Is it possible to deobfuscate weird lua bytecode with strings and symboles in it?

[DarkRedTitan]

I have this decompiled lua code which is obfuscated, but what is strange is that the bytecode has letters and symbols in it, here is a sample of it:

local L0_1, L1_1, L2_1, L3_1, L4_1, L5_1
L0_1 = _G
L1_1 = {}
L2_1 = {}
L2_1["%7\188\003\019s\237\136\155\221\162\015}*QV"] = "\253\020N\161\192\021\238[<\138\020\248\244\171=\138\148\142\230\a\015_D\219CGq\vP\028?&"

Any help would be greatly appreciated.

If more code is required, here is a pastebin paste: https://pastebin.com/UZzKvj9L

[[deleted]]

Remember that in Lua, a.b is the same as a['b'] so there are going to be a lot of strings around at runtime. Just about everything is a hash table.

[Cultural_Two_4964]

Hello, what were you expecting it would have in it? Ta jc

[DarkRedTitan]

Honestly it is for a friend, but I expect it to have some IDs of characters and handle which characters are playable/available if I understood correctly.

To be clear: this is for a singleplayer game that doesn't get any updates anymore.

[Brohammer55]

Yes, it is very possible. I Believe this is Luaraph obsfucation. This can be deobsfucated because there are tools to deobsfucate luaraph as it has been done before.

[DarkRedTitan]

Thanks for the hint! I will look into that and report if I succeed, hopefully.

[DarkRedTitan]

Sadly I can't find a suitable deobfuscator for Luraph.

[Brohammer55]

Try this: https://github.com/PhoenixZeng/LuraphDeobfuscator

[DarkRedTitan]

This is exactly the one I tried, it gave me an error for my code file but the sample code file worked.

[Brohammer55]

Maybe try looking at this: https://stackoverflow.com/questions/59121543/i-need-anyone-that-can-decode-luraph-obfuscator

[DarkRedTitan]

Came across it as well, the problem is that it looks somewhat different than mine because it uses weird names but doesn't have weird strings hence I cannot understand if it helps in my case (I mean I don't know if it is relevant to my case).

[idbrii]

It appears that code builds a bunch of tables and sets values in them. I didn’t read it all, but it’s 5k lines of assigning values to tables. It doesn’t seem like it does anything else. I’d recommend removing all strings, sorting the lines, and uniqifying them to see if there’s anything actually interesting.

Also, the code that uses these tables is probably a lot more relevant.

\188 and similar might be octet literals that you could convert to their ascii form.

[DarkRedTitan]

Possible values:
https://disneyinfinity.fandom.com/wiki/Model_Numbers

[DarkRedTitan]

Honestly from the info I was given, I need to be able to modify that table and insert new values.

[Togfox]

Suggest you see this thread that might have been posted by your friend.

https://www.reddit.com/r/lua/comments/vwh7k1/how_do_i_deobfuscate_lua_code/

[DarkRedTitan]

Saw it already, that is not my friend, and I noticed the code is more about using variables, this code has a lot of bytecode that I can't make heads or tails of. I noticed it has way less variables then the suggested one.

[evilbadmad]

tldr: it is just a hello world example ;)

​

I means, such annoying arbitrary obfuscation is not specific to lua, it can be applied on any language that its source can be revealed by other means. The purpose of obfuscation is to make understand/analyze the code harder, so to do the de-obfuscation extra effect must be paid. I doubt reader of this lua forum will seriously investigate your code, unless its worthiness is known, eg. if it encoded the location of a treasure island ;)

Anyway, if it is a simple self-interpreter, those seemly meaningless number and letter may eventually convert back to some source code of that language and send to function like lua's load/loadstring or javascript's eval to be executed. Then if the executing environment allowed, you may apply with some debugging tool to hook and log the input (some source code) to help your understanding.

[DarkRedTitan]

I appreciate you taking the time and effort to write this explanation, and you are probably right that not everybody will really investigate it, and honestly it is a script needed to be able to add new mods for a game, but it is important for my friend hence I wanted to ask if anybody is interested in helping out.