How do I de-obfuscate a Lua script?

by

There are generally two ways to obfuscate Lua source code:

  1. Obfuscate the code directly, mostly by renaming variables, introducing istraction and restructuring code to be harder to follow

  2. Encode the source code and embed it as a string in a Lua file that only decodes, loads and runs the encoded real program.

In reality, a combination of both is often used: Programs are obfuscated, then encoded and wrapped in a string. Finally, the code that loads and runs the string is often obfuscated again.

Typical mechanisms used for making Lua code harder to follow include:

  1. Renaming standard functions such as string.gsub, table.concat, etc.
  2. Renaming variables to nonsense
  3. Replacing dot- and colon-notation for table-indices with bracket-notation
  4. Using hexadecimal notation for literal strings (often in combination with 3.)

Generally speaking, the steps to de-obfuscate such code by hand are often very similar: reformatting the code to make is easier to follow the control-flow, then figuring out what each variable represents and renaming them. For this it is often necessary to have a good understanding of the Language, as one needs to be aware of all the rules that the obfuscation takes advantage of to make the code harder to understand. A few such rules to be aware of:

  1. Local variable shadowing: two different variables can have the same name in different scopes (or even in the same scope).
  2. Syntactic sugar such as dot- and colon-notation
  3. Function environments and getfenv and setfenv
  4. Metatables and that all Strings share one metatable with __index set to string
  5. Whitespace is often insignificant in Lua and only necessary to separate statements in some cases, which can also be done with ;.

For more in-detail help with de-obfuscating a specific snippet of Lua code, you could ask in the following other online communities:

But remember: Don’t ask to ask, just ask

Note that these are not official communities. For more options, see the Community page on the official Lua website.

More Related Contents:

  1. How can I create a secure Lua sandbox?
  2. How do you copy a Lua table by value?
  3. Why does Lua’s length (#) operator return unexpected values?
  4. How to get number of entries in a Lua table?
  5. Safely remove items from an array table while iterating
  6. Print all local variables accessible to the current scope in Lua
  7. How to get list of directories in Lua
  8. ESP8266 NodeMCU Running Out of Heap Memory
  9. How do I run an executable using Lua?
  10. How to dump a table to console?
  11. Lua find a key from a value
  12. How to restore obfuscated property names?
  13. Get back the output of os.execute in Lua
  14. “main” function in Lua?
  15. Easiest way to make lua script wait/pause/sleep/block for a few seconds?
  16. What does LUA acronym stand for?
  17. Returning the index of a value in a Lua table
  18. Is it possible to decompile an Android .apk file?
  19. Sort points in clockwise order?
  20. How to get rid of eval-base64_decode like PHP virus files?
  21. De-obfuscate Javascript code to make it readable again [duplicate]
  22. Search for an item in a Lua list
  23. Ruby obfuscator [duplicate]
  24. Generating uniform random numbers in Lua
  25. What is the standard (or best supported) big number (arbitrary precision) library for Lua?
  26. How to protect Java codes against decompiler? [closed]
  27. iPhone/iPad App Code Obfuscation – Is it Possible? Worth it? [closed]
  28. tools for obfuscating html and css [closed]
  29. Android/java: Transition / Migration from ProGuard to R8?
  30. Can you Distribute a Ruby on Rails Application without Source?

Leave a Comment