This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=16157

xored, posted Thu Dec 02, 2021 11:36 pm (67809)

---

Hi

So, I have a lua compiled file and I couldn't decompile it using LuaDec or another tool, all tools give me "bad header".
As I saw on HxD the header starts with "LuaQ" so it's a Lua 5.1 file.

This is the header:
1B = Escape
4C 75 61 = Lua signature "Lua"
51 = version (5.1)
00 = Format
01 = Endianness (Little endian)
04 04 04 04 00 = Size of types

I can't decompile this script and I don't know why.
I think quickbms can help me out with it, if someone can provide a quickbms script for this or can help out, I'll be really appreciated.

I'm attaching the file on this topic if someone needs it to analyse it.

Thanks in advance.

atom0s, posted Fri Dec 03, 2021 1:55 am (67812)

---

The header looks fully in tact as-is. However, the byte code looks like it was probably altered. You'd need to reverse the target and check to see if they modified the order in which Lua is handling the byte code, as well as if they altered how the byte code is stored/interpreted.

xored, posted Fri Dec 03, 2021 11:47 am (67828)

---

atom0s wrote:

The header looks fully in tact as-is. However, the byte code looks like it was probably altered. You'd need to reverse the target and check to see if they modified the order in which Lua is handling the byte code, as well as if they altered how the byte code is stored/interpreted.

Thanks! This will certainly help me to figure it out.