Would obfuscating my local scripts and modules prevent exploiters

[staandz]

If i obfuscate my local scripts and module scripts and add a security check to check if the Place ID is matched to my game in the obfuscated script, would i stop any exploiters from stealing and reviewing my modules and local scripts?

[batteryday]

no

[IndeedMythical (mrswagmoney64290)]

im pretty sure roblox doesn’t allow obfuscated scripts, even if they do allow it they strongly hate it

[psykoz]

Obfuscation can significantly degrade script performance, leading to a poorer user experience due to increased complexity and processing time.

The Place ID will work but the obfuscation is completely useless.

[ReadyHappiness (KanyeWest)]

@psykoz

Obfuscation can significantly degrade script performance

This is only true if you add extra code to your script to “obfuscate it more”.

Before running your game’s code, Roblox compiles it into bytecode. This is an obfuscated version of your source code that is harder for a human to understand, but easier for a computer.

When Roblox turns your code into bytecode, all:

• Variable names
• Function argument names (Function names are kept)
• Comments
• Luau type annotations

Are removed or obfuscated.

Bytecode does keep things like function names and line numbers, but it’s a lot better to keep them because without them, it becomes a lot harder to debug errors in production because Roblox can’t give you good information about where or how they happened.

@staandz

If i obfuscate my local scripts and module scripts […] would i stop any exploiters from stealing and reviewing my modules and local scripts?

Hackers can’t see your source code, only the bytecode it’s compiled into. Special tools called decompilers can convert this back into code, but can’t bring back things like variable names and comments.

@staandz

and add a security check to check if the Place ID is matched to my game

A good rule of thumb when writing code is to never trust the client. While hackers can’t see your source code, they can still read and modify the bytecode. Because of this, in general checks in a localscript are pointless because it’s easy for an exploiter to remove it.

I suggest reading this if you want to understand more about what exploiters can and can’t do in your game:

A Guide to Making Proper Anti-Exploits

Hello, I am Reapimus! Today I am making this guide to the proper way of making an anti-exploit, because far too often on the developer forum I am seeing so many people giving poor anti-exploit advice or trying to make ones that simply won’t work, and I am hoping that by making this guide, more people will learn and know how to make an effective, and proper anti-exploit for their games. So with that introduction out of the way, lets start with this guide! What is an Exploit? To start off with,…

[psykoz]

@ReadyHappiness

This is only true if you add extra code to your script to “obfuscate it more”.

Before running your game’s code, Roblox compiles it into bytecode. This is an obfuscated version of your source code that is harder for a human to understand, but easier for a computer.

When Roblox turns your code into bytecode, all:

• Variable names
• Function argument names (Function names are kept)
• Comments
• Luau type annotations

Are removed or obfuscated.

Bytecode does keep things like function names and line numbers, but it’s a lot better to keep them because without them, it becomes a lot harder to debug errors in production because Roblox can’t give you good information about where or how they happened.

My statement, “Obfuscation can significantly degrade script performance,” followed by yours, "This is only true if you add extra code to your script to ‘obfuscate it more’ is wrong! The main performance issue with obfuscation lies in how the obfuscation itself is implemented. If the obfuscation adds significant complexity or additional layers of computation.

There is a trade-off between the level of obfuscation (and hence security) and performance. Higher levels of obfuscation typically result in more significant performance decreases.
The weaker your security, the better your performance.
The stronger your security, the slower your performance.

[ReadyHappiness (KanyeWest)]

@psykoz

The main performance issue with obfuscation lies in how the obfuscation itself is implemented. If the obfuscation adds significant complexity or additional layers of computation.

This is what I meant by “adding extra code”

[collector]

This is a problem you should not worry about unless someone is actually doing an attack in this way

[psykoz]

@ReadyHappiness

This is what I meant by “adding extra code”

But if you’re not adding extracode, your obfuscation stinks, and it still is slower than it would be due to, guess what, Mr. Sherlock, higher complexity!

[AkiScript (Akiisqt)]

Obfuscating your code is just changing the language slightly, to truly prevent exploiters you need to improve your coding practices. Unprotected remotes will always be unprotected if you don’t protect them!