Instance

All Instances are userdata with methods below. game / workspace refresh each execute.

Methods

instance:GetChildren(): { Instance }
instance:GetDescendants(): { Instance }          -- capped
instance:FindFirstChild(name: string): Instance?
instance:FindFirstChildOfClass(className: string): Instance?
instance:FindFirstChildWhichIsA(className: string): Instance?
instance:IsA(className: string): boolean
instance:IsDescendantOf(ancestor: Instance): boolean
instance:WaitForChild(name: string, timeout: number?): Instance?
instance:GetFullName(): string
instance:GetService(name: string): Instance | table | nil
instance:GetPlayers(): { Instance }              -- useful on Players
instance:GetAttribute(name: string): any
instance:SetAttribute(name: string, value: any)
instance:GetAttributes(): { [string]: any }
instance:GetPropertyChangedSignal(prop: string): RBXScriptSignal
instance:Fire(...): void   -- BindableEvent / ProximityPrompt only (local VM)

Fire

bindable:Fire(...)           -- fires bindable.Event
prompt:Fire()                -- fires prompt.Triggered (LocalPlayer.Name)
prompt:Fire("Name")

Does not run real Roblox listeners. See Signals for Bus listen on the test place.

FindFirstChild / WaitForChild

Match Name or ClassName (helps when Name read is weird for services like Workspace).

IsA

Exact class, plus limited inheritance:

Instance — always
BasePart / PVInstance — Part, MeshPart, Seat, …
GuiObject / GuiBase* — Frame, TextLabel, …
ValueBase — *Value classes
Model, LuaSourceContainer, Accoutrement, Tool, LayerCollector

Attributes

Read: real attribute map + fake overlay
SetAttribute for new keys → fake only (does not allocate Roblox map)
Existing real keys: bool/number can be written through

Properties (common)

Prop	Notes
`Name`	string
`ClassName`	string
`Address`	number (debug)
`Parent`	Instance? — writable; `nil` unparents
child name	`inst.ChildName` via `__index`

Signals on Instance

Class	Signal / API
any	`ChildAdded`, `ChildRemoved`, `DescendantAdded`
`BindableEvent`	`.Event`, `:Fire(...)`
`RemoteEvent` / `UnreliableRemoteEvent`	`.OnClientEvent` (no `FireServer` yet)
`ProximityPrompt`	`.Triggered`, `:Fire(...)`

Details: Signals.

By class

DataModel: PlaceId, GameId, JobId, Workspace
Players: LocalPlayer, PlayerAdded, PlayerRemoving
Player: Character, CharacterAdded, DisplayName, UserId, Team
Workspace: CurrentCamera
Camera: FieldOfView (r/w)
Lighting: Brightness, ClockTime, Fog, Ambient, GlobalShadows (r/w)
BasePart: Position, Size, CFrame, Transparency, Anchored, Velocity / AssemblyVelocity; write Position/Size/Transparency/Anchored/Velocity/CanCollide/Color
Humanoid: Health, MaxHealth, WalkSpeed, DisplayName, RootPart; write Health/MaxHealth/WalkSpeed/JumpPower/JumpHeight
ValueBases: .Value (StringValue write only short SSO < 16)
BindableEvent / ProximityPrompt / RemoteEvent:* see table above

Instance.new

Instance.new(className: string, parent: Instance?): Instance?

Works. Goes through CallGate — the bridge hijacks the implementation pointer of one currently-hot BoundFuncDesc slot (tries IsA, FindFirstChild, GetChildren, WaitForChild, FindFirstChildOfClass, GetDescendants, GetAttribute, Clone, in that order) so the class constructor actually runs on the real game thread, not from outside. Re-running the cheat without restarting Roblox is safe: it recognizes and unwraps its own leftover hook from a previous run, and if the candidate slot turns out cold (nothing calls it) it silently moves on to the next candidate.

Verified against 56 Roblox classes (scripts/instance_new_test.lua): 54–56 / 56 create successfully depending on run.

⚠️ Known limitation — no rendering. Objects created via Instance.new genuinely exist in the game's memory: they are correctly parented, Anchored / Position / Size / other properties read back correctly, GetChildren on the real parent finds them. But the geometry is not picked up by the render pipeline — created parts/meshes/effects stay invisible in the 3D viewport. This is an open problem, not a stub; do not rely on visually seeing objects created this way.

Two classes fail with "unknown class" (not found by name in the reflection table) and cannot be created:

ColorCorrectionEffect
DepthOfFieldEffect

On failure Instance.new returns nil and prints a reason:

Reason	Meaning
`unknown class`	class name not in the reflection table (e.g. the two above)
`not creatable`	class exists but is abstract/service, engine refuses to construct it
`no call gate` / `gate timeout`	CallGate not installed / engine never hit the hijacked slot in time
`create timeout` / `create returned junk`	constructor call went through CallGate but didn't return a usable instance
`parent failed`	object was created but parenting via CallGate failed

local part = Instance.new("Part", workspace)
part.Anchored = true
part.Position = Vector3.new(0, 50, 0)
-- part exists, is parented, has correct properties — but won't be visible

Setting Parent

inst.Parent = otherInstance   -- reparent, also goes through CallGate
inst.Parent = nil             -- unparent

Reparenting an instance created by hand or fetched from the tree uses the same CallGate mechanism as Instance.new's own parenting step, so it has the same reliability characteristics (falls back to a direct write if the gate call fails).

Writing strings / Content fields

There is no per-property SetContent/SetString method on the Instance userdata. Instead, raw string and Content fields (e.g. a Sky face texture, Decal.Texture) are written directly by address with the low-level mem primitives:

local at = addrof(sky)
wrcontent(at + 0xf8, "rbxassetid://15536110634")  -- Sky.SkyboxBk, for example

See Memory for wrstr / wrcontent and the rest of the raw memory API, and scripts/custom_skybox.lua / scripts/weather.lua for worked examples (including the explicit cache-invalidation Content writes need).

spitari docs