So, I have a program which I am 99% sure it is using Lua as when I look at string references I see this:
Which I am understanding that somewhere in this program they have statically linked a Lua C or something of the sort, so I did a quick Google for Lua 5.2.1 Libraries, I found this which is a link to the Source Forge for Lua static libraries for 5.2.1, so I downloaded it, opened up the IDA SDK, and ran:
.\pcf.exe .\lua52.lib .\lua52.pat
which returns:
...\lua52.lib: skipped 0, total 793
Which I interpret to understand it found 793 signatures or something similar, so then I ran:
.\sigmake.exe .\lua52.pat .\lua52.pat
Which returns an error;
.\lua52.pat: modules/leaves: 767/793, COLLISIONS: 1
See the documentation to learn how to resolve collisions.
Which I assume meant I had to use the -r switch, so I reran it
.\sigmake.exe -r .\lua52.pat .\lua52.sig
It generated no errors and produced the sig file, so I dropped it in the sig directory in IDA which lets it show up, so when I go to apply
it shows up which I expected, I add it to IDA, it tells me there are
references, but nothing I am "sure" is Lua gets renamed? Is that expect or not? I know this line
sub_140856EE0(v1, (__int64)"field '%s' missing in date table", "year");
is Lua because when you google the middle field it tells it's a Lua using a Lua function. Finally I've ran a reanalyses to make sure it looks back through the file to give it a once over.
Have I missed something obvious here?
