Finding lua C functions compiled binary

Question

So i am trying to "hack" a game however not for cheating purposes. I am looking to extend the games scripting functionality through a DLL that can look for processes and return them. The game I am looking to do this for is Train Simulator (i know, don't laugh) and the game uses lua to script all of the engine functionality within the game. All the 3rd party devs get to see is the lua script that they write.

Inside the games lua there is core functions. The main ones:

function Initialise()

end

function Update(time) -- time is the interval since the last update

end

There is also C functions that are used as such:

Call("SetControlValue", name, index, value)
or
Call("GetIsPlayer")

These return different values.

What i have so far with my DLL is as follows:

#include <windows.h>


BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        /* The DLL is being loaded for the first time by a given process.
        Perform per-process initialization here.  If the initialization
        is successful, return TRUE; if unsuccessful, return FALSE. */
        MessageBoxA(0, "TSDll has been attached !", "Train Sim Dll", MB_ICONEXCLAMATION | MB_OK);
        break;
    }
    return TRUE;
}

And this works. In my train sim engine script i am using the loadlib library to load the DLL.

libinit, err = loadlib("plugins\\TSDll.dll", "libinit")
if _G["libinit"] then 
    Print("TSDll Library Loaded!")
    libinit()
else
    Print("loadlib on TSDll failed: ")
    Print(err)
end

And i get this result:

So the dll initialises properly.

The problem i face is that the Lua library is directly built in to the game binary (as far as i know) which means i am unable to reference lua.dll for fundamental functions such as lua_pushstring. Does anyone here know how i can find the address of these functions. I know a dll like this has been made before but the person who did it has been very secretive about how it has been done.

Thanks, Dan

Answer 1

As you said, the Lua engine is embedded directly into the game. It's inside plugins/GameManagerVC.dll (or GameManagerVC64.dll in case of 64-bit). So, first step will be finding out, which version of Lua it is. So put this DLL into Ghidra or IDA Pro. The most easiest way of figuring out, what version of Lua it uses, is by searching for "Lua" string in string list (In case of IDA Pro Views > Open Subviews > Strings). In case of Train Simulator, we found Lua 5.0.2. Then we should download the Lua 5.0.2 source code, so we can search for functions. The easiest way of search for functions, is by picking some function, which have some strings, and search those strings in your disassembled file. Then rename them, look for references, etc. This way, you shold be able to find all functions, you're looking for.

Answer 2

The best way you can get access to Lua when it's statically linked to the game is by writing a detour to the lua_gettop() method in the Lua library. I actually wrote a guide explaining how to do this with the Microsoft Research Detours Package. See my guide here, which explains how to hook the method and the lua_State here.

Example Detour Code

typedef int(__cdecl *gettop)(unsigned long);
gettop lua_gettop_p = (gettop)0x18121A870; // Might change if the game updates

unsigned long lua_State = 0;

// This is our version of the gettop function from IDA
DWORD _gettop(__int64 state)
{
    // If Lua State is not already set then log it and set it
    if (lua_State == 0) {
        lua_State = state;
    }

    // This is from the decompiled function and cannot be changed
    return (unsigned long)(*((QWORD *)state + 2) - *((QWORD *)state + 3)) >> 4;
}

// Here we setup the detour to "replace" the games function with ours
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DetourAttach(&(LPVOID&)lua_gettop_p, (PBYTE)_gettop);
DetourTransactionCommit();