick method so it would be futile.

they cant see the kick method but they can change it.

no, they can see the kick method and yield it

1 Like

You’re not going to make client anti cheats real if this is the extent of your knowledge on the subject. I don’t mean to be rude, but what makes you think you know something that those of us with more than a decade of experience don’t know?

Exploiters don’t see any code, obfuscated or otherwise. They instead see bytecode. Just hexadecimal. Your script is compiled into a completely unreadable format and they need to decompile it which is frankly pretty easy. Just takes a little bit of time. All that your obfuscation does is ruin your script’s performance and ability to be debugged.

They have full control over their own client. Full control. Not just over scripts. They can disable the Kick function, they can intercept and block RemoteEvents, and they can re-write your scripts to send ‘all clear’ signals to the server. You can’t stop them from doing anything, period.

You’re going to be spending a bunch of time coming up with bandaids to fix each new hack they come up with, and you still need to add proper server-sided security unless you actually want your game to be hacked. At a certain point, you’re spending more time patching little leaks in your increasingly inefficient anti-hack LocalScript and maintaining your server security than you are making your game popular enough for hackers to even be an issue.

Set up proper server-sided security because you’ll always need that. Tailor it to your game for maximum water-tightness. Do it while you develop your game. If any little hacks pop up, you can patch them with your LocalScript while you think of a good way to update the server-sided security.

Lastly, remember that some hacks may need to be allowed. I’ve seen people on the forums freak out when they learned that a hacker can delete their own GUIs. So what? He’s only hurting himself. And if a hacker tells you to play the swimming animation when they’re clearly just walking, maybe just let it go through. It’s an obscure hack, it probably doesn’t give them any benefits, and generally in situations like this the fad will pass. Trying to check for every little thing is going to be a nightmare to maintain and could potentially be pretty inefficient.

I don’t see the point of this. They can just easily remove the script if it’s client side so it makes no sense. Sure someone could forget or not in general do it but it would be super easy to create an exploit code that will auto delete the script to bypass it.

the script is deleted by it self making it run and they cant do anything about it.
(disabling it just wont work)

my plan wasnt to make a anti cheat for client but that doesnt mean you cant make with this method

they can decoplite local scripts which gives out the code so they can crack it so they can.

as i said those are to block any sending bypasses perhaps they forget to disable.
and with that i found a method that cant be stopped due to local replication
as i wont say because this would crack the code completely.

bad idea server cannot handle too much as a client does.
viewing other players , esp (if possible) , client value changes (ex. lighting)

no exploits are allowed on roblox no matter how dangerous they are or not. they break the TOS.

also if the code cant be cracked then this is fully successful
since ive seen no bypasses unless you talk to actived anti kicks for local. which are meant to kick the player if he forgets to use the anti kick but either way there is no point because the other methods will kick them anyway.

not to mention you only say bypasses for the client side which is meant for forgetting to activate the anti client side but the replicated side is still something i havent seen.

they can of course find out they are being kicked on local side and patch that but the code itself cant be cracked.

really doesnt change the fact that it does work though
obfucation codes run on diffrent requirements and thats why
it still wont mean it wont work.