Related
Closed. This question needs to be more focused. It is not currently accepting answers.
Want to improve this question? Update the question so it focuses on one problem only by editing this post.
Closed 2 years ago.
Improve this question
I paid an untrusted developer for a script. And as I thought he scammed me. He did send me code, but he obfuscated the script. It is for a game called "Roblox" that uses Lua, the code will be down below. As from I can tell by running it, it might work. But I would need to change the script for it to work. Does anyone know to to decode the obfuscation?
https://pastebin.com/B8SZmZGE
local ilIillllII1i1lliliI = assert local II1ll1iliIIIIillIli = select local lIlillIlIi11I1lIIi11I = tonumber local i1li1IIIII1IIilIil1 = unpack local iIl1IIlI11i1il1ilII = pcall local lIlI1IiiIlIl1i11ll1Il = setfenv local iIIlilIlllIliiIili1 = setmetatable local ii1Iiill11ii1IIIill = type local lIll1I1ll1lliilII1Il1 = getfenv local IiIi1llliiIIllllI1i = tostring local Ii1IIill1ilI1lilIiI = error local iilli1lIi11lllIli1l = string.sub local lIlI1li1ll1lliliIlI = string.byte local lIli1Ill1liIlilIIIiiI = string.char local I1ii1iIIl1lI1Iii1iI = string.rep local iiiIiI11IIllIiliI1I = string.gsub local illlIIIllliill1l1ll = string.match local iIi1l1liili1I11l1II = 1 local function lIll1iillI1ll1iiIiIll(IIiiiIiiIllIl1i1i1I, iIililIlliIII11illi) local i1iiI1I1iII1iiIiil1 IIiiiIiiIllIl1i1i1I = iiiIiI11IIllIiliI1I(iilli1lIi11lllIli1l(IIiiiIiiIllIl1i1i1I, 5), "..", function(llii1Ii11lI1llilill) if lIlI1li1ll1lliliIlI(llii1Ii11lI1llilill, 2) == 71 then i1iiI1I1iII1iiIiil1 = lIlillIlIi11I1lIIi11I(iilli1lIi11lllIli1l(llii1Ii11lI1llilill, 1, 1)) return
Ok so I am turtsis and I see that people have been stealing my answer and posting it on v3rmillion as there own. So I will post another answer but this time a better one on how to actually get contents of it. So basically if you didn’t read my other answer then don’t and just read this one:
Luraph is a custom lbi which is a lua bytecode interpreter. If you do string.dump(function) you will get luaQ as the output. That is why people use unluaC or luadec to get the source to these dumps. This is called bytecode which is different then string:byte() as it is a non readable lua format in lua 5.1 and up. To be able to use these encoded strings/functions you will need a lbi. What a lbi does is it interpreted the bits and deserialzes them. Here is a example of a commonly used lbi https://github.com/JustAPerson/lbi/blob/master/src/lbi.lua
Ok so now to the part where you get contents of it.
In lua (and other coding languages) there is things called opcodes. Opcodes control the base of lua and there is quite a few of them. Some of the most commonly known and most useful ones are these:
LOADK - loads a constant to the register
LOADBOOL - loads a bool to the register
LOADNIL - loads a nil to the register
JMP - jump
ADD - Adds a new thing to the register
SUB - Subtracts something from the register
There is many more but those are the main ones we will be focusing on.
Ok so to get those normally you would need a external program called unluac or luadec but for this we will be doing it in base lua. I recommend using repl.it to run the code.
So the main thing we will need is LOADK as it loads a constant
A constant is a variable or anything really that doesn’t change ex: local value = 1
Now what isn’t a constant is something that changes.
Now you probaly have heard of iron brew and synapse xen both are very known lua obfuscators created by 3ds and Defcon42
Iron brew and xen have something in common (well the base) they aren’t lbis so you don’t usually get the opcodes from them. But they have a table that has all the constants in them (xen is encrypted) to get these tables there is a whole process with table.concat and global but that’s not luraph that’s other obfuscators. Luraph is different Though because it is a lbi so there is no need for a table with all the constants in it. Instead to get the constants we need a way to get the instructions from a script. Opcodes are instructions. They are instructions because opcodes tell lua what to do with code. Ok so how do we get these instructions?
Here is a article on opcodes and instructions:
http://luaforge.net/docman/83/98/ANoFrillsIntroToLua51VMInstructions.pdf
So they all have signatures:
"sBx"
"A"
"A", "B"
"A", "Bx"
"A", "C"
"A", "sBx"
"A", "B", "C”
You get opcodes args from these instructions.
Now different obfuscators have different opcodes instructions so for luraph you will have to find them. Ok so use a dissembler or make Your own but here is a disassembler made by my friend:
https://github.com/op0x59/reddisassembler
You will need to go onto repl.it and make a repo then add the code and format it etc with the settings. Where in the settings it has opcodes you will need to manually get these from luraph.
So there you go that’s how you can do it. If you need more help dm me on discord:
turtsis#6969
Or
turtsis#2785
ALSO WHOEVER IS STEALING MY ANSWERS ON HERE AND POSTING THEM ON V3RMILLION WITH OUT CREDITING ME PLEASE STOP OR GIVE ME CREDIT.
Basically it uses bytecode (\144\22\99\88) but it has a custom interpreter and a custom bytecode vm to make it have a bytecode like this:
LPH|3EE5491D2B1A00192574A22B510A02002GE5E7E9E42GE5F53GE5F53GE5CD3GE5FDE42GE5C13GE5F934B71
So you will need to rename the variables and functions into something like variable1, variable2 so that you are able to read it. Then find parts that are junk code like
function 1iiii1i1i(i1i1ijj1jijij)
local 1j1j1jj1j1jijijij = (((10*2)/2)-3/9)
end
1iiii1i1i(90, 0)
Which are completely useless and are meant to trick decompilers into looping random number functions. to check if stuff like: iIi1l1liili1I11l1II = iIi1l1liili1I11l1II + 4 return Ii1IiI1I111I1II1IIi * 16777216 + iIII1iIiI1l1IlIIlii * 65536 + IIill111lli111ll1li * 256
These are junk code just look for it in the rest of the code (using ctrl+F) and look if it has a use. If it does, then check if that use has a use and so on until you find if it is part of the vm. The thing is though is that it might loadstring another loadstring for many times until it will take VERY LONG to decompile this. So if you really need the source contact me on discord and I can hook you up (turtsis#2785) or put a couple of hours into this
Using a Lua beautfier can make it easier to understand.
Such as: [http://blackmiaool.com/lua-beautify/][1] (https://github.com/blackmiaool/lua-beautify)
This question is 5 months old but here you go anyway:
local L3_0, L4_1, L5_2, L6_3, L7_4
L3_0 = "rebel alience"
L4_1 = "Wasp"
L5_2 = "Bottom Small Mining Laser"
L6_3 = "Adamantite Ore"
for _FORV_7_ = 1, 10 do
workspace.Ships[L3_0][L4_1][L5_2].RemoteFireCommand:InvokeServer(CFrame.new(0, 0, 0,0.996030748, -7.7674794E-4, 0.0890064985, 0, 0.999961913, 0.00872653536, -0.0890098885,-0.00869189762, 0.995992839), workspace.Asteroids[L6_3],workspace.Asteroids[L6_3], workspace.Asteroids[L6_3].CenterPoint)
wait(3)
end
It's a simple remote event.
You can find the tool used here, it's open source:
https://github.com/TheGreatSageEqualToHeaven/LuraphDeobfuscator
The script is
local L0, L1, L2, L3, L4, L5, L6, L7, L8, L9, L10, L11, L12, L13, L14, L15, L16, L17, L18, L19, L20, L21, L22
L0 = "rebel alience"
L1 = "Wasp"
L2 = "Bottom Small Mining Laser"
L3 = "Adamantite Ore"
for L7 = L4, L5, L6 do
L8 = Workspace
L8 = L8.Ships
L8 = L8[L0]
L8 = L8[L1]
L8 = L8[L2]
L8 = L8.RemoteFireCommand
L9 = L8
L8 = L8.InvokeServer
L10 = CFrame
L10 = L10.new
L11 = 0
L12 = 0
L13 = 0
L14 = 0.996030748
L15 = -7.7674794E-4
L16 = 0.0890064985
L17 = 0
L18 = 0.999961913
L19 = 0.00872653536
L20 = -0.0890098885
L21 = -0.00869189762
L22 = 0.995992839
L10 = L10(L11, L12, L13, L14, L15, L16, L17, L18, L19, L20, L21, L22)
L11 = Workspace
L11 = L11.Asteroids
L11 = L11[L3]
L12 = Workspace
L12 = L12.Asteroids
L12 = L12[L3]
L13 = Workspace
L13 = L13.Asteroids
L13 = L13[L3]
L13 = L13.CenterPoint
L8(L9, L10, L11, L12, L13)
L8 = wait
L9 = 3
L8(L9)
end
The variables are not the normal variables and it may appear a bit confusing because I was using an auto deobfuscator
i might be late but
rebel alience
Wasp
Bottom Small Mining Laser
Adamantite Ore
1
10
Workspace
Ships
RemoteFireCommand
InvokeServer
CFrame
new
0
0.996030748
-0.00077674794
0.0890064985
0.999961913
0.00872653536
-0.0890098885
-0.00869189762
0.995992839
Asteroids
CenterPoint
wait
3
1337
I have a luraph dumper the dumped version of that script is only showing one variable which is "1337" I hope this helped!
One of the easiest things to do is to create a script destroying all the Luraph's scripts. Deleting those junk codes would still be a better option, but this would do its work for some time.
What it does, is that it basically destroys these scripts forever. One of the most fun things is that it doesn't even have to destroy them forever. Luraph scripts have a limited number, how many times they could multiply making Luraph's scripts crash.
local condition = true
local Oofer = workspace.Camera
while condition do
workspace.Camera:ClearAl1Children ()
wait (2)
end
I am trying to understand a portion of JcJohnson/Karpathy's code for RNN written in Lua and Torch. You can find the complete project at github here if you are curious.
https://github.com/jcjohnson/torch-rnn
The portion I need help with is below which is from the LanguageModel.lua file:
if #start_text > 0 then
if verbose > 0 then
print('Seeding with: "' .. start_text .. '"')
end
local x = self:encode_string(start_text):view(1, -1)
local T0 = x:size(2)
sampled[{{}, {1, T0}}]:copy(x)
scores = self:forward(x)[{{}, {T0, T0}}]
first_t = T0 + 1
else
For example I don't know what these mean.
:view((1, -1)
:size(2)
:copy(x)
sampled[]
Do you know what these mean or where I can find a reference for them?
thank you
you may take some Torch tutorials here or check the docs for Torch at github repo
I'm learning Lua from a book, which is a bit old.
I've tried searching the web, but because of the use of the # sign in my search I get really confusing results.
It says that in order to use upvalue you need to use the % sign.
But when I write it in my code I get an error.
Account.new = function (starting_balance)
local self = {}
local balance = starting_balance
self.withdraw = function (v)
%balance = %balance - v;
end
return self
end
error is : unexpected symbol near '%'
Is there a new way to handle upvalues in Lua 5.x ?
Since Lua 5.0, there is no more such thing as a "upvalue sign". An upvalue is a local to the environment a function is declared in, and as such can simply be accessed as any other local variable.
In your case: just use balance instead of %balance.
From Lua 5.1, % is used as modulo operator.
A good but slightly outdated book is the online available version of Programming in Lua, and of course, the reference manual.
Must be a very old book!
The % as upvalue notation was removed in Lua 5.0. (Released 2003)
Since 5.0, Lua has lexical scoping;
that is, upvalues are automatic:
do
local balance = 0
function deposit ( v )
balance = balance + v
return balance
end
end
print ( deposit ( 5 ) )
Output:
5
I'd go with the closure http://www.lua.org/pil/6.1.html#closures
I have to communicate with a dll and it lua and this is the function I use to write strings by bytes:
writeString = function(pid, process, address, value)
local i = 1
while i <= String.Length(value) do
local byte = string.byte(value, i, i)
DLL.CallFunction("hook.dll", "writeMemByte", pid..','..process..','..address + (i-1)..','..byte, DLL_RETURN_TYPE_INTEGER, DLL_CALL_CDECL)
i = i + 1
end
DLL.CallFunction("hook.dll", "writeMemByte", pid..','..process..','..address + (i-1)..',0', DLL_RETURN_TYPE_INTEGER, DLL_CALL_CDECL)
end
I basically need to adapt this to write a double value byte by byte.
I just can't think how to make the memory.writeDouble function.
EDIT: this is my readString function:
readString = function(pid, process, address)
local i, str = 0, ""
repeat
local curByte = DLL.CallFunction("hook.dll", "readMemByte", pid..','..process..','..(address + i), DLL_RETURN_TYPE_INTEGER, DLL_CALL_CDECL)
if curByte == "" then curByte = 0 end
curByte = tonumber(curByte)
str = str .. string.char(curByte)
i = i + 1
until (curByte == 0)
return str
end,
My first recommendation would be: try to find a function that accepts strings representing doubles instead of doubles. Implementing the lua side of that would be incredibly easy, since you already have a writeString - it could be something very similar to this:
writeDouble = function(pid, process, address, value)
writeString(pid, process, address, tostring(value))
end
If you don't have that function, but you have access to the dll source, you can try to add that function yourself; it shouldn't be much more complicated than getting the string and then calling atof on it.
If you really can't modify the dll, then you need to figure out the exact double format that the lib is expecting - there are lots of factors that can change that format. The language and compiler used, the operative systems, and the compiler flags, to cite some.
If the dll uses a standard format, like IEE-754, the format will usually have well documented "translations" from/two bites. Otherwise, it's possible that you'll have to develop them yourself.
Regards and good luck!
There are many libraries available for Lua that do just this.
If you need the resulting byte array (string), string.pack should do it; you can find precompiled binaries for Windows included with Lua for Windows.
If you are more interested in using the double to interface with foreign code, I would recommend taking a different approach using alien, a Foreign Function Interface library that lets you directly call C functions.
If you able to, I even more highly recommend switching to LuaJIT, a Just-In-Time compiler for Lua that provides the power, speed and reach of C and assembly, but with the comfort an flexibility of Lua.
If none of these solutions are viable, I can supply some code to serialise doubles (not accessible at the moment).
I heard that Smalltalk doesn't support local variable in blocks. Is this true? If it is, why doesn't Smalltalk support local variables? And can I still assume it as equal with closures?
It depends on the smalltalk platform you choose. Basically you have block local variables on all smalltalk platforms. There are IMHO two kinds of implementations. If there isn't a full closure support the local variables are shared with the local variables of the method surrounding that block. For this you need to know how to work-around some problems. For full closure support local variables are there and work as you might expect.
Squeak and Pharo used to have locals that are shared with the method. Nowadays a VM with full closure support exists and Pharo supports this fully and I think Squeak does, too. I think gemstone hasn't full closure support. I don't know about VaST and VisualWorks.
You can always test it by doing something like the following:
((1 to: 5) collect: [:i|
[ | local | local := i ]])
collect: [:each| each value]
Here you only get
#(1 2 3 4 5)
if there is full closure support and
#(5 5 5 5 5)
if the | local | is shared with the method.
Do you mean a block local variable, like today in this example:
10 timesRepeat:
[| today |
today := Date today.
Transcript cr; show: today printString]
huh? where did you hear that? try this code:
block := [
x := 10.
x printNl.
].
block value.
it should output 10.
Yes, VA Smalltalk supports them.