![Cheat Engine Forum Index](templates/subSilver/images/logo_phpBB.gif) |
Cheat Engine The Official Site of Cheat Engine
|
View previous topic :: View next topic |
Author |
Message |
MrViZZion Cheater
Reputation: 1
Joined: 13 Aug 2019 Posts: 35
|
Posted: Thu Aug 29, 2019 7:34 am Post subject: how do you hack lua games? |
|
|
Such as don't starve. What i've accomplished is a really complicated compares and i am not entirely sure if they will even work on someone else's computer or stay stable during updates.
They're extremely hard to filter out between player and the million of other things that get accessed through one spot.
Is there another easier or stable method that people use for lua? Any suggestions?
|
|
Back to top |
|
![](templates/subSilver/images/spacer.gif) |
atom0s Moderator
Reputation: 200
Joined: 25 Jan 2006 Posts: 8539 Location: 127.0.0.1
|
Posted: Thu Aug 29, 2019 11:12 pm Post subject: |
|
|
I generally hook the games Lua engine and manipulate the scripts and data as needed. Given that it can be fully hooked onto easily in most cases, you can take full control of the games Lua state(s) and do basically anything you want.
_________________
- Retired. |
|
Back to top |
|
![](templates/subSilver/images/spacer.gif) |
MrViZZion Cheater
Reputation: 1
Joined: 13 Aug 2019 Posts: 35
|
Posted: Fri Aug 30, 2019 2:32 pm Post subject: |
|
|
atom0s wrote: | I generally hook the games Lua engine and manipulate the scripts and data as needed. Given that it can be fully hooked onto easily in most cases, you can take full control of the games Lua state(s) and do basically anything you want. |
Any examples or pointers?
|
|
Back to top |
|
![](templates/subSilver/images/spacer.gif) |
atom0s Moderator
Reputation: 200
Joined: 25 Jan 2006 Posts: 8539 Location: 127.0.0.1
|
Posted: Fri Aug 30, 2019 3:09 pm Post subject: |
|
|
There are a handful of examples people have done for newer titles on sites like GitHub, one for Payday 2 here:
https://github.com/JamesWilko/Payday-2-BLT
I've never released any of mine open-source so I don't have any of mine to share personally. But the jist is the same for mine. A quick little rundown of what to do:
1. Find the version of Lua the game uses. (You can search for Lua's version string information to do this. https://github.com/lua/lua/blob/master/lua.h#L19 )
2. Find the functions used for reading/writing compiled Lua chunks. (This is optional if the game uses stock Lua but this is recommended to be done to validate the size information of how their Lua instance was compiled. A small change to 1 data type can break everything if you just try to use normal compiled Lua libs.)
- Look for functions in this: https://github.com/lua/lua/blob/1fb4d539254b67e7e35ed698250c66d1edff0e08/ldump.c#L216
- Look for functions in this: https://github.com/lua/lua/blob/1fb4d539254b67e7e35ed698250c66d1edff0e08/lundump.c#L294
At this point there are two ways you can go about doing things.
1. Obtain the Lua state pointer and just use your own compiled version of Lua in an injected DLL that matches their version and modifications.
Going this route is only really recommended if you are 100% sure they are using a stock build of Lua / LuaJIT and have done nothing to it. Any changes to how Lua works, size information that you fail to correct in your compiled build, etc. will cause crashes/errors/issues. So doing this you must be sure your compiled copy of the Lua library matches theirs.
Download the copy of Lua that you found they used, make any required adjustments to the size data or types.
- Editing types/sizes is generally just through modding these:
-- https://github.com/lua/lua/blob/1fb4d539254b67e7e35ed698250c66d1edff0e08/luaconf.h (Do your main edits in this file.)
-- https://github.com/lua/lua/blob/master/lua.h#L90 (Only edit these directly if you have to.)
Once compiled, your injected DLL just needs to find the Lua state pointer and then you can just pass that to your own Lua functions compiled in your DLL.
If the modifications made line up, you're good to go and no more additional work is required.
2. Obtain pointers to all the Lua functions you require and invoke them manually.
This is the preferred method since in most cases, companies will modify their copy of Lua to change various things around. Common things changed are:
- Type sizes.
- Additional types added.
- Extended types added.
- More metatable protos added.
- Additional library modifications for things like bitwise operations, internally added things like LuaSocket, etc.
- Use of LuaJIT with modified VM operations.
- Altered byte code generation to remove the use of simple Lua decompilers.
In this event you have to find pointers to every single function and create a header that defines the protos of each of those functions. This method is preferred since you do not need to worry about making sure your compiled Lua lib matches perfectly, in this setup you do not use Lua at all in your project. You are only creating a header that implements the required defines and protos that you plan to make use of.
There are a ton of examples at this point of doing this kind of thing on GitHub and other cheat related sites. Also keep in mind Lua is not thread safe, so you need to make sure that you are not causing threading issues with invoking Lua functions from your hooks/injected dll. Generally this is done by adding your own locking mechanism or making use of one the game already has implemented to keep their Lua instance thread safe.
_________________
- Retired. |
|
Back to top |
|
![](templates/subSilver/images/spacer.gif) |
MrViZZion Cheater
Reputation: 1
Joined: 13 Aug 2019 Posts: 35
|
Posted: Fri Aug 30, 2019 5:52 pm Post subject: |
|
|
Thanks. I will check these out!
|
|
Back to top |
|
![](templates/subSilver/images/spacer.gif) |
MarcRené Newbie cheater
Reputation: 0
Joined: 20 Mar 2017 Posts: 15
|
Posted: Sun Sep 01, 2019 4:09 am Post subject: |
|
|
There's another tutorial on our forums here. (Topic-ID is 564665. I'd post the direct link, but since I'm not allowed to post URLs... *shrug*)
Since "Don't starve" is mentioned as example, this one might help you out.
When trying this technique for my own project (Victor Vran and Gauntlet Slayer Edition) I'm always getting lost between the "find lua state" and "just inject your commands" part.
|
|
Back to top |
|
![](templates/subSilver/images/spacer.gif) |
atom0s Moderator
Reputation: 200
Joined: 25 Jan 2006 Posts: 8539 Location: 127.0.0.1
|
Posted: Sun Sep 01, 2019 6:01 pm Post subject: |
|
|
For hooking onto a game like Victor Vran, you also need to hook/obtain the pointer to their Lua state critical section that they have. Calls to their Lua state should be guarded with using the critical section to prevent race conditions and stack corruption.
I haven't touched VV in a while, so thigs may have changed, but here is my old stuff from hacking that a bit for personal fun:
Main Lua State Pattern
Code: |
Pattern: A1 ?? ?? ?? ?? 8D 4D ?? 6A ?? 68 ?? ?? ?? ?? C7
Offset : + 0x01 is the pointer to the Lua state.
|
All the patterns to the usual Lua functions that are desired/used for things like this:
Code: |
/**
* Pattern Definition
*/
struct pattern_t
{
const char* Name;
const char* Pattern;
intptr_t Offset;
intptr_t Count;
};
/**
* Patterns
*/
pattern_t g_Patterns[] =
{
// lua.h - Main Lua Patterns
"lua_callk", "55 8B EC 8B 45 0C 8B 4D 18", 0x00, 0x00,
"lua_close", "55 8B EC 8B 45 08 8B 40 10 FF 70 70", 0x00, 0x00,
"lua_createtable", "55 8B EC 56 8B 75 08 8B 46 10 83 78 0C 00 7E 09 56 E8 ?? ?? ?? ?? 83 C4 04 56 E8 ?? ?? ?? ?? 8B", 0x00, 0x00,
"lua_gc", "55 8B EC 8B 45 0C 53 8B 5D 08 56 57 33 FF", 0x00, 0x00,
"lua_getfield", "55 8B EC FF 75 10 FF 75 0C FF 75 08 E8 ?? ?? ?? ?? 83 C4 08 50 FF 75 08 E8 ?? ?? ?? ?? 83 C4 0C 5D", 0x00, 0x01,
"lua_getglobal", "55 8B EC 56 8B 75 08 FF 75 0C 6A 02 8B 46 10 FF 70 24 E8 ?? ?? ?? ?? 83 C4 08 50 56 E8", 0x00, 0x00,
"lua_gettop", "55 8B EC 8B 45 08 8B 48 14 8B 40 0C 2B 01 83", 0x00, 0x00,
"lua_isstring", "55 8B EC FF 75 0C FF 75 08 E8 ?? ?? ?? ?? 83 C4 08 8B 40 04 83 E0 0F 83 F8 04 74 09 83 F8 03 74 04", 0x00, 0x00,
"lua_newstate", "55 8B EC 53 8B 5D 0C 68 ?? ?? ?? ?? 6A 08 6A 00 53", 0x00, 0x00,
"lua_next", "55 8B EC 56 FF 75 0C 8B 75 08 56 E8 ?? ?? ?? ?? 8B 4E 0C 83 E9 08 51 FF 30 56 E8", 0x00, 0x00,
"lua_pcallk", "55 8B EC 8B 45 14 83 EC 08 53 57 8B 7D 08", 0x00, 0x00,
"lua_pushboolean", "55 8B EC 8B 55 08 33 C0 39 45 0C 0F 95 C0 8B 4A 0C", 0x00, 0x00,
"lua_pushcclosure", "55 8B EC 57 8B 7D 10 85 FF 75 19 8B 55 08 8B 45 0C", 0x00, 0x00,
"lua_pushfstring", "55 8B EC 56 8B 75 08 8B 46 10 83 78 0C 00 7E ?? 56 E8 ?? ?? ?? ?? 83 C4 04 8D 45 10 50 FF 75 0C", 0x00, 0x00,
"lua_pushlightuserdata", "55 8B EC 8B 55 08 8B 45 0C 8B 4A 0C 89 01 C7 41 04 02 00 00 00 83 42 0C 08", 0x00, 0x00,
"lua_pushlstring", "55 8B EC 56 8B 75 08 8B 46 10 83 78 0C 00 7E ?? 56 E8 ?? ?? ?? ?? 83 C4 04 8B 45 10 85 C0", 0x00, 0x00,
"lua_pushnil", "55 8B EC 8B 4D 08 8B 41 0C C7 40 04 00 00 00 00 83 41 0C 08 5D C3", 0x00, 0x00,
"lua_pushnumber", "55 8B EC 8B 4D 08 F3 0F 10 45 0C 8B 41 0C F3 0F 11 00", 0x00, 0x00,
"lua_pushstring", "55 8B EC 57 8B 7D 0C 85 FF 75 12 8B 55 08 8B C7", 0x00, 0x00,
"lua_pushvalue", "55 8B EC 56 FF 75 0C 8B 75 08 56 E8 ?? ?? ?? ?? 8B 56 0C", 0x00, 0x00,
"lua_rawset", "55 8B EC 56 8B 75 08 57 FF 75 0C 56 E8 ?? ?? ?? ?? 8B 4E 0C 8B F8 83 E9 10 51 FF 37 56", 0x00, 0x00,
"lua_rotate", "55 8B EC 51 8B 45 08 56 57 FF 75 0C 8B 70 0C 50 83 EE 08 E8 ?? ?? ?? ?? 8B F8 83 C4 08 8B 45 10", 0x00, 0x00,
"lua_setfield", "55 8B EC FF 75 10 FF 75 0C FF 75 08 E8 ?? ?? ?? ?? 83 C4 08 50 FF 75 08 E8 ?? ?? ?? ?? 83 C4 0C 5D", 0x00, 0x01,
"lua_setglobal", "55 8B EC 56 8B 75 08 FF 75 0C 6A 02 8B 46 10 FF 70 24 E8 ?? ?? ?? ?? 83 C4 08 50 56 E8", 0x00, 0x01,
"lua_setmetatable", "55 8B EC 53 56 57 FF 75 0C 8B 7D 08 57 E8 ?? ?? ?? ?? 8B 77 0C 83 C4", 0x00, 0x00,
"lua_settop", "55 8B EC 8B 45 08 8B 48 14 8B 11 8B 4D 0C 85 C9 78 ?? 8D 14 CA", 0x00, 0x00,
"lua_toboolean", "55 8B EC FF 75 0C FF 75 08 E8 ?? ?? ?? ?? 83 C4 08 8B 48 04 85", 0x00, 0x00,
"lua_tonumberx", "55 8B EC 51 FF 75 0C FF 75 08 E8 ?? ?? ?? ?? 83 C4 08 83 78 04 03 75 ?? F3 0F 10 00 B8 01 00 00", 0x00, 0x00,
"lua_type", "55 8B EC FF 75 0C FF 75 08 E8 ?? ?? ?? ?? 83 C4 08 3D ?? ?? ?? ?? 74 ?? 8B 40 04 83 E0 0F 5D C3", 0x00, 0x00,
"lua_tolstring", "55 8B EC 56 8B 75 08 57 FF 75 0C 56 E8 ?? ?? ?? ?? 8B F8 83 C4 08 8B 47 04 83 E0 0F 83 F8 04 74", 0x00, 0x00,
// lauxlib.h - Auxiliary Lua Patterns
"luaL_argerror", "55 8B EC 83 EC 64 8D 45 9C 57 8B 7D 08 50 6A 00", 0x00, 0x00,
"luaL_checklstring", "55 8B EC 56 57 FF 75 10 8B 7D 08 FF 75 0C 57 E8", 0x00, 0x00,
"luaL_loadbufferx", "55 8B EC 83 EC 08 FF 75 18 8B 45 0C FF 75 14 89 45 F8", 0x00, 0x00,
"luaL_error", "55 8B EC 83 EC 64 8D 45 9C 56 8B 75 08 50 6A 01 56 E8 ?? ?? ?? ?? 83 C4 0C 85 C0 74 ?? 8D 45 9C 50 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8B 45 B0", 0x00, 0x00,
"luaL_loadfilex", "55 8B EC 81 EC 0C 02 00 00 53 56 8B 75 08 57 56", 0x00, 0x00,
"luaL_requiref", "55 8B EC 56 57 8B 7D 08 68 ?? ?? ?? ?? 68 D8 B9", 0x00, 0x00,
// Main Lua State Pattern
"lua_state", "A1 ?? ?? ?? ?? 8D 4D ?? 6A ?? 68 ?? ?? ?? ?? C7", 0x01, 0x00,
};
|
I didn't make a pointer for it at the time, but the critical section was at:
0x00A57BDC
Minified Lua header with the needed stuff without having to include Lua etc.
Code: |
/**
* Victor Vran Minified Lua Helper
* (c) 2017 atom0s [[email protected]]
*
* Game Version : 2.7.0.0
* Lua Version : 5.3.2
*/
#ifndef __LUA_DEFINES_H_INCLUDED__
#define __LUA_DEFINES_H_INCLUDED__
#if defined (_MSC_VER) && (_MSC_VER >= 1020)
#pragma once
#endif
#include <Windows.h>
/**
* lua.h - Lua Defines
*/
#define LUA_KCONTEXT ptrdiff_t
#define LUA_NUMBER float
typedef struct lua_State lua_State;
typedef LUA_KCONTEXT lua_KContext;
typedef LUA_NUMBER lua_Number;
/**
* Lua General Defines
*/
#define LUA_MULTRET (-1)
#define LUAI_MAXSTACK 1000000
#define LUA_REGISTRYINDEX (-LUAI_MAXSTACK - 1000)
#define lua_upvalueindex(i) (LUA_REGISTRYINDEX - (i))
/**
* Lua Type Defines
*/
#define LUA_TNONE (-1)
#define LUA_TNIL 0
#define LUA_TBOOLEAN 1
#define LUA_TLIGHTUSERDATA 2
#define LUA_TNUMBER 3
#define LUA_TSTRING 4
#define LUA_TTABLE 5
#define LUA_TFUNCTION 6
#define LUA_TUSERDATA 7
#define LUA_TTHREAD 8
#define LUA_NUMTAGS 9
/**
* Lua Garbage Collection Defines
*/
#define LUA_GCSTOP 0
#define LUA_GCRESTART 1
#define LUA_GCCOLLECT 2
#define LUA_GCCOUNT 3
#define LUA_GCCOUNTB 4
#define LUA_GCSTEP 5
#define LUA_GCSETPAUSE 6
#define LUA_GCSETSTEPMUL 7
#define LUA_GCISRUNNING 9
/**
* lua.h - Lua Function Prototype Definitions
*/
typedef int /**/(*lua_CFunction)(lua_State *L);
typedef int /**/(*lua_KFunction)(lua_State *L, int status, lua_KContext ctx);
typedef void* /**/(*lua_Alloc) (void *ud, void *ptr, size_t osize, size_t nsize);
/**
* lua.h - Main Lua Definitions
*/
typedef lua_State* /**/(*lua_newstate_t)(lua_Alloc f, void *ud);
typedef void /**/(*lua_callk_t)(lua_State *L, int nargs, int nresults, lua_KContext ctx, lua_KFunction k);
typedef void /**/(*lua_close_t)(lua_State *L);
typedef void /**/(*lua_createtable_t)(lua_State *L, int narr, int nrec);
typedef int /**/(*lua_gc_t)(lua_State *L, int what, int data);
typedef int /**/(*lua_getfield_t)(lua_State *L, int idx, const char *k);
typedef int /**/(*lua_getglobal_t)(lua_State *L, const char *name);
typedef int /**/(*lua_gettop_t)(lua_State *L);
typedef int /**/(*lua_isstring_t)(lua_State *L, int idx);
typedef int /**/(*lua_next_t)(lua_State *L, int idx);
typedef int /**/(*lua_pcallk_t)(lua_State *L, int nargs, int nresults, int errfunc, lua_KContext ctx, lua_KFunction k);
typedef void /**/(*lua_pushboolean_t)(lua_State *L, int b);
typedef void /**/(*lua_pushcclosure_t)(lua_State *L, lua_CFunction fn, int n);
typedef const char* /**/(*lua_pushfstring_t)(lua_State *L, const char *fmt, ...);
typedef void /**/(*lua_pushlightuserdata_t)(lua_State *L, void *p);
typedef const char* /**/(*lua_pushlstring_t)(lua_State *L, const char *s, size_t len);
typedef void /**/(*lua_pushnil_t)(lua_State *L);
typedef void /**/(*lua_pushnumber_t)(lua_State *L, lua_Number n);
typedef const char* /**/(*lua_pushstring_t)(lua_State *L, const char *s);
typedef void /**/(*lua_pushvalue_t)(lua_State *L, int idx);
typedef void /**/(*lua_rawset_t)(lua_State *L, int idx);
typedef void /**/(*lua_rotate_t)(lua_State *L, int idx, int n);
typedef void /**/(*lua_setfield_t)(lua_State *L, int idx, const char *k);
typedef void /**/(*lua_setglobal_t)(lua_State *L, const char *name);
typedef int /**/(*lua_setmetatable_t)(lua_State *L, int objindex);
typedef void /**/(*lua_settop_t)(lua_State *L, int idx);
typedef int /**/(*lua_toboolean_t)(lua_State *L, int idx);
typedef lua_Number /**/(*lua_tonumberx_t)(lua_State *L, int idx, int *isnum);
typedef const char* /**/(*lua_tolstring_t)(lua_State *L, int idx, size_t *len);
typedef int /**/(*lua_type_t)(lua_State *L, int idx);
/**
* lauxlib.h - Auxiliary Lua Definitions
*/
typedef int /**/(*luaL_argerror_t)(lua_State *L, int arg, const char *extramsg);
typedef const char* /**/(*luaL_checklstring_t)(lua_State *L, int arg, size_t *l);
typedef int /**/(*luaL_error_t)(lua_State *L, const char *fmt, ...);
typedef int /**/(*luaL_loadbufferx_t)(lua_State *L, const char *buff, size_t sz, const char *name, const char *mode);
typedef int /**/(*luaL_loadfilex_t)(lua_State *L, const char *filename, const char *mode);
typedef void /**/(*luaL_requiref_t)(lua_State *L, const char *modname, lua_CFunction openf, int glb);
/**
* Lua Function Calls
*/
lua_newstate_t lua_newstate = nullptr;
lua_callk_t lua_callk = nullptr;
lua_close_t lua_close = nullptr;
lua_createtable_t lua_createtable = nullptr;
lua_gc_t lua_gc = nullptr;
lua_getfield_t lua_getfield = nullptr;
lua_getglobal_t lua_getglobal = nullptr;
lua_gettop_t lua_gettop = nullptr;
lua_isstring_t lua_isstring = nullptr;
lua_next_t lua_next = nullptr;
lua_pcallk_t lua_pcallk = nullptr;
lua_pushboolean_t lua_pushboolean = nullptr;
lua_pushcclosure_t lua_pushcclosure = nullptr;
lua_pushfstring_t lua_pushfstring = nullptr;
lua_pushlightuserdata_t lua_pushlightuserdata = nullptr;
lua_pushlstring_t lua_pushlstring = nullptr;
lua_pushnil_t lua_pushnil = nullptr;
lua_pushnumber_t lua_pushnumber = nullptr;
lua_pushstring_t lua_pushstring = nullptr;
lua_pushvalue_t lua_pushvalue = nullptr;
lua_rawset_t lua_rawset = nullptr;
lua_rotate_t lua_rotate = nullptr;
lua_setfield_t lua_setfield = nullptr;
lua_setglobal_t lua_setglobal = nullptr;
lua_setmetatable_t lua_setmetatable = nullptr;
lua_settop_t lua_settop = nullptr;
lua_toboolean_t lua_toboolean = nullptr;
lua_tonumberx_t lua_tonumberx = nullptr;
lua_tolstring_t lua_tolstring = nullptr;
lua_type_t lua_type = nullptr;
luaL_argerror_t luaL_argerror = nullptr;
luaL_checklstring_t luaL_checklstring = nullptr;
luaL_error_t luaL_error = nullptr;
luaL_loadbufferx_t luaL_loadbufferx = nullptr;
luaL_loadfilex_t luaL_loadfilex = nullptr;
luaL_requiref_t luaL_requiref = nullptr;
/**
* Lua Helper Macros
*/
#define lua_call(L,n,r) lua_callk(L, (n), (r), 0, NULL)
#define lua_pcall(L,n,r,f) lua_pcallk(L, (n), (r), (f), 0, NULL)
#define lua_tonumber(L,i) lua_tonumberx(L, (i), NULL)
#define lua_pop(L,n) lua_settop(L, -(n)-1)
#define lua_newtable(L) lua_createtable(L, 0, 0)
#define lua_register(L,n,f) (lua_pushcfunction(L, (f)), lua_setglobal(L, (n)))
#define lua_pushcfunction(L,f) lua_pushcclosure(L, (f), 0)
#define lua_isfunction(L,n) (lua_type(L, (n)) == LUA_TFUNCTION)
#define lua_istable(L,n) (lua_type(L, (n)) == LUA_TTABLE)
#define lua_islightuserdata(L,n) (lua_type(L, (n)) == LUA_TLIGHTUSERDATA)
#define lua_isnil(L,n) (lua_type(L, (n)) == LUA_TNIL)
#define lua_isboolean(L,n) (lua_type(L, (n)) == LUA_TBOOLEAN)
#define lua_isthread(L,n) (lua_type(L, (n)) == LUA_TTHREAD)
#define lua_isnone(L,n) (lua_type(L, (n)) == LUA_TNONE)
#define lua_isnoneornil(L, n) (lua_type(L, (n)) <= 0)
#define lua_pushliteral(L, s) lua_pushstring(L, "" s)
#define lua_insert(L,idx) lua_rotate(L, (idx), 1)
#define lua_remove(L,idx) (lua_rotate(L, (idx), -1), lua_pop(L, 1))
#define lua_tostring(L,i) lua_tolstring(L, (i), NULL)
#define luaL_loadbuffer(L,s,sz,n) luaL_loadbufferx(L,s,sz,n,NULL)
#define luaL_loadfile(L,f) luaL_loadfilex(L, f, NULL)
#define luaL_loadstring(L, s) luaL_loadbuffer(L, s, strlen(s), s)
#define luaL_checkstring(L,n) (luaL_checklstring(L, (n), NULL))
#define luaL_dofile(L, fn) (luaL_loadfile(L, fn) || lua_pcall(L, 0, LUA_MULTRET, 0))
#define luaL_dostring(L, s) (luaL_loadstring(L, s) || lua_pcall(L, 0, LUA_MULTRET, 0))
#define luaL_getmetatable(L,n) (lua_getfield(L, LUA_REGISTRYINDEX, (n)))
#define luaL_opt(L,f,n,d) (lua_isnoneornil(L,(n)) ? (d) : f(L,(n)))
#endif // __LUA_DEFINES_H_INCLUDED__
|
_________________
- Retired. |
|
Back to top |
|
![](templates/subSilver/images/spacer.gif) |
MarcRené Newbie cheater
Reputation: 0
Joined: 20 Mar 2017 Posts: 15
|
Posted: Mon Sep 02, 2019 9:52 am Post subject: |
|
|
Thank you for sharing this. Seems a lot of work, especially figuring this out.
Have to admit: I don't get it yet.
Luckily, it seems that I'm not the only one having problems with this stuff.
(Misery loves company)
Is there some kind of an idiot-proof guide? Step-by-step, perferrably?
I can find some usesful topics in the forums, but fail at connecting all the loose ends...
|
|
Back to top |
|
![](templates/subSilver/images/spacer.gif) |
jgoemat Master Cheater
Reputation: 22
Joined: 25 Sep 2011 Posts: 253
|
Posted: Sun Jun 30, 2024 11:44 am Post subject: |
|
|
Found this thread looking for help. I'm just getting into trying to do something with 'Renowned Explorers'. It is daunting starting with little knowledge of LUA internals and so many things to do. For that game though I found a string using "MemoryViewer->View->All Strings" and searching for lua: "LuaJIT 2.1.0-beta3". Here's what I've been working on...
I was able to download and build LuaJIT and write a little C program to try it out (using "x64 Native Tools Command Prompt for VS 2022" which comes with Visual Studio"). Command line for this game is 'msvcbuild.bat nogc64 static' which makes it link into my little app statically like the game which has it in the exe and not as a dll and uses 32 bit offsets for the linux vm which matches the game. I started without 'nogc64' but found my code used 64 bit registers in places where the game got by with 32 bit registers. I had noticed all the lua addresses from the game seemed to be confined in 32 bit address space also so that made sense.
Then using CE in my program which has debugging information I can start it from explorer (not console to keep from having extra process for the console) and goto 'main.lj_vm_call' for instance (my program being main.exe) and tried some AOB for my code. The game's code for this function is almost identical, with just some changes to large offsets (i.e. 0b30 -> 0b50).
Another interesting thing I found on the internals: 0xbigshaq.github.io/2022/08/23/lua-jit/
This goes into the internals of how LuaJIT works. There's a VM for lua bytecode. You can find compiled snippets of bytecode searching for AOB '1b 4c 4a' which is the magic number. I haven't looked into this a whole lot but using structure dissect it seems like the same or a close format in the game. There could be a problem if they've modified anything. There isn't an exact specification for this. They could easily re-arrange the opcodes to make the numbers completely different than mine since the VM is self-contained, or even between versions.
|
|
Back to top |
|
![](templates/subSilver/images/spacer.gif) |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|