Additional notes

This page contains additional notes about razvanSB's script environments.

How are the restrictions applied?

The following explaination assumes you already have deep knowledge of Luau's internals in order to understand.

razvanSB uses a Luau virtual machine (interpreter) written in Luau itself to apply the restrictions by modifying the NAMECALL and CALL opcodes to redirect all API calls (or namecalls) and standard function calls to a native handler, which check for any restricted functions or restricted operations, and allow to dynamically change the behavior of a function. This allows for restrictions to be dynamically applied at a much lower level and allows for the restrictions to be significantly harder to bypass.

To introduce the custom functions and variables to the script's environment, the script manager will change the execution environment of the generated executable and set the execution environment of the executable to one that contains the functions and variables, which allows for a robust approach of shimming the custom variables and functions into the root script.

As part of a security measure, razvanSB wraps and isolates all functions that reach the point of executable generation in the call stack from accessing the environment of other internal scripts in order to prevent indexing of the internal scripts.

How do I meet the privilege requirement?

razvanSB uses 112x4 (a ban manager owned by the same owner) for ban management and for whitelist management. To have full unrestricted access to AssetService and require, you need to contact an 112x4 administrator (someone who has the 4th privilege level) or the owner and specify your intentions.

Note that the privilege requirement will not allow you to circumvent all restrictions. All restricted API calls and additional restricted functions will still be restricted/blocked from being used, even after meeting the privilege requirement. Having a higher privilege level (2nd, 3rd, 4th (administrator) or 5th (owner)) wont make any difference either.

Other notes

Restriction errors

All errors that are triggered by performing a restricted operation (such as kicking a player) will cause local and server scripts instantiated by NewScript or NewLocalScript to fully stop, even if the restricted call is wrapped in pcall. The same goes for calling nil values in local scripts as part of the script builder's custom error handling. This may be changed in the future to prevent unnecessary full script stops for all scripts generated by NewScript and NewLocalScript.

_G and shared

_G and shared have been changed to regular tables with protected metatables, removing the attribute that allows the tables to extend all contents across all scripts of the same execution context.

Restricted API calls

The following types of API calls are restricted and will result in the script forcibly stopping:

• Player:Destroy()

• Player:Kick()

• Player:ClearAllChildren()

• PlayerGui:Destroy()

• Players:BanAsync()

• Players:UnbanAsync()

• razvanSB_remote:Destroy()

• AssetService:LoadAssetAsync() (unless the privilege requirement is met)

Use of native code generation and the --!optimize directive

razvanSB's luau compiler and interpreter do not natively support ROBLOX's native code generation. Therefore, appending the @native attribute to a function will result in no effect. The same goes for using the --!native and --!optimize directive.

Restricted environment table writes

owner, LoadLibrary, NewScript, NewLocalScript, NewModuleScript and their aliases cannot be overwritten. Currently, the only way to circumvent this restriction is using rawset, as it does not trigger the __newindex metamethod that enforces the restriction.

Unwritable TextChatService.OnIncomingMessage

Because the razvanSB client-side takes over TextChatService.OnIncomingMessage first, any attempts to take the connection over will have no effect. This is a part of preventing abuse that involves using the TextChatService connection.

Filtering of getfenv and setfenv return values

To prevent access to _G , shared and references to razvanSB's internal scripts, the return values of getfenv and setfenv are filtered in the root script environment (the non-NewLocalScript/NewScript environment).

debug restrictions

The debug library's functions are fully restricted to prevent stack inspection, which may allow the script to index razvanSB's internal scripts and cause havoc. Currently, this affects all three types of environments (the root script, NewLocalScript and NewScript's environment), but it may be changed in the future to only be a restriction for the root script environment.