Hi, I’m reposting the SaveInstance detection method I posted a couple months ago (as per request by a lot of people). Reason why I deleted the old one was because the code was pretty “poor” and at the time I didn’t want to risk it being patched by UniversalSynSaveInstance Dev’s.
The way this works:
UniversalSynSaveInstance (SaveInstance) utilises UGCValidationService for it’s HiddenProperty feature, however UGCValidationService isn’t actually apart of the game’s DataModel until explicitly referenced (you can’t use the Weak Metatable method because they use cloneref on every service), so this creates an easy detection. There is no actual use for UGCValidationService for game developers, which means it shouldn’t ever be used in your game in the first place.
There are multiple ways to detect if UGCValidationService is being used, including:
game.DescendantAdded
game.ChildAdded
game:FindService()
The best method of detection to use is game:FindService, due to multiple factors, one being because if a user executes SaveInstance (autoexecutes) before the scripts code runs then it won’t be able to detect SaveInstance using the methods game.DescendantAdded and game.ChildAdded, whereas if you loop the FindService method, it will continuously scan the game for UGCValidationService every set seconds.
local GuiService = game:GetService("GuiService")
task.spawn(function()
while true do
if game:FindService("UGCValidationService") then
for i = 1, 1e5 do
local Lol = Instance.new("HumanoidDescription")
Lol.FaceAccessory = "0"
GuiService.CloseInspectMenu(GuiService)
GuiService.InspectPlayerFromHumanoidDescription(GuiService, Lol, string.rep(utf8.char(8203), 1e5) .. "")
-- The code above crashes the client
end
end
task.wait(1.5)
end
end)
The reason why we crash the client instead of only kicking them is because even once the client (player) is kicked, they still have access to the game’s memory, as they are still being fed the game’s network data, which allows them to still save the game. Whereas if we crash them this will completely prevent them from being able to save the game (for obvious reasons).
The crash I put in the code above works by creating a massive Unicode string and repeatedly feeds it to a rendering-related function/API which essentially “chokes” on long strings. It does this over 100,000 times (1e5 is just an exponential form of 100k) to ensure a massive bulk of these strings get sent, which leads to a huge RAM spike causing the player’s client to crash.
Note that this crash is susceptible to being hooked (bypassed), especially because of the fact it’s now free released and not obfuscated. So I’d definitely suggest making a new crash for it, if you know how to ofc (probably not needed tho, and do not use while true do end).
UniversalSynSaveInstance Dev’s are still yet to make a patch for this detection method (honestly they probably never will for various reasons lol), and the only way they can patch it without removing this feature is easily detectable. Removing this feature could also cause certain issues with SaveInstance.
To those that will comment “the client isnt secure this can be bypassed! blablabla”:
This code/detection is ofc susceptible to being bypassed as is anything on the client (same with the server if given the correct vulnerabilities via the likes of backdoors), that being said this should obviously be secured to prevent any bypasses and any other tampering (of which I’m not going to do for you, that’s something you’ll have to do)
Place this code in a LocalScript, in ReplicatedFirst. If you have any other questions feel free to let me know.
This post is dedicated to those that for years have said SaveInstance is “undetectable”, nothing is undetectable in terms of security, just as nothing is ever completely invulnerable (Anti-Cheats).
