This is Lua from some game. I would like to modify and use this. But it's obfuscated.
Here's the structure I figured out:
For example, entering a chat calls the following Lua file.
return function (self,type,message) _G["\u{5F}\u{49}\u{06B}\u{49}\u{6B}\u{6B}\u{6C}\u{06B}\u{49}\u{069}\u{6B}\u{69}\u{006C}\u{6C}\u{049}\u{0069}\u{06C}\u{6C}\u{006B}\u{69}\u{6C}\u{06B}\u{06C}\u{49}\u{6B}\u{0069}\u{06C}\u{0069}\u{49}\u{006B}\u{0069}\u{6C}\u{69}"]["\u{049}\u{0069}\u{6B}\u{69}\u{049}\u{6B}\u{049}\u{006C}\u{69}\u{6B}\u{006C}\u{69}\u{06C}\u{6B}\u{6B}\u{69}\u{6C}\u{6C}\u{0069}\u{06B}\u{6B}\u{6B}\u{006C}\u{69}\u{6C}\u{06C}\u{49}\u{006C}\u{049}\u{49}\u{49}\u{6C}"][(530247052)-(442715560)+(417474590)](self,type,message) end
The code calls an unknown global variable. I also found a file with many unreadable global variables defined.
First, I performed the following calculation (530247052)-(442715560)+(417474590). The result is 505006082
There was a similar pattern in the "chunk.lua" file where global variables were defined. Here are some of them:
[(1437643653)+(1949875078)-(2882512649)]=function(__a0,__a1,__a2)local ikiikkiKKk=223266510;ikiikkiKKk+=1811079080;(function(_iI0l1liIioIl,_o01ilio0oI00,_io0l1lioiIo1)local _1o0iIi1o1lo1=_iI0l1liIioIl[_G["\u{5F}\u{6C}\u{6B}\u{6B}\u{049}\u{006C}\u{49}\u{06B}\u{6B}\u{049}\u{06B}\u{49}\u{69}\u{0069}\u{006B}\u{6B}\u{049}\u{0049}\u{6C}\u{6B}\u{49}\u{49}\u{6C}\u{6C}\u{69}\u{69}\u{049}\u{0049}\u{049}\u{06C}\u{0069}\u{069}\u{6C}"]["\u{69}\u{06C}\u{6C}\u{6C}\u{069}\u{006C}\u{49}\u{69}\u{6B}\u{0049}\u{69}\u{06B}\u{0049}\u{6C}\u{6C}\u{69}\u{69}\u{49}\u{006B}\u{006B}\u{06C}\u{006B}\u{69}\u{069}\u{0049}\u{06B}\u{069}\u{049}\u{06B}\u{0049}\u{69}\u{049}"][(1155173479)+(1577632519)-(1688057523)]][_G[_G["\u{05F}\u{0049}\u{6C}\u{69}\u{06B}\u{49}\u{49}\u{6C}\u{006C}\u{69}\u{6B}\u{49}\u{6B}\u{6C}\u{006B}\u{0049}\u{69}\u{69}\u{49}\u{6C}\u{0069}\u{69}\u{06C}\u{6C}\u{06B}\u{049}\u{69}\u{006C}\u{6C}\u{0049}\u{49}\u{006C}\u{0069}"]["\u{06C}\u{006C}\u{6C}\u{6C}\u{006B}\u{0069}\u{49}\u{49}\u{6C}\u{69}\u{6C}\u{0049}\u{49}\u{6C}\u{6C}\u{6C}\u{6C}\u{69}\u{0069}\u{49}\u{0069}\u{6C}\u{6B}\u{6C}\u{6C}\u{49}\u{0049}\u{6C}\u{6C}\u{6B}\u{06B}\u{69}"][(1334598761)+(865866175)-(2122149422)]][_G["\u{005F}\u{006C}\u{006B}\u{06B}\u{49}\u{6C}\u{49}\u{006B}\u{6B}\u{49}\u{6B}\u{49}\u{069}\u{0069}\u{6B}\u{6B}\u{49}\u{0049}\u{6C}\u{6B}\u{0049}\u{49}\u{06C}\u{006C}\u{0069}\u{0069}\u{049}\u{49}\u{49}\u{6C}\u{69}\u{69}\u{06C}"]["\u{69}\u{6C}\u{006C}\u{06C}\u{0069}\u{6C}\u{49}\u{0069}\u{6B}\u{49}\u{69}\u{06B}\u{49}\u{6C}\u{6C}\u{69}\u{69}\u{49}\u{06B}\u{006B}\u{006C}\u{06B}\u{69}\u{69}\u{49}\u{6B}\u{0069}\u{49}\u{6B}\u{0049}\u{069}\u{49}"][(475540248)+(1474562382)-(1625698704)]]]local _1oiI0I1o1l0i={}for _1l0IoI1l1ioi=1,10000 do _1oiI0I1o1l0i[_1l0IoI1l1ioi]=_G["\u{5F}\u{06C}\u{06B}\u{006B}\u{049}\u{6C}\u{49}\u{006B}\u{6B}\u{049}\u{06B}\u{0049}\u{069}\u{069}\u{06B}\u{006B}\u{49}\u{49}\u{6C}\u{6B}\u{049}\u{49}\u{6C}\u{6C}\u{69}\u{0069}\u{49}\u{49}\u{0049}\u{006C}\u{0069}\u{69}\u{6C}"]["\u{69}\u{6C}\u{06C}\u{6C}\u{69}\u{6C}\u{49}\u{0069}\u{06B}\u{49}\u{069}\u{006B}\u{0049}\u{006C}\u{06C}\u{0069}\u{0069}\u{049}\u{6B}\u{6B}\u{6C}\u{006B}\u{69}\u{0069}\u{49}\u{6B}\u{069}\u{49}\u{06B}\u{49}\u{069}\u{49}"][(460084513)+(758444488)-(-873305452)]end
(1437643653)+(1949875078)-(2882512649) A function is defined in a global variable. The reason I imported this part is because the result of (1437643653)+(1949875078)-(2882512649) is the same as the result "505006082" calculated in the file above. And it has the same three parameters.
But I don't know how to proceed from here.
What should I try next? and Is what I'm currently trying getting closer to the answer?
Everything is described above. I need a tool or someone who knows how to solve this.
These \u{xxx} are UTF-8 encoded characters, you can just print them using lua to get its original value, e.g.
print("\u{5F}\u{49}\u{06B}\u{49}\u{6B}\u{6B}\u{6C}\u{06B}\u{49}\u{069}\u{6B}\u{69}\u{006C}\u{6C}\u{049}\u{0069}\u{06C}\u{6C}\u{006B}\u{69}\u{6C}\u{06B}\u{06C}\u{49}\u{6B}\u{0069}\u{06C}\u{0069}\u{49}\u{006B}\u{0069}\u{6C}\u{69}")
You will get _IkIkklkIikillIillkilklIkiliIkili. Keep converting all these similar strings, e.g. the first function can be deobfuscated to:
return function (self,type,message)
_G["_IkIkklkIikillIillkilklIkiliIkili"]["IikiIkIliklilkkillikkklillIlIIIl"][505006082](self,type,message)
end
Obviously these keys and variable names are also obfuscated. You can further replace them with short names, it should be easier to search for relevant information in the code.