How To Create an Anti-Cheat - List of Vulnerable and Abused Events (Updated January 2020)

send me DM so i can send you few menus

There is a github someone compiled a bunch of menus.

4 Likes

how would i get started making an AC with this? im lost

1 Like

Good evening!

As you have understood, protecting your scripts is essential in the protection against cheater.

To put it simply,

  1. You list the TriggerEvent of ALL your scrips. (your future blacklist)
  2. You modify the start of each event (your script security).
    Example: “esx_ambulancejob: revive” to “sa_253DZ56_fe_ambulancejob: revive”

If you do that and you use an automatic blacklisting system for users, you are giving them NO chance to use them.

Triggers from other scripts that are not on the server do not need to be added since you do not have them!

I advise you to opt for a securisation containing a code that you can easily replace with a text editor which has the option “replace all” and which can do it in all the resources at the same time.

Sometimes some script uses the triggerevent of other script.
Be careful when changing your event name, it could cause bugs. They ALL have to be changed.

Now !

It would be time to talk more concretely about the protection made to the NATIVE FUNCTION of GTA or FiveM!

This is a subject still very little developed yet essential!
You can buy the anti-cheat for $ 200 you will only get 50% protection, maybe 60% but not more.

All cheats can use the native functions of the game, that is to say, the spawn of weapon, vehicle, object, tp, noclip, explosions etc, etc …

The anti cheats will offer some solutions but are still able to be bypassed, like anti-blips, anti-spectate.

You will also have solutions like blacklists, weapon, vehicle, item but you can never blacklist everything, because you use cars, weapons etc …

A smart cheater will only have to give himself the weapons used on your server, vehicles also etc …

They can also mess up your server and make explosions and many more …

So gentlemen, you who have skills or notions that I do not have. How to protect its native functions which are the heart of the problem.

Thanks for reading me

You can keep track on the server what a player is allowed to spawn, own, have etc.

There’s server events like entityCreating, giveWeaponEvent, explosionEvent and more. In the end, you are able to catch 90% of cheaters using server events and “getter” natives - GetPlayerArmour, GetWeaponDamageModifier. There are even natives to check if a player is spectating someone else.

Links: https://runtime.fivem.net/doc/natives/, https://docs.fivem.net/docs/scripting-reference/events/server-events/ etc

Don’t forget to read this too How hackers can exploit your servers and what to do about it and gain insight through “anti cheat” code on Github

It takes some time to get an anti-cheat that works according to what you want (as every server is different), so buying an anti-cheat is a waste of money. Truly because as a server owner you must know how to code. Learning is the whole point of owning a server. You create the world you want your players to experience. Don’t limit yourself by using the creations of others. Also don’t start/have a server if you’re unwilling to learn.

I totally agree with you, but there is no topic, wiki or other documentation to properly understand these functions.

Could you explain to me how to protect its native functions in the game?
Is it like a TriggerEvent and you have to replace its name in every file that uses it?

For triggerevents, I know their function is to declare somewhere, so it’s easy to modify this.
But for the native functions it remains very vague for me.

If you have an example to give me or a full explanation I would love to learn how to protect its functions and share my protection if it is reliable and efficient :slight_smile:

1 Like

“TriggerServerEvent” Is what you need to be looking for and altering those events where they are declared and used. You can then obfuscate the triggers which will stop a lot more people being able to grab them and use them.

Hello !

“TriggerServerEvent” is not what i"m looking for, i want to catch “explosionEvent”, spawn car, spawn ped, spawn entity, spawn weapon, and all other function on troll menu who not on server script.

All of my are renamed and safe.
Thx

Checkout the fivem own server events wiki. There is example about explosionEvents/Entity creating ( spawn ped/ spawn car )
i don’t think there is a event for spawn weapon currently, you have to make your own client side script then if player gets a new weapon trigger a server event about it

Is it possible to blacklist events such as AttachEntityToEntity so only certain resources can use it?
Example:
Blacklist GiveWeaponToPed for everything except the vMenu Resource.

You might be able to by setting the global GiveWeaponToPed to null/nil

Thanks, I will try it out. Recently modders have just been abusing basic events in my server such as GiveWeaponToPed, SetEntityInvincible, CreatePed, FreezeEntityPosition, AddExplosion, ClearPedTasksImmediately, and AttachEntityToEntity.

Those are called natives, not events.

For some of them you can intercept them server side. For example the events giveWeaponEvent which is emitted when a player gives another player a weapon or explosionEvent for explosions.

They all have two parameters sender (self explanatory) and ev which is a JSON object with information about it.

See fivem/ServerGameState.cpp at 6f13235d01999779aa4220eede0abadaa49a6549 · citizenfx/fivem · GitHub

1 Like

Alright thanks, is there an example script on how to stop them? Also do you have any idea on how a modder was able to spawn LSIA on top of sandy shores today?

hi
please dm me

Don’t think about yourself, think about the community. Participate in the community by participating in this topic and discussion :slight_smile:

1 Like

it could be a good thing if you can not let players connect to your server IF they using any program in Windows, like these executors, exeption steam , fivem , gc, etc…

We as FiveM users cannot do that.

Why just don’t do access control on event ?
example :
triggerEvent → call server → check role right → return to event

1 Like