shakna-israel

Obfuscating Lua

I've had some fun ruining Python recently, but Python is what I use at work. I prefer to use other languages when I'm doing stuff for fun.

And obfuscation only really makes sense in fun and competition - given a suffeciently determined actor, your code will be reverse engineered. Unless you write it in Malboge.

For this particular experiment, I'll be using Lua 5.3. As I'll probably need to dive into some of the less portable functions to commit our atrocities, I can't guarantee it will run on other popular versions like Luajit or 5.1.

---

corsix

Exploiting Lua 5.1 on 32-bit Windows

The following Lua program generates a Lua bytecode program called ignore-unsigned-sga.fnt, which in turn loads a DLL from within an extremely locked down Lua 5.1 sandbox in a program called RelicCOH2.exe. The remainder of this document attempts to explain how this program works by a whirlwind tour of relevent bits of the Lua 5.1 virtual machine.

if string.dump(function()end):sub(1, 12) ~= "\27Lua\81\0\1\4\4\4\8\0" then
  error("This generator requires a 32-bit version of Lua 5.1")
end

local function outer()
  local magic -- In bytecode, the stack slot corresponding to this local is changed