0

I want to make a protected Lua script [for a game] that can be run via an external program. This means I don't want anyone else to see the source code. The external program is a Lua wrapper

Seraph is a ROBLOX Lua script execution exploit. It uses a wrapper to emulate a real ROBLOX scripting environment. It can run scripts in an elevated level 7 thread, allowing you to access API functions and change properties that are normally not accessible. It also contains re-implementations of missing functions such as loadstring and GetObjects, and bypasses various security checks, such as the URL trust check in the HttpGet/HttpPost functions.

They recently implemented LuaJIT and I thought this might help. If it can only be run by LuaJIT wrappers that would be awesome!

--PS I know basic lua but can't write anything cool. --PPS It needs to be able to have a password pulled from an online database

5
  • 4
    Consider: The external program needs to be able to read the encrypted source. Therefore, the external program is aware of the decryption key. Therefore, the decryption key is present in the external program or in the external programs configuration. Therefore, the decryption key is present on the users computer. Therefore... you get the drift. May 10, 2017 at 2:26
  • 1
    Yes indeed...encrypting source code is a poor choice when one has the option to compile it and send a binary format instead. May 10, 2017 at 5:20
  • So binary format / bytecode will protect people from looking at the internal workings @JoshParnell and will be impossible or hard to decompile May 10, 2017 at 23:17
  • @AdministratorReece Yes; it will be hard, not impossible. If someone really wants to do it, they can. But, even though someone may decompile a program, it does not mean that they have your source. For example, there is software that can decompile most programs to C. The catch is that, usually, the C makes very little sense. To actually reconstruct the source, you need a human who is very skilled at reversing (reverse-engineering). In the case of Lua, it is easier because the bytecode is not 'as compiled' as C. But still, no one is going to recover your original source code. May 10, 2017 at 23:52
  • ...that is, unless it's filled with national secrets or is worth lots and lots of money. In which case, sure, maybe I'll try myself :P In all seriousness though, I would not worry about it. It's the best you can reasonably do in this situation and it's likely to work perfectly for your needs. May 10, 2017 at 23:54

1 Answer 1

2

Since I'm not familiar with ROBLOX, I'm just going to focus on this part of your question:

This means I don't want anyone else to see the source code.

For this, you will want to use Lua's bytecode dumping facilities. When executing a script, Lua first compiles it to bytecode, then executes said bytecode in the VM. LuaJIT does the same thing, except that it has a completely different VM & execution model. The important thing is that LuaJIT's bytecode is compatible with standard Lua and still offers the same bytecode dumping facilities.

So, the best 'protection' you can have for your code is to compile it on your end, then send and execute only the compiled, binary version of it on the external machine.

Here's how you can do it. First, you use this code on your machine to produce a compiled binary that contains your game's bytecode:

local file = io.open('myGame.bin', 'wb')
file:write(string.dump(loadfile('myGame.lua')))
file:close()

You now have a compiled version of your code in 'myGame.bin'. This is essentially as 'safe' as you're going to get.

Now, on your remote environment where you want to run the game, you transfer 'myGame.bin' to it, and run the compiled binary like so:

local file = io.open('myGame.bin', 'rb')
local bytecode = file:read('*all')
file:close()
loadstring(bytecode)()

That will effectively run whatever was in 'myGame.lua' to begin with.

Forget about passwords / encryption. Luke Park's comment was poignant. When you don't want someone to have your source, you give them compiled code :)

1
  • 1
    Note that unlike Java bytecode, Lua bytecode isn't portable across operating systems or architectures. May 21, 2020 at 23:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.