How To Create an Anti-Cheat - List of Vulnerable and Abused Events (Updated January 2020)

That would temporarily work, but you should also fix the exploit itself to avoid people just triggering your new event name. Once you’ve made a fix, please share it with the resource creator as all these events are from public resources.

1 Like

if can inform me about how to config injection ban??

Do you have something for Server Crashers ?
And thanks for this awesome work ^^

Thanks will add that to my anti-cheat bot :slight_smile:

Hello, I was wondering if anyone had a good, reliable anti cheat. If so, please DM me about it, thanks.

1 Like

Going to use a bunch of these, Thanks! also guessing you don’t maintain this no more?

I do, but only if people send me new Lua menus or events.

send me DM so i can send you few menus

There is a github someone compiled a bunch of menus.

4 Likes

how would i get started making an AC with this? im lost

1 Like

Good evening!

As you have understood, protecting your scripts is essential in the protection against cheater.

To put it simply,

  1. You list the TriggerEvent of ALL your scrips. (your future blacklist)
  2. You modify the start of each event (your script security).
    Example: “esx_ambulancejob: revive” to “sa_253DZ56_fe_ambulancejob: revive”

If you do that and you use an automatic blacklisting system for users, you are giving them NO chance to use them.

Triggers from other scripts that are not on the server do not need to be added since you do not have them!

I advise you to opt for a securisation containing a code that you can easily replace with a text editor which has the option “replace all” and which can do it in all the resources at the same time.

Sometimes some script uses the triggerevent of other script.
Be careful when changing your event name, it could cause bugs. They ALL have to be changed.

Now !

It would be time to talk more concretely about the protection made to the NATIVE FUNCTION of GTA or FiveM!

This is a subject still very little developed yet essential!
You can buy the anti-cheat for $ 200 you will only get 50% protection, maybe 60% but not more.

All cheats can use the native functions of the game, that is to say, the spawn of weapon, vehicle, object, tp, noclip, explosions etc, etc …

The anti cheats will offer some solutions but are still able to be bypassed, like anti-blips, anti-spectate.

You will also have solutions like blacklists, weapon, vehicle, item but you can never blacklist everything, because you use cars, weapons etc …

A smart cheater will only have to give himself the weapons used on your server, vehicles also etc …

They can also mess up your server and make explosions and many more …

So gentlemen, you who have skills or notions that I do not have. How to protect its native functions which are the heart of the problem.

Thanks for reading me

You can keep track on the server what a player is allowed to spawn, own, have etc.

There’s server events like entityCreating, giveWeaponEvent, explosionEvent and more. In the end, you are able to catch 90% of cheaters using server events and “getter” natives - GetPlayerArmour, GetWeaponDamageModifier. There are even natives to check if a player is spectating someone else.

Links: https://runtime.fivem.net/doc/natives/, https://docs.fivem.net/docs/scripting-reference/events/server-events/ etc

Don’t forget to read this too How hackers can exploit your servers and what to do about it and gain insight through “anti cheat” code on Github

It takes some time to get an anti-cheat that works according to what you want (as every server is different), so buying an anti-cheat is a waste of money. Truly because as a server owner you must know how to code. Learning is the whole point of owning a server. You create the world you want your players to experience. Don’t limit yourself by using the creations of others. Also don’t start/have a server if you’re unwilling to learn.

I totally agree with you, but there is no topic, wiki or other documentation to properly understand these functions.

Could you explain to me how to protect its native functions in the game?
Is it like a TriggerEvent and you have to replace its name in every file that uses it?

For triggerevents, I know their function is to declare somewhere, so it’s easy to modify this.
But for the native functions it remains very vague for me.

If you have an example to give me or a full explanation I would love to learn how to protect its functions and share my protection if it is reliable and efficient :slight_smile:

1 Like

“TriggerServerEvent” Is what you need to be looking for and altering those events where they are declared and used. You can then obfuscate the triggers which will stop a lot more people being able to grab them and use them.

Hello !

“TriggerServerEvent” is not what i"m looking for, i want to catch “explosionEvent”, spawn car, spawn ped, spawn entity, spawn weapon, and all other function on troll menu who not on server script.

All of my are renamed and safe.
Thx

Checkout the fivem own server events wiki. There is example about explosionEvents/Entity creating ( spawn ped/ spawn car )
i don’t think there is a event for spawn weapon currently, you have to make your own client side script then if player gets a new weapon trigger a server event about it

Is it possible to blacklist events such as AttachEntityToEntity so only certain resources can use it?
Example:
Blacklist GiveWeaponToPed for everything except the vMenu Resource.

You might be able to by setting the global GiveWeaponToPed to null/nil

Thanks, I will try it out. Recently modders have just been abusing basic events in my server such as GiveWeaponToPed, SetEntityInvincible, CreatePed, FreezeEntityPosition, AddExplosion, ClearPedTasksImmediately, and AttachEntityToEntity.