This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=4777

JeasonOK, posted Thu Aug 17, 2017 8:46 am (25615)

---

Hey guys I have a luac file and I will to decode for example it looks like this:

MvbRlaC-UE??*5?IuOD")
C!Ac-?e:AUiu??S??N?Ue?'_U-so
o?kE8 V???Uno
>XgO?oP-UOa6??dvdy(e

Game:MTA(Multi Theft Auto GTA:SA)
Filename:sourceC.luac

aluigi, posted Thu Aug 17, 2017 8:52 am (25617)

---

I'm not aware of compile lua files that start with those bytes.
You forgot two mandatory things when opening a topic here: name of the game and sample file.

aluigi, posted Thu Aug 17, 2017 3:44 pm (25631)

---

*edit*
Final script working with all the versions of netc.dll (1.5.4 and 1.5.7, both win7 and xp versions):
http://aluigi.org/bms/luac_mtasa.bms
*edit*

You can use this script for quickbms to decrypt any script built with both the "some" and "more" obfuscation provided on http://luac.mtasa.com
No reverse engineering, just simple calling of the same DeobfuscateScript function used by the software to do the same job:

Code:

quickbmsver "0.8.0"
set MEMORY_FILE10 string "
void memcpy(unsigned char *out, unsigned char *in, int size) {
    for(int i = 0; i < size; i  ) out[i] = in[i];
}"
#calldll "netc.dll" "InitNetInterface" "__stdcall" CNET   # useless and quickbms can't do "[CNET] 0xa0"
get NAME filename
get SIZE asize
log MEMORY_FILE 0 SIZE
math RET_BUFF = 0
math RET_SIZE = 0
# static functions offsets for mtasa 1.5.4: 0x1a6a0 and 0x1ac20 (xp)
# netc.dll 1.5.4 and pthread.dll must reside in the same folder of quickbms.exe
calldll "netc.dll" 0x1a6a0 "__stdcall" RET MEMORY_FILE SIZE &RET_BUFF &RET_SIZE NAME
math RET & 0xff
if RET == 0
    print "Error: DeobfuscateScript failed"
    cleanexit
endif
log MEMORY_FILE 0 0
putvarchr MEMORY_FILE RET_SIZE 0
calldll MEMORY_FILE10 "memcpy" "tcc" "" MEMORY_FILE RET_BUFF RET_SIZE
get NAME basename
get EXT extension
string NAME   "_decrypt."
string NAME   EXT
log NAME 0 RET_SIZE MEMORY_FILE

Notes: netc.dll 1.5.4 and pthread.dll must reside in the same folder of quickbms.exe

Teancum, posted Thu Aug 17, 2017 10:31 pm (25660)

---

A bit off topic, but related to LUA, is there any reliable way to decompile 5.0.1? Luadec and unluac.jar don't handle it. I can provide a sample.

Decro, posted Fri Aug 25, 2017 1:30 pm (25850)

---

Sorry for such a stupid question, but i was using the code posted above, and got an error. So, what is that error means and is there a way to fix it?



sample file: FILE

aluigi, posted Fri Aug 25, 2017 1:47 pm (25851)

---

Probably you are using a version of netc.dll which is not the current 1.5.4.
It's clearly written in the notes.

It has been successfully tested with both the normal and xp dll (on both winxp and win 7, 8, 10).

Decro, posted Fri Aug 25, 2017 1:57 pm (25852)

---

Eh, i'm sure that i'm using the latest versions of those dll's, directly from MTA:SA 1.5.4 Client ( also tryed both: XP/Vista and Win7/8/10 versions)

aluigi, posted Fri Aug 25, 2017 2:04 pm (25853)

---

0b76a660f284a581de528366914b6ef4 netc.dll
a28a94b7977afa95aff32e043efa1add netc.dll (XP)

aluigi, posted Fri Aug 25, 2017 2:08 pm (25854)

---

Ok I found what's the problem, we are both right
The issue is a micro update of mtasa, my version was 1.5.4.11664 while now it's 1.5.4.11668

*edit* in the meantime I have attached the original netc.dll (Win7 version)

mtasa_netc_1.5.4.11664.zip

Decro, posted Fri Aug 25, 2017 2:22 pm (25855)

---

Thank you very much. It works now for me

aluigi, posted Fri Aug 25, 2017 2:41 pm (25859)

---

In case someone doesn't want to use that dll, you can use this simple script to get the address to use in the script at the place of 0x1a6a0:

Code:

findloc OFFSET binary "\x10\x31\x00\x00\x00"
math OFFSET   5
math OFFSET   0xa0
goto OFFSET
get DeobfuscateScript long
math DeobfuscateScript - 0x10000000
print "DeobfuscateScript %DeobfuscateScript|x%"

Just run quickbms, select the script and select your netc.dll, it will display something like:
DeobfuscateScript 0x0001abb0

Decro, posted Fri Aug 25, 2017 2:51 pm (25860)

---

Thx for the tip. But now there is another problem. I thought I would be able to decrypt the resulting file by the old methods (luadec and unluac), but they are not able to perform this task even after deobfuscation. Got to find something that may help me doing this.

Zako, posted Tue May 01, 2018 3:49 am (34553)

---

Hello, i found a code on this forum to encode luac scripts from MTA but this is only working with old files. Is there any way to make this program working for new luac files.

I think they added a new feature on the compiler system, but im not sure.

Here is the link to the compiler:
https://luac.mtasa.com

Here is the link to the old post:
viewtopic.php?t=4777

aluigi, posted Tue May 01, 2018 10:20 am (34558)

---

Merged the post in the previous topic.

So do you mean there is a new encryption method or something similar?
Have you used the dlls from version 1.5.4? It was confirmed to work correctly.
luac.mtasa.com mentions version 1.5.2 as the older covering the latest type of encryption so 1.5.4 was ok

Zako, posted Tue May 01, 2018 11:59 am (34564)

---

I have tried to decode luac files from 1.4 and it was working. Then i tried to decode luac files from mta 1.5.4 with the 1.5.4 dll's. it removed the extra obfuscation from the file but when i try to uncompile it with another program named 'unluac', im getting a empty file.

Maybe unluac got a problem or mta made something new in the compiler.

aluigi, posted Tue May 01, 2018 3:35 pm (34572)

---

Yeah it's perfectly possible.
At least decryption is excluded

GodOfPenguins, posted Tue Jun 26, 2018 1:00 pm (36216)

---

Can somehow decompile this code? I used the script for MTA (result - client_core_decrypt.luac), but it did not change much. Unluac cant help.

aluigi, posted Wed Jun 27, 2018 3:31 pm (36233)

---

Post moved in the original topic.
Check the topic in case there are some useful information.

GodOfPenguins, posted Wed Jun 27, 2018 5:49 pm (36243)

---

I think that this is still possible. The script from the archive is partially decompiled, maybe this will somehow help.

lamjed001, posted Fri Aug 31, 2018 11:16 am (37976)

---

Thank You Man!

aluigi, posted Sat Sep 01, 2018 12:41 am (38003)

---

You must use the 1.5.4 dlls provided in the previous post viewtopic.php?p=25854#p25854

Chris, posted Tue Sep 04, 2018 9:37 am (38097)

---

You can't decompile 2 - More (From 1.5.2-9.07903) extra obfuscation after this deobfuscator with luadec/unluac because the MTA Team changed something in Lua bytecode format :/
I downloaded MTA source code and called the luac deobfuscator function from net.dll when the server start, but the result is same.

Zako, posted Sun Dec 23, 2018 11:03 pm (41592)

---

hello aluigi,

I think that you got the most experience with quickbms. Is it possible for you to update the code or the program, so we can use it on mta 1.5.6 files? The current one is not working anymore.

I found out that we can uncompile '1 - Some', and that '2 - More (From 1.5.2-9.07903)' is not working with the current one. So the current code is only removing the encryption of 1 and not from 2.

aluigi, posted Thu Jan 10, 2019 7:21 pm (42136)

---

I can't check right now but I doubt there has been any change in the encryption.

If the lua file is compiled then that's a different thing.
Encryption is solved, decompiling is up to you.