I am currently trying to hack the Lua implementation of a game in order to extend the built-in methods for game modders.
In order to do so, I try to hijack a the pointer to a valid lua_State struct and register new libraries with it.
I have now tried several places / stages of the target game to intercept the program and steal lua_State from it. My first try was callin in luaL_openlib() at the very end of base_open(). This was the first time I got this null-pointer exception:
Exception thrown: read access violation.
L->l_G->_defaultmeta.value.gc was nullptr.
From the comments you can see, that Egor Sktiptunoff suggested to me moving the entry point of my hack into a user-level function. Since I know, that one of the first functions getting called is dofile(), I stole the lua_State struct from there and passed it to my DLL.
What you see here is the actual code from my injected DLL which I tried to execute at the end of base_open() and dofile() (user-level):
EXTERN_DLL_EXPORT void initialize(lua_State *L)
{
if (initialized == true) {
return;
}
initialized = true;
lua_pushvalue(L, LUA_GLOBALSINDEX); // Works
luaL_openlib(L, "ext", extension_funcs, 0); // Crashes with "L->l_G->_defaultmeta.value.gc was nullptr"
}
Below you can find the screenshot of a debug session and the location where the exception gets thrown. The lua_State object is the one that I stole and was passed to e.g. dofile. How can it be that L->l_G->_defaultmeta.value.gc is NULL at this point in time? Is there anything I can do here or is there any explanation for this?
I know that the game which I try to hack here uses a "slightly different version of Lua 5.0", but could it be that they changed the way how garbage collection works or something? Because there is ..
One more thing to keep in mind:
The game has Lua compiled into it. The DLL I created has its own compilation of Lua 5.0.1. There is of course a chance, that the game developers back then decided to not just "sligtly" change Lua, but instead change it a lot. I am always just assuming that all the developers did was removing some default libraries and added some other built-in functions like LOG(), WARN(), etc. It would be strange if they changed code in Lua's core - but I tell you that just so somebody who has an idea about Lua might consider this as an explanation for the exception I am getting here.

base_openyou can inject your code in some user-level function (such asluaB_getmetatable) which address could be found by looking at the tablebase_funcspoints to. I think it would be safer to execute your injected code from the first invocation ofgetmetatablefrom Lua script. Simply intercept first call toluaB_getmetatableby replacing its address inbase_funcstable.luaB_getmetatableis already a built-in function which appears to be available to the interpreter already. To me it would make more sense to register my library when Lua does configure itself. I am not sure what's the top-level function that is handling that whole procedure from the start to the end but maybe if I inject my code e.g. to the end of it all - maybe then it will work. I was hoping actually that somebody comes and says: "Well, it can't work because at this time the pointer to the gc isNULLjust move it to X .."lua_Statehas a null pointer ..luaB_getmetatable" means change its address to point to your code: your code must do what you want (luaL_openlibor something), deactivate itself (to disable executingluaL_openlibon the next invocation ofgetmetatable) and jmp to originalluaB_getmetatable.openstdlibsin lua.c or so might be also a possible point of entry - just after the the initialization part or so.