# Additional notes

## How are the restrictions applied?

{% hint style="info" %}
The following explaination assumes you already have deep knowledge of Luau's internals in order to understand.
{% endhint %}

razvanSB uses a Luau virtual machine (interpreter) written in Luau itself to apply the restrictions by modifying the `NAMECALL` and `CALL` opcodes to redirect all API calls (or `namecalls`) and standard function calls to a native handler, which check for any restricted functions or restricted operations, and allow to dynamically change the behavior of a function. This allows for restrictions to be dynamically applied at a much lower level and allows for the restrictions to be significantly harder to bypass.

To introduce the custom functions and variables to the script's environment, the script manager will change the execution environment of the generated executable and set the execution environment of the executable to one that contains the functions and variables, which allows for a robust approach of shimming the custom variables and functions into the root script.

As part of a security measure, razvanSB wraps and isolates all functions that reach the point of executable generation in the call stack from accessing the environment of other internal scripts in order to prevent indexing of the internal scripts.

## How do I meet the privilege requirement?

razvanSB uses 112x4 (a ban manager owned by the same owner) for ban management and for whitelist management. To have full unrestricted access to `AssetService` and `require`, you need to contact an 112x4 administrator (someone who has the 4th privilege level) or the owner and specify your intentions.

{% hint style="warning" %}
Note that the privilege requirement will not allow you to circumvent all restrictions. All restricted API calls and additional restricted functions will still be restricted/blocked from being used, even after meeting the privilege requirement. Having a higher privilege level (2nd, 3rd, 4th (administrator) or 5th (owner)) wont make any difference either.
{% endhint %}

## Other notes

{% hint style="danger" %}

## Restriction errors

All errors that are triggered by performing a restricted operation (such as kicking a player) will cause local and server scripts instantiated by `NewScript` or `NewLocalScript` to fully stop, even if the restricted call is wrapped in `pcall`. The same goes for calling `nil` values in local scripts as part of the script builder's custom error handling. This may be changed in the future to prevent unnecessary full script stops for all scripts generated by `NewScript` and `NewLocalScript`.
{% endhint %}

{% hint style="warning" %}

## `_G` and `shared`

`_G` and `shared` have been changed to regular tables with protected metatables, removing the attribute that allows the tables to extend all contents across all scripts of the same execution context.&#x20;
{% endhint %}

{% hint style="warning" %}

## Restricted API calls

The following types of API calls are restricted and will result in the script forcibly stopping:

* `Player:Destroy()`
* `Player:Kick()`
* `Player:ClearAllChildren()`
* `PlayerGui:Destroy()`
* `Players:BanAsync()`
* `Players:UnbanAsync()`&#x20;
* `razvanSB_remote:Destroy()`
* `AssetService:LoadAssetAsync()` (unless the privilege requirement is met)
  {% endhint %}

{% hint style="warning" %}

## Use of native code generation and the `--!optimize` directive

razvanSB's luau compiler and interpreter do not natively support ROBLOX's native code generation. Therefore, appending the `@native` attribute to a function will result in no effect. The same goes for using the `--!native` and `--!optimize` directive.
{% endhint %}

{% hint style="info" %}

## Restricted environment table writes

`owner`, `LoadLibrary`, `NewScript`, `NewLocalScript`, `NewModuleScript` and their aliases cannot be overwritten. Currently, the only way to circumvent this restriction is using `rawset`, as it does not trigger the `__newindex` metamethod that enforces the restriction.
{% endhint %}

{% hint style="info" %}

## Unwritable `TextChatService.OnIncomingMessage`&#x20;

Because the razvanSB client-side takes over `TextChatService.OnIncomingMessage` first, any attempts to take the connection over will have no effect. This is a part of preventing abuse that involves using the `TextChatService` connection.
{% endhint %}

{% hint style="info" %}

## Filtering of `getfenv` and `setfenv` return values

To prevent access to `_G` , `shared` and references to razvanSB's internal scripts, the return values of `getfenv` and `setfenv` are filtered in the root script environment (the non-`NewLocalScript`/`NewScript` environment).
{% endhint %}

{% hint style="info" %}

## `debug` restrictions

The `debug` library's functions are fully restricted to prevent stack inspection, which may allow the script to index razvanSB's internal scripts and cause havoc. Currently, this affects all three types of environments (the root script, `NewLocalScript` and `NewScript`'s environment), but it may be changed in the future to only be a restriction for the root script environment.
{% endhint %}
