When someone injects an exploit to a game the exploit it injects as a local script but where does the script inject to? i tried injecting - print(script.Parent.Name) and some other stuff like it and it prints out "nil
" couldn’t find where it injects to.I’m just trying to detect if someone injected a script or not.Or am i asking a really dumb question? if so I’m sorry I don’t know much about exploits/injecting and how they work.
1 Like
They can edit anything that’s on the client, there is no way to stop them from doing that. The best you can do is to not trust client and make your game critical code run on the server.
5 Likes
alright understood thanks for the help!
1 Like
What BenMactavsin said is correct, but here’s some more information.
The object browser and everything in it (and the folder system on your PC) are not real. There can be things in the game or on your hard drive that don’t show up. They have a location in memory or a location on the hard drive because there has to be an address to retrieve it. But what they don’t need to have is a corresponding object in a file system or object browser. The file system more or less says ‘this folder here contains these files here at these addresses.’ Depending on the exploit, it likely won’t even create an object that can be recognized by Roblox’s file system. In Roblox, beginner scripters have sometimes assumed that when an object’s parent is nil, it goes to a place called nil where everything else with a nil parent is kept. That’s not the case though. If its parent is nil, then it exists without being in the object tree, without being anywhere.
Scripts can run without being in a Script object because there is a lot more to a program than what the object browser will show you. Even if someone were to use a script, they could put it almost anywhere. LocalScripts will run in Character, PlayerGui, PlayerScripts, any of their tools, CoreGui, maybe a few more. That’s if they’re inserting an object, but that’s rare anymore.
Anything that you can see in a LocalScript or can be controlled by one (Character, GUIs, RemoteEvents/Functions) can be exploited. That’s why, even though TeleportService works in a LocalScript, it will only teleport the current player. It’s security against someone teleporting everyone. When you use RemoteEvents, don’t trust what the client sends over. Keep their bank account on the server, and when they make money check to see if it is legitimate or almost legitimate. Don’t authorize a 100,000 dollar increase. When they buy something, don’t give them the object because they said they have enough. Go to the bank in a server-sided Script and double-check. This is why you can use Inspect Element to change how many Robux you have, but when you refresh it resets. Roblox knows how much you have on their servers.
9 Likes
When you inject an exploit, a local script is created and it’s parent is set to nil by default.
When you call Instance:Destroy() it basically sets the parent of the instance and it’s descendants to nil, so its impossible to delete the local script that has been created by an exploit since even if you could reference the local script that has been created by the exploiting software, you wouldn’t be able to completely delete it.
Hope you understood!
1 Like
Depends which one is used. From what I’ve seen there 2 different groups.
- Script parented to nil, is able to parent it inside the game too
- Script running in a separate VM (wrapper)
1 Like
I don’t think this takes a rocket scientist to answer this but… it injects to the Roblox Client…
1 Like
yeah but my question was where in the roblox client. I’ve already gotten the answer which is nowhere but somewhere since you can’t just find it because the parent is set to nil so its not technically in the game so yeah.
As said, it’s nowhere. They inject it into memory, not the client.
That’s somewhat my understanding I guess.
Local scripts (client-sided stuff)
It injects a DLL file into Roblox and from there it can do anything. It runs code by making a LocalScript parented to nil so other scripts cant see it. They also have custom script environments too.
1 Like
I know this post is 2yrs old but it’s stunning how some people feel smart after replying to a post they clearly didn’t bother to properly read. Have a good day
3 Likes