How to Secure your Game Against Exploiters

[@AxmPlays]

I am a former exploiter and own synapse. Most exploiters are children so you only need to really worry about speed and fly hacks, however, there are more experienced exploiters that can manipulate remotes and network ownership which will completely ruin your game. Thanks for publishing this video because I myself did not know about the network ownership one.

[@MarxismOfficial]

s

[@OggySpelar]

it is true most exploiters are script kiddies

[@billybobjankens12]

I also own a couple of exploits including Synapse X (sadly my router blocked it :sad_face:) and I know about network ownership and how it works. I don't know how an exploiter would forget about part:SetNetworkOwner(nil) because devs use that alot.

[@pato_do_lago]

Ye that's what I was thinking, but maybe it's better to make a strong anti-cheat because experienced exploiters will eventually get in your game.

[@BennydoesstuffYT]

Ur cringe 😂

[@MrYEETman9820]

In my experience a solid portion of exploiters are teens/adults with depressing lives who waste their disposable income gaining unfair advantages over children because it gives them some semblance of control and power in their worthless lives. The reason I know this is because I was there once when I was 18-20 and I am still in many of their communities on Discord. NEVER underestimate the passion of greed and toxicity behind the exploit community. Imagine your defensive layers around your game are like a cheese grater, and the exploits are the cheese. No matter how small you make those holes in the defense, the exploiters will tirelessly work towards squeezing through the cracks and microscopic holes. Never stop updating your game, and always stay in the loop and keep up with exploit communities. Stay safe gamers, peace.

[@Official_uoi5553_Channel]

Wow you motivated me to secure my scripts even more now. Danke!

[@40kq]

A majority of exploiters who do script their own stuff and know what they're doing are definitely an older audience (Older teens to adults). They also make up like 0.1% of the general roblox exploiting community as a whole. Although a huge number of them are not living depressing lives at all. Often times we just exploited because we liked trolling. Another thing to note is a lot of games player bases are entirely built upon exploiters. For example Fencing, Dollhouse Roleplay, Twisted Murderer, Jailbreak, Etc. I primarily scripted because it was a fun way to see how roblox's engine works and how to exploit that. I totally agree that exploiters will find any little thing to exploit and bring destruction to any game. I quit exploiting earlier this year due to personal reasons and of-course, the upbringing of byfron.

[@PogoDigitalism]

Experienced coder here, great way of explaining a not all too easy subject for learners in a funny story. Keep it up

[@40kq]

I totally agree, he turned this scenario from a big and scary thing into a simple and easy thing. I hope I start seeing less of these remote vulnerabilities in good games.

[@wouf_]

It’s kinda the most easy type of anticheat to make I’ve ever seen lmao and it never was hard to do something like that tf ?

[@_Sickk]

You mean scripting?

[@wouf_]

@@_Sickk scripting = coding in this case

[@doncomputer5931]

Exploiters are easy to deal with when I am in the game, I just delete them from the game and run a script on the server that will constantly check if they are in game and delete them from it, But if I am not in the game, Those filthy exploiters can get into mischief. This tutorial was useful for child-proofing my games from the fifthly darn kids who try to exploit.

[@LogoDev]

It's good to note that you can actually throw in dummy args in your remotes. Catches a LOT of people. E.G. Instead of completely removing the item price argument here, we could catch exploiters by keeping it, and comparing it to the itemPrices table. If the price isn't the same, then obviously, someone messed with the remotes. Little things like this add up a LOT. In one of my games, I caught a few people just by letting them think they could manipulate the force behind knockback. And, as the game gets more complex, the anticheat becomes easier to bypass. Be prepared to look through a lot of randomly released scripts when you make a release! Note: Exploiters will happen. Don't spend too long fighting them, your game's release is more important!

[@unded1827]

Now im curious what you did with those exploiters.

[@rumory]

once you catch them you can do whatever you want until you ban them...

[@yesil_hiyar7335]

this is a minor inconvenience for whoever is trying to exploit in your game - to be honest i dont think this is a good idea as you'd have to actively update 2 scripts and one mistake in one could cause your some of your playerbase to be flagged - in my opinion its never right to kick the cheater as to restricting their access.

[@LogoDev]

@@yesil_hiyar7335 I mean, I'd never kick an exploiter either. Also, it may be a minor inconvenience but it has always flagged hundreds of exploiters on my end.

[@yesil_hiyar7335]

@@LogoDev that’s fair enough but it just seems like it’d be more messy to send dummy arguments

[@realtitedog]

I'm glad you made this video for people who don't really know how exploiting works. I used to not understand but once I started using exploits in my own game I realized that a lot of my games were insecure and had remotes that could manipulate datastores, spawn admin-only items, etc.

[@flowckey]

He forgot to talk about teleporting

[@flowckey]

And spawning instances on client

[@Blade3337R]

@@flowckey well the anti speed cheat part of the script easily removes teleporting off the list, and if you do spawn instances on the client side, the server wont count it because the script is server-side. sorry that im responding after 2 weeks.

[@flowckey]

@@Blade3337R I do believe that spawning instances on client would be counted as in Jail Break but I think the falling mechanism would take that in charge. No worries, I also don't check my notifications often.

[@Dadwar_Real]

you have outdone yourself once again, while most "hackers" are just script kiddies there are a few you gotta worry about so this video of yours is perfect to make games safer while also teaching new coders how it happens in the first place, well done and great job, keep it up.

[@fitmotheyap]

Yeah, as someone who has never touched roblox studio and exploiting it's interesting

[@uzidayo]

Yeah all it takes is one experienced programmer to reverse engineer your game and release a script for the masses

[@_pengwin]

These do work, but the floating check will flag on high ping players, yes you can whitelist that but then cheaters can use blink to hold network packets, another problem is if the player's game is like tower of hell, falling down will flag, vehicles will flag it. There is also a very knew method that it overpowered, but I won't mention it as most regular exploiters don't have access to this method.

[@40kq]

Simple way to check to see if someone is falling or not! VELOCITY and CFRAMES! Both on the Y axis. Check if they are floating using racyast and then time that. If they're hovering over a part longer than a couple seconds and their velocity behavior is acting off then kick them for suspicious client behavior.

[@_pengwin]

@@40kq hey that means i place a high down velocity and teleport boom or tween.

[@RosemaryWebs]

bookmarking for later on in my development; thank ya for pointing these things out! i had a relative grip on how speed/fly exploitation prevention worked, but never knew about Network Ownership and such. genuinely helpful, dude!

[@40kq]

Network ownership manipulation is pretty much patched for the most part.

[@VileKronecker]

Your tutorials that go over various aspects of lua scripting are the most helpful that I could find and I've learned a lot through your previous tutorials to where I am confident that I could start a little project with the knowledge I have gathered. Thank you so much.

[@GnomeCode]

Thank you, that's great to hear. Best of luck with your future developing!

[@VileKronecker]

@@GnomeCode Thanks! I will keep the luck with me!

[@7cogj]

you make the best development content gnomecode!

[@Kallax2]

there is suphi kaner too that does in depths tutorials. You should totally check it out

[@ThatBoringDeveloper]

As a former member of rblx modding & exploiting community with the roles of “pen tester” traditional exploits can be very dangerous but a lot of traditional exploiters that manipulate the client are “script kiddies” with either no or very little knowledge of lua and how the environment works when unloaded or loaded/running, more experienced exploiters tend to exploit things like back doors (despite back doors not being considered exploits under Roblox’s TOS we will refer to them as exploits), backdoors can’t be very harmful too a game for reasons that likely don’t need to be explained

[@chanzeyuan]

I develop hack clients as a way of learning (not distributing) and although I sometimes use it in some games to check if it works, I send it to the game owners once I'm done with it to get it patched.

[@TheMaxGuy]

one of the few cases where i'm okay with exploiting

[@40kq]

It's okay to admit that you just make Ui and use public API's. We all know you don't know how to properly construct an actual executor.

[@b2hots]

You're a real one.

[@Smurfis]

As someone that has been building a game, this system is absolutely amazing as a case study and something to build upon and I am highly supportive of this video except for in the case of reverse engineering. Wouldn’t it be better to host this in a module and pass a script to the player so then if they remove it you can import it again with a small loop and a check?

[@paulstrobeck8947]

Hey, I have a tip for you Gnome: when making functions and declaring variables, use a colon to set its data type. That way, the autocorrect works.

[@Rizzzzzzzzzzzzzzzzzzzzzzzzzzzz]

I really wish he would make a seried expanding on this anti-cheat system, id love to hang around and learn more about it and also create one along the way

[@nopfp416]

you can create 2 new positions and ignore the y value in the speed check completely like local v1 = Vector3.new(root.Position.X,0,root.Position.Z) local v2 = Vector3.new(lpos.Position.X,0,lpos.Position.Z) And get the distance with those (this will fix the spikes in speed when jumping/falling and allows for lower walkspeed detection)

[@5rolledupinacan]

i make literal games out of these tutorials, really helpful, i can understand it alot, fun to watch, all of the code actually works.

[@NorbYyY_GG]

billy mc'mischief is a piece of work

[@tboleon]

im interested in game development and i didnt want to start coding it and working on models etc without knowing it was secure first, thank you for your video

[@refraysmusic]

For the anti-speed part. One way to make jumping not affect the speed is to calculate the distance between the two positions, but using only the X and Z coordinates, and not the Y. You can do this using the good ol distance formula from Algebra class :P The distance formula calculates the distance between 2 points on an X,Y plane, but you can treat an X,Z plane the same way.

[@Oyo-d4z]

I think i recommend adding a warning system to count like 5 times, if they are caught more than that they get kicked

[@vintagedegenerate]

FYI for newcomers: Enum.RaycastFilterType has changed: Replace Blacklist with Exclude, and Whitelist with Include.

[@АртёмДолгоруков-ж3ш]

About Anti "fly". If player froze client or get lag spike, he/she will tagged as cheater

[@alexskorpik11play79]

I mean , we dont want tab glitchers

[@creationsdolly]

yeah. plus, roblox is not exactly notorious for having great server connections. i think the best solution would be to not serve any bans for it, but rather save the position where they last made contact with the ground and if it goes over that 3 second buffer then set them back to the ground.

[@PioVerdi28]

Hello gnomecode! Currently at tower defense serie, ur tutorials are so good! Keep it up!

[@madbliss9238]

*Lumber tycoon owner taking notes*

[@Baburun-Sama]

Byfron Update seems made this Tutorial High-Priority

[@plasmatic1440]

I have a request for a series what about a game similar to Pokémon because most games get banned so a customized theme similar to Pokémon?

[@CreatorProductionsOriginal]

Let’s say your game had something that changed the player’s walkspeed, in that case, you shouldn’t increase the max speed, but instead adapt it into the code, to check if that player has that thingy that changes their speed, correct?

[@TheRealJ1]

like how doors does it. yes.

[@furchad3574]

How to secure your game against exploiters Make the game a “exploit simulator” with a built in “exploit” which mimics most actual exploits so everyone is always at equal starting level

[@ag_youtube14]

Thanks gnome code! I'm working on a SCP horror game with acp's! I'm still working on it. I hope it's good!

[@noobikgaming6452]

Gnomecode is the real legend that will always make us happy :)

[@jasoncebereros2057]

this is still exploitable since you use :getcharacter and use primary parts, the exploiter can touch it then immediantly delete their humanoidrootpart (primarypart) or set the primarypart of their character to nil which will completely break your script

[@jasoncebereros2057]

also you could do player:CharacterAppearanceLoaded to wait until the player character loads

[@jasoncebereros2057]

AND the anti-speed can still be exploitable since there are certain exploits that detach your hmr and replace it with a fake one that still allows your character to move then it slowly brings the hmr towards it kinda like a lag-back

[@bolekinds]

didn't roblox add an option where deleting any parts of your character would not register to the server? that would be useful to include in the video, since the thing you just said would not work anymore

[@jasoncebereros2057]

@@bolekinds no, since its your character you can control it delete any of your bodyparts and such and will replicate to the server since you own your character all of the time until you die, and no detaching your rootjoint wont kill you

[@XaneMyers]

@@bolekinds I'm not sure what that change did, but I do know that "invis-flinging" was patched sometime recently by Roblox. Try it and the spinning brick doesn't spin and just…falls to the floor.

[@AlexDavidson-pm5qc]

also one way they can do something is trough grabbing themselves and going lightspeed since they are always network ownership of themselves

[@dhaloi]

damn you Billy McMischief!

[@abadgurl2010]

Billy McMischief is the hero I never knew I needed, lol. Too bad I'm on mobile and can't do anything he did.

[@abadgurl2010]

If I could I would just 100% the American Girl event game because I swear some of those Doll Stars aren't even placed into the world yet so it's literally impossible to find them all to get the badge for doing so. Plus the in-game clothes are cute and I want more despite not getting to have them outside of the game.

[@Sewbetan]

well uhm actually there are mobile exploits 🤓

[@b2hots]

Those 30 dislikes are from exploiters lmao

[@adrianos76rbx]

I was doing an anticheat for my game today ima add some of this thx gnome!!!

[@Profeshinal]

Woah teaching people how to script and teaching people how to defend their games from scripters, never thought I’d see such luxury

[@b4con321]

pov: u tp 2 times at 0.1 delay and u get teleported back where u actually wanted to tp or the anticheat just has an delay so u still can grab all coins XD

[@Nebula_Protogen752]

Imma add Billy Mischief to my game lmao

[@justmrkoala]

a good punishment would be after u tp them back to the good pos then there will increase a value called warning and then if they have 3 warnings and do it again you ban them

[@XaneMyers]

I think increasing the number of warnings (to 5 or something) would be a good idea, in case there are any false positives. I've read about a genius way to punish players on the DevForum; After an exploiter sets off the anti-cheat enough times, rather than banning them (since they can easily return on an alt. account), instead mess with them. Add random delays to remote events, disable collisions at random, and make their experience frustrating. 😈

[@alexskorpik11play79]

@@XaneMyers i mean, delayed remote events, and collisions are client sided, unless the collisions are for a single player game, which then can still be avoided by just turning it back on constantly So like, yeaaaaaaaaaa

[@HaileyStudios1213]

Thanks man this helped in my doors recreation you made a tutorial for :)

[@MinkSquared]

something i always do is sorta double check, once on the server, once on the client. its a pretty efficient way to weed out basic script kiddies

[@theofficiaIsteve]

"casually gives a descriptions for exploiters to debunk"

[@MajesticUC]

For the speed check, surely you could just ignore the y axis when checking the distance moved. You do DistanceMoved = (Vector3.new(lastposition.x, 0, lastposition.z - Vector3.new(root.position.x, 0, root.position.z)).magnitude?

[@BunnyMasterRBLX]

the doors tutorial: imma go get some milk real quick

[@GigaGnome]

Thanks. Not like I have players in my game for there to be hackers though.

[@thesovereigngentleman2336]

I'm just commenting for the algorithm. Another great video!

[@GnomeCode]

Thanks for that!

[@krielol2743]

the only issue here is that you used a raycast continuously on the server which can be expensive, a much easier way is Humanoid.FloorMaterial == Enum.Material.Air

[@minecraftperson8412]

Imagine writing certain code so that if some kid uses speed hack scripts, he gets a cinematic cutscene shown to the whole server that he cheated and that he's bad at cheating, blows him up and then bans him permanently. Not too good with code so dunno if it's possible.

[@X_Fire_fox_ff_D]

more then possible >:D

[@minecraftperson8412]

@@X_Fire_fox_ff_D hell yeah

[@boogs7190]

You can simplify this by just checking the humanoids floor material instead of raycasting, if it ~= air then they are touching the ground.

[@alidoesvideos]

But what about if they are jumping

[@sesocell]

When falling speed is going to like 200-300

[@andreyromashchenko8967]

Sounds like a good anticheat will slow down even the simplest game for the whole server.

[@silvianizzolini816]

Is the DOORS Tutorial abandoned?

[@kaiomarmoldamasio5548]

Series ideia: How to make a my restaurant game

[@MindsetWorld1422]

Thanks for the tutorial keep up the good work love your vids man

[@thathistorykaiser]

Hello GnomeCode! I really appreciate all the resources that you've provided to us, and it's definitely helping me become more of a seasoned developer, but I wanted to ask about an issue that comes with the AntiExploit. All the tutorials from this series have gone into one game I have made where I test and store these scripts for reference in future projects. In the video "The Dark Arts of Troubleshooting," you go over fixing and explaining out the process of finding and troubleshooting errors within a trampoline script. Well with that same trampoline, I am testing the AIR TIME feature and have found that I am getting rubber banded to my originalGoodPosition. If there is any way that I could overcome this, then I would greatly appreciate it as I am still learning and do not have a solution yet for on-the-spot problems. Thank you!

[@eee_eee]

alternative title : how to not become prison life

[@stavros222]

Thats accurate. This game suffers

[@goofyahhhhbubba]

As a noob dev, I ain't even put any arguments in my remotes, so I'm totaly safe 😎

[@Funnis_stuffOFFICIAL]

can you make some sort of ai that grabs you and damages you? (comes with a animaton) i want a ai like that for a zombie game like biting zombies or whatever

[@mobilepro9263]

I clicked on the video as soon as I saw it thank you

[@AIO0110]

NOOO!!! Billy!! you was suppossed to be the good kid who always does not use /e claim On every roblox marketplace ítem!!!

[@NeedToDev]

That's awesome. Thank you for informing me about the network owner stuff, didn't know that, will certainly be useful!

[@caz0gamz]

I saw someone talk about this on your discord server. And you even responded. I wonder if that’s why you made the video

[@EliSky09]

Yet again gnomecode knows just what we need at the right time, thanks gnomecode :) (I actually really needed this so thanks)

[@thomasdixon6476]

I'll definitely use this video, but can you also make a video on console compatibility please. If not do you know any videos that would help me.

[@timme_]

Thank you this is pretty useful keep up the work.

[@ajusy1884]

Yessss I needed this

[@mrSEEK_official]

how to wait for doors episode 8: just wait until gnomecode feels like it

[@NYANDAKKE]

Oh, my head hurts😵‍💫

[@stewabletv3022]

Exploits work via a script being injected into the remote control system. Clients like krnal use this

[@fmczmc4869]

i use a custom system called CID and CMSG. cid just stands for client id, and cmsg is custom message.

[@420a.]

interesting... thank you for your tutorials, they helped me alot.

[@GnomeCode]

Cheers!

[@Ashthenotskilled]

@@GnomeCode can you put in the description the antiexploit code mine doesnt seem to be working

[@SBSagas]

As a experienced exploiter and I own Script-Ware and Synapse. If you can't bypass ws or fly then you can just make a PathfindingService robot that will walk to the gold and avoid the zombies It's not that hard to do. Or ESP

[@XaneMyers]

Or use a tween to forcibly move the player through walls to each collectible. I've noticed (through script videos) that games that have teleport/walk speed anti-cheat scripts cause exploit script writers to use tweens instead to slide through the air.

[@TheMaxGuy]

another way you can replicate exploits with studio is using the command bar (in view tab)

[@xxbluefangxx1927]

Thank you so much for this video! I was so tired of these dumb gen alpha kids who think they're pro hackers or something trying to cheat in my game. It was so annoying! Thank you for helping me fix this :)!!!!!!!

[@piedoge5976]

It's unlikely that people will be hacking in your game, especially if its a singleplayer game since if its a multiplayer game, their probably gonna ruin the other peoples times, so basically to sum it up, if your game is a singleplayer game, your probably fine, if its a multiplayer game then probably just up the security a bit.

[@phantomfills3833]

You can set the player's network ownership to nil to make it server-owned and more difficult to move

[@chibisayori20]

For server-owned player character, does the client send movement data to the server? If so would it be possible to tween the character or have a fake-simulated client character that lerps with the server-character and have the actual player character be a invisible part?

[@alexskorpik11play79]

@@chibisayori20 The client is only able to send W,A,S,D,Spacebar,etc movements, Anything other, like physics handling, is what server does. oh and server does the movement itself, Thats whatever it does

[@chibisayori20]

@@alexskorpik11play79 wait so it is server authoritive, it just roblox gives network ownership to the client so movement is smooth/there isn't delay when server checking physics, it just goes: oh, player moved, updating it's position to every client

[@alexskorpik11play79]

@@chibisayori20 let me explain: so its basiclly like client moved so it fires sort of a remote event [no it doesnt , im just lazy to dig into the client files] which tells the ser ver to update it, thats why sometimes players complain about hitbox, because theres a small delay between client and server updating. client handles physics,etc basiclly.

[@chibisayori20]

​@@alexskorpik11play79 if you force the network owner of the player's character to server, client can still move (since it sends input data after all) but will wait more because server needs to check if physics are correct, vs if it was client owned physics, then server doesn't do much validating. No idea about Hitboxes tho, thought those we're just .Touched events

[@IRWNum1]

Gnome code, are you still doing the Doors series, if so, can you add screech

[@pneum7932]

Gnome code!!!@ Love your tutorials man

[@sour2868]

I used to abuse network ownership so heavy most games never patched it

[@lord_nom_conquersall2093]

GnomeCode delivers!

[@ٴٴٴٴۥۥ]

cool one gnome!

[@bojjguppguy]

@GnomeCode I was just wondering are you done with the doors game

[@Chip95]

I know this is a big ask but could you make a video about redoing some of the tower Defense code as I cannot get past a certain part in the tutorial as the collision group code and body gyro keeps saying it is deprecated

[@henrickjamahsk908]

the fly anticheat would not work because there is a script that lets u fling people which would activate fly and speed anticheat

[@Alifkery]

Collab animation when

[@noblebuild2550]

Damn excellency as always

[@ThatOneRobloxDev]

there's also this app called: "Cheat Engine" which has the ability to change the memory address and quite literally write to the memory, replacing values. So this tutorial might not work for that level of hacking...

[@ThatOneRobloxDev]

@@10F2C I managed to use it with roblox :/

[@40kq]

Cheat engine is an oldschool cheat engine for many different game clients back in the day. All it does is show you memory addresses and allow you to change those memory addresses. Cheat engine works the same as any other roblox executor. Still client sided, probably has less capabilities than modern day executors too.

[@_Leafrin]

I strongly recommend putting this in the client, even though your script can be deleted, you're at risk of a false positive if your ping is bad.

[@geo_sailor]

client side anti-cheat can literally be deleted by exploiters

[@alexskorpik11play79]

@@geo_sailor he mentioned it in his comment btw

[@FellowNiko]

Things you should never add in your game: firing remotes from the client, instead you could use server scripts if you're using the playergui for example cuz you can make server scripts work like local scripts if they are placed inside startergui or inside the player instance, character or backpack.

[@betapacket]

16:25 why not use Humanoid.FloorMaterial ~= Enum.Material.Air for ground checks?

[@Moonzyss_]

there are ways to spoof floor material, but since most exploiters are skids they most likely wont know how to bypass it. if you want even more detection you can combine the raycast method and floor material in the video for more security, but it is slightly more tricky to do.

[@40kq]

@@Moonzyss_ As far as I am concerned, spoofing floormaterial has never been a big thing because they all got patched a long while ago.

[@DavidStefan-wt9le]

Hello, Little Timmy is wondering how to protect their game from Billy using a Speed Hack Bypass (EX. CFrame Speed)

[@giuyo]

Hi thanks I will try this soon

[@oranskiii]

Great video as normal man! 😀

[@templars44]

Curse you, Billy McMischief!

[@guywitha_sword]

this made me laugh too much

[@3dcreator737]

As an experienced roblox coder and former exploiter I agree fully with this video, This is probably one of the most accurate tutorials on yours clearly explained abusing remotes and pretty much everything. Because it's mainly the cause of remotevents which cause games to have vunerability.

[@ensarkrl]

Hey Gnome code , will you continue the Doors series?

[@HeyShattered]

I understand the speed anticheat but what if your game has some ability which lets you go like 100 s/ps? How will the script detect exploiters in that situation?

[@teenspider]

Hey that game looks fun! I wanna play it