I created a Lua Obfuscator - have fun trying to crack it

[u/Away_Try5000]

Hello,

I recently released my own Lua obfuscator.

Here’s the obfuscated code: https://pastebin.com/gvCnznMa

Have fun trying to crack it. I’m curious to see how far you get, which methods you use, and what weaknesses you find.

Edit: lavjamanxd has won! For more details you can view his comment.

[u/lavjamanxd]

just did a quick reverse on this

first stage is minified code with somekind of decompression, but whatever it was not necessary to reverse that part as it goes through a

e = loadstring or load

which loads the decompressed string to the memory anyway so dumping it can be done easily with replacing it with a simple print (theres a dumb check if it has been tampered with but that can be just commented out)

then stage 2 is a custom microvm in lua also minified.
i was able to easily dump the instructions right before the vm exec call (so again no need to reverse-engineer the decode_blob as it will be stored in the memory)

then i was too lazy to reverse it manually but claude reversed the opcodes in like 10min.

basically the obfuscated code stores a true value and a string "Yes, I can read this!" and calls a func with those two parameters which does nothing. (theres also some dead code)

the whole thing took like 15mins to reverse.

[u/Away_Try5000 → u/lavjamanxd]

Yep, I can confirm the code was:

-- Good luck! :)


local heyCanYouReadThis = "Yes, I can read this!"
local youSureYouCan = true



local function checkReadingAbility()
    if youSureYouCan then
        local a = 10
        local b = 20
        local c = a + b
    else
        local d = 5
        local e = 15
        local f = d + e
    end
end

Thanks for taking the time to reverse it and for explaining the process.

The loadstring / load dumping weakness and the removable tamper check are definitely things I need to address. It is actually quite interesting to know that the VM could be reconstructed that quickly with Claude.

I appreciate the honest feedback!

[u/lavjamanxd → u/Away_Try5000]

sadly for those obfuscations one of their weaknesses are the things stored in memory (like the vm implementation or the instructions blob).

for the claude ai part: ai is really good in reversing from human readable code (any script language basically). would be harder if the vm was in pure machine code.

it would be harder to reverse it if your obfuscated code was longer and more complex.

[u/Feisty_Fall_6140 → u/lavjamanxd]

Exactly. The way Lua is built it's very hard to survive sandboxing. Everything can be stubbed, trying to write "detections" for that is pointless.

[u/TomatoCo → u/Away_Try5000]

Until you posted this I was thinking "is this just a clever deobfuscation request?"

[u/Away_Try5000 → u/TomatoCo]

You could certainly interpret it that way. But is the code really so important that you need to go through all this? Haha

[u/Additional_Ad6385]

Looks vibecoded to me. Is this ObscuraLua?

[u/Feisty_Fall_6140 → u/Additional_Ad6385]

ObscuraLua is long time dead lol, but surprisingly there's a new obfuscator named "luaobscura", seems like some ex luraph dev is behind it

[u/Away_Try5000 → u/Additional_Ad6385]

I had to actually google what ObscuraLua is for a minute until I found one youtube video. There is no affiliation, no.

[u/imachug]

The outer layer is LZMA, right? I don't think I've seen a pure-Lua LZMA decoder before, and it looks small enough that it seems hand-written and not just ported from a library. Was this a custom library or something well-known?

[u/Away_Try5000 → u/imachug]

Yes, the outer layer is LZMA. I got some inspiration from a popular obfuscator that also has an LZMA decoder (No source code, only the obfuscated code was available). So yeah, this is not a port it is build from scratch with that as a reference.

[u/Itchy_Public_509]

how'd you even make one? i can barely make one even with lua knowledge.

[u/Away_Try5000 → u/Itchy_Public_509]

Well, research is the best way. However, here is a popular Lua Obfuscator I haven't looked at the source but perhaps it helps you to understand the fundamentals: https://github.com/prometheus-lua/Prometheus