23: Garry's Mod Lua Tutorial - How to Exploit & Secure Net Messages (2024)

Table of Contents
Introduction Video FAQs


Useful Links:
Discord: discord.gg/cC9KZUd
Dan's Gmodstore: www.gmodstore.com/users/dan
Patreon: www.patreon.com/danfmn


Hello and welcome today's tutorial we're going to be learning about networking exploits, we're gonna learn how to abuse networking and how to patch networking exploits in this tutorial we're gonna be using code from part, 17 in part, 18 of mcGarry's, wanna lude thesaurus series.

So if you have not watched that those videos yet I recommend that you go do so now and then come back so let's get into it.

Okay? So in today's tutorial, I'm, basically, just using the same code from the previous tutorials.

The only thing that I'm going to be changing here is I'm only going to be working with weapons.

We did cover entities.

However, in this case, I just want to show bad practice for whenever you have, for example, a weapon shop.

So I'm gonna remove the entities here.

So we just have the weapons.

And then in our server side here this week, this is our normal net dot, receive I believe.

This is a really good example of networking and how to avoid exploits and we're going to just have this in the background.

So we can reference it later, but we actually are going to be rewriting a bad example of networking.

So we can learn from it and abuse it in our client-side code.

Here we have our tutorial shop and basically what's happening here in our list.

Here, whenever we go to purchase something, we are sending an ID, which is associated with an item.

And if we send, for example, one, we know that this is the SKS if we send two then this is the m24.

And if we send three that's the clock, and you can see that we're getting all the item data here by indexing, the ID and I did go into further depth in this on the de toriel.

So I recommend watching that if you have not already and a one more thing inside of my Garry's Mod directory here inside our actual Lua folder, where my Garry's Mod client is running I have a file here called awesome, cheat lua.

And so this is what I'm gonna be using to exploit the net messages.

And in this tutorial, I do have sv allow cs, lewin enabled.

Typically if you have this that you want this disabled, however, people can bypass this in multiple ways.

But just for this tutorial, we are going to have.

It enabled make sure whenever you are running a server to have this disabled.

So no one can run client-side Lua.

But now that we have that enabled we are good to go to run our own client-side Lua.

And then we should be good to go.

So the first thing I want to do is talk about some bad things that I see when people are networking so we're gonna go ahead and redo this here.

So if you see here, we have this item data.

We have the name the description the price, and we have actually a bunch of more information, such as the class name and the item type.

What I'm gonna want to do here is actually send the class name of the item that they're trying to buy cuz that makes sense.

So I'm gonna do neck dot write string and I'm gonna do item data dot classic.

Then we want to send the price of what they're trying to buy, because that makes sense right? We want to charge them appropriate amount.

So we're gonna do item data dot price set aside 32 bits here.

And then additionally, we want to send the player that is trying to buy something so I'm gonna do neck that right entity and it's.

The local player, who's attempting to purchase something which makes sense and then I'm going to go ahead and save this.

Then on the server side here, whenever we receive this net message, what we want to do is obviously charge the player.

The appropriate amount make sure we give the item to the correct player and give them the right item.

So the first thing that we sent was the class name.

So when you local class name, people's net dot, read string, then we sent the price, which will we sent 32 bits.

So we're gonna read 32.

And then the player we sent as well so we're going to read that entity that they sent let me just make sure that we are good here.

Yep, net dot, write entity.

That is the same set up here.

So what we want to do obviously is check to see if they can afford this price, because we don't want to just give him a free item.

So we're gonna do if P, oh, I can't afford price.

Then we're gonna take the price or take that money.

So we're gonna do add money.

We're gonna add the negative of the price.

So we're, basically, subtracting here.

And then we're gonna do peel why give and we're gonna give that class name.

So now if I hop in game now and I, let me reopen this menu here I'm gonna go ahead and purchase the sks.

You can see everything works as expected.

And that is good.

Here also I forgot to save this.

So we do have the previous items there.

But yet everything is working good I.

Have the clock I got the SKS.

My money is going down.

I believe, yes, it is also I was able to buy this again, because we didn't check to see if the player already has the weapon so that's something we're going to want to add in well.

But the main focus here is this m24 it's, $20,000, I, don't want to spend $20,000.

So what I'm gonna do now is take a look at the server's code that I'm on because there are file stealer so that's something to keep in mind, and people can easily get a hold of any client-side files that you have.

And so they can see their net messages, how they're structured.

And what data is being sent to the server.

So if I was to look at this code here that we just wrote, which is a really really bad thing to do.

This is a really it's just so exploitable in so many ways I'm gonna take advantage of it.

So in my code here, I'm gonna go ahead and copy this.

And so this is my cheat, I'm gonna go ahead and take that net message that I found and I saw that they're writing a class name, they're writing the price and the writing a player.

So there's, a few things that we can do here with this.

We can we can give any weapon to any player, and we can give any weapon for free.

So we don't have to charge a single thing, and we can choose pool gets the weapon.

And the reason for this is because we're not actually sending, for example, by ID that as we were doing it in the previous tutorial, we would send an ID, and then we would look up all the data inside this table, however, in our client-side code, we're already looping over that table.

And so we're just sending the values to the server.

And this is bad because the client can manipulate that and I'm gonna show you that now.

So what I'm gonna do here for the right string? I'm gonna go ahead and pick a weapon from the list.

One that's, not even in the shop.

So I, don't, believe, there's, an ak-47 so I want that and I'm gonna go ahead and put that here.

Next I don't want to spend any money.

So I'm gonna go ahead and set this to zero then I actually want to give this to myself.

So I'm gonna keep this as local player.

So I'm going to save this down.


So if you look here, I do not have an inky 47.

And now what I'm gonna do is I'm gonna run Lua underscore open script CL, and then we're gonna take our file name here, which is, awesome, cheat, Lua and hit enter.

And now you can see I just got an inky 47 and I did not lose any money.

If I do that again, I'm, not yeah, I am not losing any money for sure and I'm gonna do it with the ak-74 I'm gonna go ahead and give that to myself and take a good look at my money at the bottom left and boom, I got an NK 74 from that code.

And my money did not go down.

So there, this is a serious issue.

So how do we fix this real quick? Actually before we fix it I want to show you an example of how I can give a weapon to another player.

So if I just hop into my console here and I print table player get all you can see we have the first ID here, which is player Y, which is B.

And then in the second ID here, we have player 2, which is the bot so I'm going to go ahead and give this bought an NK 74.

So what I'm gonna do here is I'm gonna take that table that we just printed to play, it I get all and I'm gonna indexed by the second player.

So now if I run this code again, you can now see that he actually got the ak-74.

So this is a serious issue.

So let's talk about how to fix this.

So the first thing that we want to do is actually fix the option to give a weapon to any player.

So to do that, this is actually fairly simple.

If you look here in our function, arguments on this original net dot, receive, we have the Len, and we have the PL y.

So py is actually the player that sent the net message.

So we do not need to write the entity here.

So what I'm gonna do now is when going here and I'm just gonna remove this line.

So we're, no longer writing the entity and then on our receiver, no longer gonna read this entity and we're gonna go into our arguments here and fill them in with the appropriate information.

So now if I save this and I hop back into the shop now, I can go ahead and buy this m24 and everything still works, because we know which player is attempting to send this message.


Now to fix this.

What we want to do is get the item data similar to how we did in the previous tutorial.

Because if you look here in our code, originally, we were sending K, which was the current iteration of the loop, which it makes sense.

So if we send one, we know that this is the sks, if we send two, this is the m24.

If we send three, this is the Glock so that's a way to index the information here.

We just want to go ahead and write.

Okay, which like I said, was the current iteration.

So and I thought, right and I believe we did an integer right, int and we'll do K 32.

And we will send that to the server, and then what it's gonna do here I'm gonna remove this bad code now and I'm, just gonna explain why the option above here is better than this.

So first off, we are using PL, I, correct that's.

The right thing we want to do then we have this ID here.

And so this ID is going to be a number between 1 and 3 for the most part because there's only three items in the loop.

One thing you could do is actually check to see if this ID is a number that is not 1 2 or 3.

And if it's not more than likely, this person is sending an ID that is most likely sending an item that is not legit.

So we could actually check here.

And we could say if ID is greater than table dot count tutorial shop, dot, I teams, then we're gonna return meaning the code below it's, not gonna run and we're gonna say, print, py.

Steam ID is potentially attempting to abuse a net message.

And we could say tutorial shop, underscore purchase.

And then we can paste the ID that they're sending here.

So I'm just gonna show you that real quick.

So if I go ahead and go in game now, and we have our new nem messages set up.

You can see this is working here, everything's, fine, good stuff.

Yeti idea.

What what I want to do is actually use this cheat here and using the new method or the new structure here, I'm gonna go ahead and send a number that does not exist.

So I'm gonna go ahead and do net that right, int and I'm gonna say, for example, 4, okay.

And so now if I go in here and I open up that code here, you can see nothing happened in game.

However, if we go into console, we can see steam ID is potentially attempting to use a net message, tutorial shop, underscore purchase.

So, hey, we know that something is not right here.

And so we can utilize information and look at our structure and see if there's anything that is abnormal and then potentially report it.

So, for example, I could maybe kick this player or ban them for potentially abusing, ok.

So now that we have some form of protection here just to check to see if somebody is exploiting, this will not run any code so there's, nothing that we need to really need to worry about.

However, this is just more of a thing to potentially catch any cheaters.

And you can see here if there's no item data.

So for example, if they try to this person sends 5 for whatever reason we also have a method here to check if they are also sending some form of illegitimate ID.

So now we actually have all the data that we need with this item data since we're, looking up the value based on the ID that was sent so there's.

No reason to send the price there's, no reasons in the class name and there's, no reason to send the player that is attempting to purchase something here, because we have all this information stored on the table.

So that's something to keep in mind.

Whenever you are developing some form of networking for your add on another thing that I should mention on just to kind of go over some general topics here, if you are ever working on for example, like a MPC, where you heal a player, a really important thing to do is check to see if the player is actually near the NPC, whenever they are attempting to be healed and use.

So for example, you could write the NPC from the client to the server that there to be healed by you check to see if the NPC is actually a healing NPC.

And then you also check to see if the player is within the correct distance, for example, the player is sending an entity that is not a healing NPC, but it's calling the healing net message.

And then we could say, hey, this guy might be attempting to abuse.

And so then we'll want to ban them, or if they're not within distance, there's, a couple things that could happen there where they could just move away from the NPC, but the menu still open, but we'll just want to return if they're too far away.

So the healing doesn't happen.

Otherwise if we didn't check for the distance, and we didn't check for the correct entity, well, then they can heal themselves.

No matter where they are in the world.

In this case, if we had like an NPC where we're purchasing items from not not only, would we want to send the ID? We like I said, we wanted to check the NPC to where they're purchasing the items from and make sure it's correct and they're within distance.

So there's, a lot of things to keep in mind there's, not a solution for everything.

However, it depends what your structure is what information is necessary.

So the key things to remember send the least amount information as possible one that way you're not sending a useless info.

And that is not needed.

Additionally, what I only send IDs that you can really look up for items or just just just don't trust.

The client is basically the overall message here because the client as shown in this awesome cheat can manipulate the data.

So that's an example of how to abuse the net messages that's, how you can patch them.

You guys have any questions, please feel free to calm them down below also just.

So you guys know this video tutorial was selected based on patreon.

So as you can see here on patreon, we had three people vote and the video that was suggested was networking exploits and how to patch them.

So if you guys are interested in having a say on which video I produced next make sure to check out my patreon link in the description, and you can vote on the next video also, you get access to all the code that is in my tutorials.

So you no longer need to watch them if you're just interested in the code.

So that will be it.

Thank you guys so much for watching I.

Hope, you guys have a wonderful day and take care.

23: Garry's Mod Lua Tutorial - How to Exploit & Secure Net Messages (2024)


Does GMod run on Lua? ›

gLua is Garry's Mod adaption of the open source Lua language. Lua is a language best described as a plugin language, often used for addons and plugins, from everything between Garry's Mod to World of Warcraft, Factorio, and even VLC.

How do I enable cheats in GMod? ›

To begin you must first go to the "Options" on your game menu and select the "Keyboard" tab, then select "Advanced...", Finaly you check off the "Enable Developer Console (~)" and select "Ok" and select "Apply" on your "Options" menu. This will allow you to open the cheating console.

What coding language does GMod use? ›

Garry's Mod includes the functionality to modify the game by developing scripts written in the Lua programming language.

Is Lua scripting easy? ›

Is Lua easy to learn? While every language has its complexities, Lua is one of the easier-to-learn languages and is excellent for beginners interested in image processing or game development.

How long does it take to learn Lua scripting? ›

It takes two to three days to learn the basics of Lua, and three to four weeks to know enough to use it professionally. Lua's syntax is simple and fairly easy to learn. Lua is “strongly typed”, which means that it is consistent and predictable.

Is GTA coded in Lua? ›

So, in summary, while the engine that GTA V runs on it indeed written in C/C++, Lua can easily be included over the top of it as an embedded language for modders to use.

Is Lua outdated? ›

While Lua is still used fairly often in gaming and web service, it performed poorly in terms of community engagement and job market prospects. That being said, in spite of its age, Lua's growth has flat-lined rather than declined, which means that although it's not popular, it's not dying either.

Does Lua support ++? ›

Lua has been used to extend programs written not only in C and C++, but also in Java, C#, Smalltalk, Fortran, Ada, Erlang, and even in other scripting languages, such as Perl and Ruby.

How do I enable objects cheat? ›

To do this activate the cheat console, type in “bb.showhiddenobjects” and you'll find the objects are now available to use.

Can you get banned for cheating in GMod? ›

You can't get VAC banned in garry's mod. Not even if you hack. I can. Gmod has got VAC secure like all Source games (except Portal/Portal 2 and some other games).

How do you fly in GMod? ›

In order to fly in the hit Source game Garry's Mod, you need to carry out the following instructions step by step:
  1. Buy computer.
  2. Buy keyboard and mouse.
  3. Install steam.
  4. Install GMod.
  5. Fart really loudly into your chair.
  6. Load into a sandbox server.
  7. Locate to the "v" button.
  8. Press space.
Dec 28, 2022

How do I start learning Lua? ›

A good place to start learning Lua is the book Programming in Lua, available in paperback and as an e-book. The first edition is freely available online. See also course notes based on this book. The official definition of the Lua language is given in the reference manual.

What version of Lua is GMod? ›

Pure Lua Resources

Official Reference Manual (5.1) - This is the version Garry's Mod utilizes.

Is GMod ok for 11 year olds? ›

Yes Gmod is safe for kids. If you do not like blood, there are many addons that disable it. If your parents dont want you too look/have sexual addons, I would steer away from anime and fnaf related addons.

Can a 9 year old learn Lua? ›

Absolutely! So, let's take a look at a few beginner-level Lua coding projects. (First things first, kids should download Roblox Studio, a free creative engine as limitless as your child's imagination. Then, they can give one of these introductory Lua challenges a try.)

Can a 12 year old learn Lua? ›

While a little more complex than a visual programming option like those listed above, Lua is still a great programming language for kids and teens to learn – especially if they are interested in video games and robotics.

Can you learn Lua in 1 day? ›

Roblox uses Lua and learning the basics of Lua can take anything from a few days to a few weeks, depending on the time you put into it. The more you practice, the faster you will learn. To get started and to become effective in Lua programming, there are some basics you should learn and know.

How much does a Lua coder get paid? ›

$60,000 is the 25th percentile. Salaries below this are outliers. $131,000 is the 75th percentile.

What is harder Lua or Python? ›

Lua is easier than the Python language but Python is popular and demanding language than the Lua language for beginners. Python is a scripting language but it is heavy and slower than the Lua language but Lua is a light-weight, portable, and rapid execution language.

Which is faster Lua or Python? ›

Performance: In terms of execution time, Lua is generally thought to be faster than Python. Python, on the other hand, has a larger standard library and a more comprehensive set of third-party libraries, which can make developing certain types of programs easier.

Is Roblox just Lua? ›

Code in Roblox is written in a language called Lua, and it's stored and run from scripts.

What games are scripted in Lua? ›

  • Age of Conan.
  • Allods Online.
  • American Girl (video game series)
  • Angry Birds (video game)
  • Aquaria (video game)
  • Artifact (video game)

Is Roblox built on Lua? ›

Roblox uses Lua code. Roblox is coded with Lua, and uses relatively simple and use kid-friendly conventions so they can quickly get to grips with how to program inside the Roblox platform.

What age is Lua for? ›

Roblox Studio: LUA Programming | Small Online Class for Ages 9-14.

Why is Lua so popular for modding? ›

In video game development, Lua is widely used as a scripting language by game programmers, perhaps due to its perceived easiness to embed, fast execution, and short learning curve.

Why is Lua unpopular? ›

Lua is very widely used. It's just not as visible because it's used as an embedded scripting language. That means code reuse isn't as widespread in Lua as it is in other languages—each application embedded Lua is sort of its own little world, and it's not always easy to share code between them.

What does == mean in Lua? ›

The operator == tests for equality; the operator ~= is the negation of equality. We can apply both operators to any two values. If the values have different types, Lua considers them different values. Otherwise, Lua compares them according to their types. Specifically, nil is equal only to itself.

What does += mean in Lua? ›

The += operator performs enhanced assignments. The value of the expression to the right of the operator is added to the value of the variable to the left of the operator, and the result replaces the value of the variable.

When did Lua 5.0 come out? ›

Lua 5.0 was released on 11 Apr 2003. Its main new features were collaborative multithreading via Lua coroutines, full lexical scoping instead of upvalues, and metatables instead of tags and tag methods. Lua 5.0 also introduces booleans, proper tail calls, and weak tables.

How do I run a Lua script? ›

To run a Lua script
  1. Open the Lua Script Library through Prepare > Run Lua Script. Use the appearing dialog to load, save, and execute Lua scripts as well as to create new ones.
  2. Select the script to be run.
  3. Click Execute Script.

How do I run a Lua function? ›

The API protocol to call a function is simple: First, you push the function to be called; second, you push the arguments to the call; then you use lua_pcall to do the actual call; finally, you pop the results from the stack.

How do I compile and run a Lua script? ›

  1. Go to the Lua download area.
  2. Download the version of Lua that you want.
  3. Unzip the . tar. ...
  4. Download the Compile. bat file from this repo and move it into the extracted lua-x.y.z folder.
  5. Make sure you have cl.exe , link.exe and lib.exe either in your %PATH% variable or in the extracted lua-x.y.z folder.
  6. Run Compile.

Top Articles
Latest Posts
Article information

Author: Edwin Metz

Last Updated:

Views: 5261

Rating: 4.8 / 5 (58 voted)

Reviews: 81% of readers found this page helpful

Author information

Name: Edwin Metz

Birthday: 1997-04-16

Address: 51593 Leanne Light, Kuphalmouth, DE 50012-5183

Phone: +639107620957

Job: Corporate Banking Technician

Hobby: Reading, scrapbook, role-playing games, Fishing, Fishing, Scuba diving, Beekeeping

Introduction: My name is Edwin Metz, I am a fair, energetic, helpful, brave, outstanding, nice, helpful person who loves writing and wants to share my knowledge and understanding with you.