Gerys, posted Sun Nov 01, 2020 8:56 pm (59894)

---

Quickbms (l32/l64).

Write to pm.

leone98, posted Sun Nov 15, 2020 11:26 am (60284)

---

hello i use l64decode for python but when open the script python closse immediatly why? thanks for help

leone98, posted Mon Nov 16, 2020 10:44 pm (60342)

---

Hello i try to convert the l64 to lua with l64 decoder but when run the script with cmd with administator mode, the file not convert in lua. Help me thanks

aluigi, posted Tue Nov 17, 2020 8:22 am (60351)

---

@leone98
Please don't open new topics.

random418, posted Wed Dec 09, 2020 9:38 am (60996)

---

Mmtrx wrote:

Ok, solved. The l64 files are obfuscated by a 64-bit key that gets decreased by 8 for each consecutive 8-byte block. After de-obfuscating, you can feed the l64 files to luajit-decompiler to get readable Lua sources.

Hi, could you explain how to de-obfuscate the l64 files? I've been able to run through every step, but when using the LuaJit decompiler, I get an I/O error for most files, probably due to the obfuscation you described.

leone98, posted Wed Dec 09, 2020 10:15 pm (61017)

---

@random418, read privatemessages that sent thanks

leone98, posted Thu Dec 10, 2020 8:48 am (61029)

---

random418 wrote:

Mmtrx wrote:

Ok, solved. The l64 files are obfuscated by a 64-bit key that gets decreased by 8 for each consecutive 8-byte block. After de-obfuscating, you can feed the l64 files to luajit-decompiler to get readable Lua sources.

Hi, could you explain how to de-obfuscate the l64 files? I've been able to run through every step, but when using the LuaJit decompiler, I get an I/O error for most files, probably due to the obfuscation you described.

random418 read the private messages thanks

Tbfarmer, posted Sun Jan 31, 2021 11:10 pm (61951)

---

Mmtrx wrote:

Seems that the .l64 luajit byte code files have been encrypted, after being dumped with luajit. If somebody could find the decrypt algorithm, I could use a luajit-decompiler to get (close to) the original Lua source. Based on the 2 files by kenny2801, I attach a sample of the plain and encrypted .l64 files.

Ok, solved. The l64 files are obfuscated by a 64-bit key that gets decreased by 8 for each consecutive 8-byte block. After de-obfuscating, you can feed the l64 files to luajit-decompiler to get readable Lua sources.

Since I was interested in the field mission system, I attach AbstractFieldMission.lua, AbstractMission.lua as an example.

How do you deobfuscate the file?

Mmtrx, posted Mon Feb 01, 2021 11:30 am (61957)

---

You can find a deobfuscator here: https://github.com/chill1Penguin/l64decode

thediabl0, posted Mon Feb 01, 2021 4:06 pm (61963)

---

Mmtrx wrote:

You can find a deobfuscator here: https://github.com/chill1Penguin/l64decode

I can run shapesUnlocker.py with python 3.9, but l64decode.py I can't see nothing...

wisniagames239, posted Wed Feb 03, 2021 7:19 am (61981)

---

thediabl0 wrote:

Mmtrx wrote:

You can find a deobfuscator here: https://github.com/chill1Penguin/l64decode

I can run shapesUnlocker.py with python 3.9, but l64decode.py I can't see nothing...

You can run the script using cmd where you give the input and output path, but I didn't do it myself, because the message "Python" pops up

MrPersistent, posted Wed Jul 21, 2021 7:20 am (65287)

---

Hi, apologies for asking the same question, however I've been trying to get this method figured out for a long time. I have the l64 files which I use l64decode.py to decode but the end result is still in hex form and very hard to read.

Not sure if this is obfuscated or not. I tried to use the recommended luajit decoder on them but it states "cannot load incompatible bytecode".

Hopefully I'm on the right track at least.

I would greatly appreciate any help.

MrPersistent, posted Sat Jul 24, 2021 2:11 am (65327)

---

I got it working! The batch file luajit decompiler did not work for me, non of the 3 versions of it did.

This l64decode works great for converting the l64 files. Then to convert the LUAjit files it outputs, I used this luajitdecomiler.

This is the argument to use with l64decode's "l64decode.py" to convert all files in a folder and output them into a new folder.

--recursive "C:\Users\username\Documents\Script Extraction\source" "C:\Users\username\Documents\Script Extraction\luajit"

This is the argument to use with the luajitdecomiler's "main.py" to convert all files in a folder and output them into a new folder.

--recursive "C:\Users\username\Documents\Script Extraction\luajit" --dir_out "C:\Users\username\Documents\Script Extraction\luajitConverted" --catch_asserts

optional use of "--catch_asserts" on the end of luajitdecomiler's argument is to "Prevent most integrity asserts from canceling decompilation"

-Don't output your converted files in the same folder or in a subfolder of the source folder as the converting process will try to read them aswell which will throw some errors and create blank doubled files..

Success at last

Thank-you to everyone and this forum!

Gerys, posted Sun Sep 26, 2021 9:07 am (66659)

---

Cool, he finalized the code. The if a ~ = b error when correct if a == b no longer appears).

Gerys, posted Sun Sep 26, 2021 9:28 am (66661)

---

There is a new error, now the function a (nil,, 23) does not write nil everywhere, although you need a (nil, nil, 23) .... ))

Gerys, posted Sun Sep 26, 2021 9:29 am (66662)

---

This is what I mean luajitdecomiler