Now before I start, let me just say, I know detecting exploits on the client is very unreliable and I should rely on sanity checks on the server blah blah blah blah blah, but I want to know how to detect spoofing, hooking functions, etc...
Before you comment, if it is something like this: "Exploit detection on the client is unreliable and you should rely on sanity checks on the server", don't even waste your time.
Now we may begin.
The exploiter could spoof the WalkSpeed - Many developers are unaware of spoofing with exploits. So i’m gonna explain it right now.
The exploiter has access to the games metatable. Now with that, you can actually spoof many returns. The exploiter could set the WalkSpeed to 20 but when a script indexes it, it will return 16. Here’s how they do it:
local mt = getrawmetatable(game) -- This gets the game's metatable
local oldindex = mt.__index -- This saves what it does normally when you index a property
setreadonly(mt,false) -- makes it so you can edit the games metatable
mt.__index = function(indexed,property) -- detects if a part is indexed (Referring to Humanoid.WalkSpeed)
if indexed == "Humanoid" and property == "WalkSpeed" then -- checks if the part indexed (Humanoid) is a humanoid and checks if the property is walkspeed
return 16 -- returns a fake value of 16
end
return oldindex(indexed,property) -- if the indexed isnt humanoid and the property isnt walkspeed then do what it does normally
end
setreadonly(mt,true) -- locks the metatable again
Another thing they can do is prevent a LocalPlayer:Kick() - Now this is another mistake people do, kicking on the client. As I just showed you, you can spoof anything really. That happens to also include calling functions on parts.
Here’s a simple antikick you can make within a minute:
local mt = getrawmetatable(game) -- This gets the game's metatable
local oldnc = mt.__namecall -- This saves what it does normally when you call a part's function
setreadonly(mt,false) -- makes it so you can edit the games metatable
local LocalPlayer = game:GetService("Players").LocalPlayer
mt.__namecall = function(self,...) -- detects if a part's function is called
local method = getnamecallmethod() -- gets the method that's called (Like :Kick or :FindFirstChild)
if method == "Kick" and self == LocalPlayer then -- checks if the function called is :Kick and its called on LocalPlayer (so it detects if its LocalPlayer:Kick())
return -- this will just return and do nothing (making it so the player actually doesn't get kicked)
end
return oldnc(self,...) -- if it isnt kicking the localplayer then it does what it casually does
end
setreadonly(mt,true) -- locks the metatable again
The only thing I can really think of is to do this (this prevents the second script):
local succ = pcall(function()
print(game.WalkSpeed)
end)
if succ then
--Kick player
end
Yes, I know there's no point in really doing this in the long run, but having something on the client can always annoy/bug the exploiters nevertheless.
If you know anything about how to detect/prevent this or can think of something that might be possible, please reply to this post.
Thanks again,
Bin_Latin

2 comments
Bruh you are just taking from this old thread from roblox dev forum : https://devforum.roblox.com/t/exploiters-and-how-they-spoof-stuff-in-your-own-game/695958/, Anyway there's simply no way of preventing it on the client side, you just simply can't its impossible, anything you do on the client will be bypassed, it might prevent some script kiddies, but not people that know what they are doing
Also those same script kiddies can get script from others on forum