Scripting Helpers is winding down operations and is now read-only. More info→

How to protect local scripts from exploiters?

Asked by

Finty_james 269

3 years ago

I have tried to make an anti-cheat, but it never works. There was one thing I have always learned from this: Never Trust the client. So I decided to go into server and try to loop every millisecond to see if the local script was edited. Once I did, I proceeded to go into the client one more time to kick them. Plus the chat is never safe, because local scripts are used to create the chat. So if local scripts can be used by anyone, doesn't that mean that the chat isn't safe?

I don't think scripts can detect when they delete local scripts. BulletproofVast 1033 — 3y

depending on the anti-cheat, if its for something like speed or flying, you could just make it in a server script. BulletproofVast 1033 — 3y

But isnt that supposed to be determind on client? Because only the client can access the character. Finty_james 269 — 3y

uh ther r other ways to check speed besides looking at the value. for flying, you could check their position or see if they are floating/not falling. BulletproofVast 1033 — 3y

2 answers

Answered by

2_MMZ 1059

3 years ago

Edited 3 years ago

The best way to protect your LocalScript is to clone it, and put it in a safe section. Example: ReplicatedStorage. That LocalScript will be disabled. Next, you will need a regular script that's always enabled, and constantly checks if the LocalScript has been deleted. When that regular script detects that if it has been deleted, then it will clone the LocalScript that was in the safe section, and undisable it. That way, when the exploiter keeps deleting it, it will keep cloning itself.

Thanks for the alert! But Client-Sided Is important too, so what if they fire a remote function or remote event? Finty_james 269 — 3y

His game is in fact not safe, well at least if the exploiter knows what they're doing. Try to make anti-exploit scripts that check if they mess with any property locally and kick them out if you're dealing with exploiters. AntoninFearless 622 — 3y

Remember to never trust the client? Yea. But to do that We need to go to a local script to kick the player. Also, Does the selection service apply with scripts? Finty_james 269 — 3y

uh if they delet dat scrip first they can stil do hehe BulletproofVast 1033 — 3y

View all comments (5 more)

That's not really what "never trust the client" means. Client-sided anti-cheats are futile as exploiters can remove scripts. What it applies to is client-server communication: never trust the input from the client passed via remotes -- try to verify that the data is valid. Perform server-sided checks where necessary Rare_tendo 3000 — 3y

Can't you use the console to check things locally? Does exploiters use the dev console? Finty_james 269 — 3y

Exploiters do not have access to the developer console. The only way someone can access the developer console, is if they are invited to work on your game. They install software to hack ingame, which uses LocalScripts, and Remote Events. If you would like to solve this, I would recommend doing is, putting that same LocalScript inside of ReplicatedStorage. Make sure to have it disabled. 2_MMZ 1059 — 3y

Next, you'll want to make a script that constantly checks if the LocalScript has been deleted, and clones the ReplicatedStorage LocalScript to the same spot your other script was, and undisables it. That way, if the exploiter keeps trying to delete it, it'll clone itself. 2_MMZ 1059 — 3y

What about the event that inherit from Instance, Like if the parent is changed, if the hacker ever tries to that, we can kick them with using the player parameter through game.Players.PlayerAdded. Finty_james 269 — 3y

Answered by

NGC4637 602

2 years ago

Edited 2 years ago

you can try to put the local script in StarterPlayerScripts, name it something innocent like WelcomeScreen or just LocalScript.

then in ServerScriptService, put a script that has the following source:

game.Players.DescendantRemoving:Connect(function(descendant)
    if descendant.Parent.Parent:IsA("Player") and descendant:IsA("LocalScript") then
        local player = descendant.Parent.Parent
        player:Kick("adios") -- if you want to you can change the kick function to be anything you want to do to the player
    end
end)

How to protect local scripts from exploiters?

2 answers

Answer this question