luareverse-engineeringdeobfuscationgarrys-mod

I need help deobfucate gLua code but cannot find any solutions


I am trying to de-obfuscate a .glua file (Garry's Mod Lua) but failing since there is no programs (to my knowledge) that assists with de-obfuscating .glua. This is what the glua code looks like: menu.lua

LuaCmd.lua

If anyone has experience de-obfuscating .glua or any de-obfuscation knowledge such as reverse-engineering that would help me out a lot. Thank you!


Solution

  • At the start, the script declares a variable with a non-breaking character as the global table to confuse people trying to read the script.

    The strings that contain "\(numbers)" are character codes that are parsed as regular characters. Example:

    > string.byte("h")
    104
    > "\104\104\104"
    "hhh"
    

    As the script goes on, it keeps declaring variables and functions with x amount of non-breaking characters, to also confuse you even more when trying to read the script. If you replaced the non-breaking characters with a random letter (lets use A) with a program like Notepad++ (here's a tip: turn on "view all characters"), you would see something along these lines (line breaks are added for readability purposes):

    local A = _G
    local AA = A[something]
    local AAA = A[something else]
    local function AAAA(params)
        -- code here
    end
    -- some other code here
    AAAA(something, something)
    AAA[something](something, something)
    

    Those are just some tips on how to make the code just a bit more readable. Internally, functions may use some more obfuscation to additionally confuse people who get past the non-breaking characters and other "obstacles".

    Most obfuscated scripts are basic "convert the character into \character code and load/runstring or use a HTTP fetch request and run the code" that can be de-obfuscated real easily. With code like this, you will have to spend a little more time to get something that you can read and have an understanding of.

    Here's a code snippet that is obfuscated in a similar manner by which your code snippet is obfuscated. Doing the things suggested above results in:

    local A = _G
    local AA = A['string']
    local AAA = A['bit']['bxor']
    local function AAAAAAA(AAAA)
        return AAAA
    end
    

    which is just a script declaring a couple of local variables and then declaring a local function that returns the first argument.

    Of course that could be simplified more, but if you wanted you could go and give every variable different names which would make it more readable.