5

I've been experimenting with decompiling Lua bytecode and found useful tools like unluac, and LuaAssemblyTools. Unluac seems to do the trick with lua scripts compiled with luac giving me almost the exact source code, however when I convert lua script to bytecode using the code:

file:write(string.dump(loadfile(filename)))

I get a different output than with luac, however they are very much the same being only a byte extra at (a lot of) different places. Now this new file will give me an IllegalState exception from unluac and when I try to run the bytecode file (created by the code line above) in luac with the -l option I get:

C:\MyDir>luac -l stringdumped.txt
luac: stringdumped.txt: bad integer in precompiled chunk

So there is clearly a difference between string.dump and luac, even though it is suggested here: http://lua-users.org/wiki/LuaCompilerInLua to use string.dump as an emulator for luac.

Could anyone explain the difference to me, and suggest how I would go about reversing a string.dump "compiled" script?

3

There is virtually no difference between the bytecode emitted by loadfile and luac. The only possible reason for the error you are getting is that you are opening the file stringdumped.txt in text mode. Try the following code and see if there are any errors

f = io.open("stringdumped.txt", "wb") --Note that file is opened in binary mode
f:write(string.dump(loadfile("sample.lua")))
f:close()

Since there is no difference, the output file stringdumped.txt can both be run by the lua interpreter as well as decompiled by unluac. The reversing steps too are exactly similar as you would do with any other compiled lua scripts.

| improve this answer | |
  • Aha, but how can one disassemble the output of string.dump? Wrapping loadstring or loadfile around would just give the instruction to load the filename or byte-string. – Dennefyren Jul 12 '14 at 11:12
  • @Dennefyren Forget the previous answer, see the updated one. – 0xec Jul 12 '14 at 18:22
  • Oh wow I am such an idiot! Didn't realize I needed binary mode. Thank you! – Dennefyren Jul 13 '14 at 23:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.