suchisgood (12-26-2018)
Okay, so, I've been working on this for probably like 2 hours as a "fun" project.
I'll keep on adding more "mechanisms" and obfuscation strategies over the time.
If anyone got suggestions, feel free to hit me up.
Make sure not to use " but ' instead for now.
Obfuscator: https://obf.finn.gg/
suchisgood (12-26-2018)
Last edited by suchisgood; 12-26-2018 at 02:14 PM.
How to deobfuscate:
Put "RunString = print;" at top of script and run in lua executor like repl.it
Things wrong with this:
1. Making a fuck ton of globals.
2. Using stupidly long var names.
3. Using readable characters instead of zero width characters.
4. All you do to obfuscate the actual code is reverse it and convert it to decimal.
5. All you need to do is 'CompileString = function(c, n, e) return function() print(c) end end' to get the actual code.
6. A more complex way of deobfuscation would be to just convert all the decimal to characters and then you could just read the code yourself.
7. 'Lua Obfuscator by Finn'
Overall this obfuscator is pretty lame. If anybody that knows a fair bit of Lua sees one of these obfuscated scripts they'll know how to deobfuscate it. You should take a look at proper obfuscation.
Last edited by Cyaegha; 01-10-2019 at 07:11 AM.
The "Lua Obfuscator by Finn" thingy was never meant to be left in, actually I left it for debugging purposes.
Other than that, you are correct. Thank you for not insulting immediantly, but rather giving useful feedback!
Sadly there's no good ways to obfuscate Lua I'm aware of, but I am trying another technique later today.
//Edit:
1. Made them local.
2. They're used to you're having a hard time to deobfuscate it via hand.
3. Correct, will fix.
4. Added some more stuff.
5. Fixed.
6. That's why there's the long var names.
7. Removed, as I said, wasn't meant to be left.
Last edited by Fatulatti; 01-10-2019 at 06:16 PM.
Most of the problems I mentioned are still there? The only thing I've noticed that changed is using underscores instead of capital letters for the variable names.
Literally all you have to do is convert the decimal and voila, you've deobfuscated it. Your junk code isn't even junk in the way it's suppose to be, it's just bad and serves no purpose other than to increase the file size by a massive amount. You don't even remove excess whitespace in the code to make it slightly less readable without putting it through a beautifier/formatter. You're still making all of your junk variables global and literally the only obfuscation you've done to the original code is reverse it.
And what do you mean there's no good way to obfuscate Lua? Did you not look at the pastebin I posted? Most people get confused enough with !CAC's vehicle.lua and that's magnitudes more obfuscated than vehicle.lua. To make a proper obfuscator you just need to parse the code and generate an AST then rebuild it with the obfuscated changes. There are plenty of opensource Lua parsers you can paste from.
This is what I meant by converting decimal. All that's left is to reverse what's left.
this is aids, but not hard. took around 2 hours.
https://csgofoodreviews.com/bp/moat_ac.lua
is there a way to un-obfuscate a code ?!