LUA Decryption

[undrgrnd59]

Certain UI mods these days are scrambling their LUA code. God knows what the UI mod is really doing when you can't view the code for yourself, it just isn't safe. From some primary research I've *heard* that it isn't that hard to unscramble the code, but I don't know for sure how. Does anyone have any links that could help out here? If there is programming needed (which I wouldn't be surprised to hear) I know C#...

[Saiket]

Which addon are you attempting to decrypt? I've taken a look at Carbonite, but that one's encrypted and obfuscated beyond all comprehension. Once you have the original source decrypted, the code looks like "function lolreturn ( elseend, roflwhile ) return elseend + roflwhile; end"; essentially they use a program to automatically remap actual variable names to made-up combinations of Lua reserved words and "lol", "rofl", etc.

Here's a tip for the first decrypting process based on my experience with Carbonite: before the addon has a chance to load, hook the "loadstring" and "RunScript" types of functions and save the arguments passed to them while the addon loads. Even if the encryption is recursive, you'll eventually see arguments of real decrypted code passed through. Save them in a saved variable and do what you will with the results.

Let me know if it isn't Carbonite you're looking at though so I can take a look. I enjoy the challenge, heheh.

[Stew]

Originally Posted by Saiket

Which addon are you attempting to decrypt? I've taken a look at Carbonite, but that one's encrypted and obfuscated beyond all comprehension. Once you have the original source decrypted, the code looks like "function lolreturn ( elseend, roflwhile ) return elseend + roflwhile; end"; essentially they use a program to automatically remap actual variable names to made-up combinations of Lua reserved words and "lol", "rofl", etc.

Here's a tip for the first decrypting process based on my experience with Carbonite: before the addon has a chance to load, hook the "loadstring" and "RunScript" types of functions and save the arguments passed to them while the addon loads. Even if the encryption is recursive, you'll eventually see arguments of real decrypted code passed through. Save them in a saved variable and do what you will with the results.

Let me know if it isn't Carbonite you're looking at though so I can take a look. I enjoy the challenge, heheh.

Yes, carbonite is probably the worst thing to try and understand, but i'm sure someone will figure it out eventually

[undrgrnd59]

Originally Posted by Saiket

Which addon are you attempting to decrypt? I've taken a look at Carbonite, but that one's encrypted and obfuscated beyond all comprehension. Once you have the original source decrypted, the code looks like "function lolreturn ( elseend, roflwhile ) return elseend + roflwhile; end"; essentially they use a program to automatically remap actual variable names to made-up combinations of Lua reserved words and "lol", "rofl", etc.

Here's a tip for the first decrypting process based on my experience with Carbonite: before the addon has a chance to load, hook the "loadstring" and "RunScript" types of functions and save the arguments passed to them while the addon loads. Even if the encryption is recursive, you'll eventually see arguments of real decrypted code passed through. Save them in a saved variable and do what you will with the results.

Well the addon in question is definitially Carbonite. To be completely blunt I paid for two months it thinking I'd get that version forever, but they make it expire after two months so that you have to keep on paying for it. In my mind I paid for the product at that time, I don't care about further updates, and I want to at least change it so that it won't expire.

Unfortunately I thought this would be a wee bit easier since its LUA (as opposed to something like C++), and I've never reverse-engineered before, so your post isn't exactly encouraging How does the WoW engine load that garbled trash anyway? I'de like to at least get to poke around the "lol" code and see if I could search for the part about 'Expired' and delete it hah. Of course I have no idea how hard it is to get to that point so if you think its too much just lemme know.

[Saiket]

To be honest, it's probably more trouble than it's worth. I never did understand the first layer of encryption it used; I only found a way to let it decrypt itself for me. It takes a lot of effort even to get that far though, and I've been writing addons since the game went public.

Every once in a while I see someone post here about cracks for it, but they're really primitive and difficult to get working. Here's one example, but from the looks of the replies I'm not sure it works: [Only registered and activated users can see links. ]

[undrgrnd59]

Woo, well thanks for that link. The UI code seemed to be broken with the download (when I clicked on the Carbonite button it popped up an error). Of course nobody else mentioned this problem so it was probably just me. Everything else *seemed* like it should work other than that though :P Either way it's progress thanks again.