3

I am currently trying to hack the Lua implementation of a game in order to extend the built-in methods for game modders.

In order to do so, I try to hijack a the pointer to a valid lua_State struct and register new libraries with it.

I have now tried several places / stages of the target game to intercept the program and steal lua_State from it. My first try was callin in luaL_openlib() at the very end of base_open(). This was the first time I got this null-pointer exception:

Exception thrown: read access violation.

L->l_G->_defaultmeta.value.gc was nullptr.

From the comments you can see, that Egor Sktiptunoff suggested to me moving the entry point of my hack into a user-level function. Since I know, that one of the first functions getting called is dofile(), I stole the lua_State struct from there and passed it to my DLL.

What you see here is the actual code from my injected DLL which I tried to execute at the end of base_open() and dofile() (user-level):

EXTERN_DLL_EXPORT void initialize(lua_State *L)
{
    if (initialized == true) {
        return;
    }

    initialized = true;

    lua_pushvalue(L, LUA_GLOBALSINDEX);          // Works
    luaL_openlib(L, "ext", extension_funcs, 0);  // Crashes with "L->l_G->_defaultmeta.value.gc was nullptr"
}

Below you can find the screenshot of a debug session and the location where the exception gets thrown. The lua_State object is the one that I stole and was passed to e.g. dofile. How can it be that L->l_G->_defaultmeta.value.gc is NULL at this point in time? Is there anything I can do here or is there any explanation for this?

enter image description here

I know that the game which I try to hack here uses a "slightly different version of Lua 5.0", but could it be that they changed the way how garbage collection works or something? Because there is ..


One more thing to keep in mind:

The game has Lua compiled into it. The DLL I created has its own compilation of Lua 5.0.1. There is of course a chance, that the game developers back then decided to not just "sligtly" change Lua, but instead change it a lot. I am always just assuming that all the developers did was removing some default libraries and added some other built-in functions like LOG(), WARN(), etc. It would be strange if they changed code in Lua's core - but I tell you that just so somebody who has an idea about Lua might consider this as an explanation for the exception I am getting here.

6
  • Instead of modifying base_open you can inject your code in some user-level function (such as luaB_getmetatable) which address could be found by looking at the table base_funcs points to. I think it would be safer to execute your injected code from the first invocation of getmetatable from Lua script. Simply intercept first call to luaB_getmetatable by replacing its address in base_funcs table. Dec 11, 2016 at 12:14
  • @EgorSkriptunoff Sorry, I have no idea about Lua but I see that luaB_getmetatable is already a built-in function which appears to be available to the interpreter already. To me it would make more sense to register my library when Lua does configure itself. I am not sure what's the top-level function that is handling that whole procedure from the start to the end but maybe if I inject my code e.g. to the end of it all - maybe then it will work. I was hoping actually that somebody comes and says: "Well, it can't work because at this time the pointer to the gc is NULL just move it to X .." Dec 11, 2016 at 16:34
  • @EgorSkriptunoff According to this the way I do it should actually work but for some reason lua_State has a null pointer .. Dec 11, 2016 at 16:37
  • That link describes loading user library AFTER Lua core has been initialized. You are trying to modify initialization process, this may be more difficult. "To intercept luaB_getmetatable" means change its address to point to your code: your code must do what you want (luaL_openlib or something), deactivate itself (to disable executing luaL_openlib on the next invocation of getmetatable) and jmp to original luaB_getmetatable. Dec 11, 2016 at 16:49
  • @EgorSkriptunoff Okay, I see. I will try that. Though I've been looking a bit deeper into the Lua code and found that openstdlibs in lua.c or so might be also a possible point of entry - just after the the initialization part or so. Dec 11, 2016 at 17:07

2 Answers 2

3

It really looks like your sizeof(lua_TObject) doesn't match what the game's Lua is using. A common reason for this to be different is using floats (or ints) as numbers instead of the default double. I haven't personally made this change in Lua 5.0, but it looks like it can be done by defining LUA_NUMBER as float (or int). With int/float the size should be 8, but with double it is 16 (not 12 because the double needs to be aligned).

lua_TObject consists of a type tag (tt) along with a value union. The largest thing in that union is usually the 8-byte double (or an 8-byte pointer if 64-bit, but this is 32-bit). Everything else is typically 4 bytes. Most of the stuff in your watch window looks pretty valid, but the lua_Objects look sketchy. And _defaultmeta comes directly after another lua_TObject, so if the size of lua_TObject is different, your code and the game code will disagree about the location of this member. tt for _defaultmeta should be 5 (LUA_TTABLE), but yours looks like it is probably a pointer. Also, the tt fields for top, base, and _registry indicate other types that will have a pointer type value, but the gc field indicates your code is seeing small integers instead of pointers. These are probably tt fields of adjacent lua_TObjects. On top of all that, top and base don't have the same 16-byte alignment, and these are supposed to be pointers into the same lua_TObject array.

If you continue having trouble, try examining the lua_State object you get from the game before you have modified it, and compare it to the lua_State you see in a cleanly initialized lua_State you have made yourself. Obviously, pointer addresses may differ, and the game may be setting up some contents you are not, but some inconsistencies may still jump out.

If you have access to compiled Lua chunks that the game uses, you could also look at the header information of these chunks. This will contain some information that could be helpful in matching your Lua configuration including sizeof(lua_Number).

(But I think there is some chance that changing doubles to floats could be sufficient.)

It may also help you to add debugging checks to your own Lua build that may warn you sooner in the case of any funny business, at least initially. It looks like Lua 5.0 allows for both lua_assert and api_check to be #defined for such purposes.

Good luck!

1
  • Hi! This sounds very reasonable. I rejected the idea of a modified lua_State because I thought "why the extra work?" If I developed a game I would not want to reinvent a thing like Lua but it seems they either really made some changes, or like you suggest, made their own configuration or so. I don't know when I have time to dig into that because I got the thing basically working so far - yet still without the correct description of lua_Struct. +1 Dec 17, 2016 at 9:07
0

If all you want is to add some global functions, just set a suitable luaL_reg struct called myfuncs and then call

  lua_pushvalue(L, LUA_GLOBALSINDEX);
  luaL_openlib(L, NULL, myfuncs, 0);  /* open lib into global table */

Do this in your own C code. There is no need to change the source of lbaselib.c.

3
  • Hi! The thing is that I am modifying an executable and the entry point of my hack is currently in base_open of lbaselib.c. The code I am showing above would only be the C equivalent to what I am trying to achieve. So, the only thing I'd have to change is to call lua_pushvalue? Can you explain what this is doing and why I have to call is? Is this connected to the issue I am having with the null-pointer? I'd just like to understand what's actually failing here and why. :D Dec 11, 2016 at 10:33
  • I have added lua_pushvalue(L, LUA_GLOBALSINDEX) but the program crashes because of the same reason. Since lua_pushvalue does not fail I think I can assume that my lua_State* pointer is the correct one. So the question remains why L->l_G->_defaultmeta.value.gc is NULL. Dec 11, 2016 at 11:01
  • I have updated my question - it appears that this issue might arise somewhere else or due to a different reason. Dec 12, 2016 at 1:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.