hello, I tried to decompile a .lua binary file but I failed because of size_of_Instruction. I understand your program doesn't support 0x08 bytes?
Source of compiled lua file: https://github.com/Tencent/UnLua.
Non-standard op encodings, needs to use unluac's --opmap option with the correct opmap file. I can usually decode the ops that appear in the sample with only a little guessing. (E.g. lt and le can be tricky to distinguish from only context.) Files using other ops won't work unless you add them (or if I'm nice enough to help again; usually I don't mind decoding opmaps).
Someone posted UnLua before, but it was 5.4; this is 5.3. That also had a non-standard chunk format. I didn't see any of the non-standard stuff reflected in the github repo, so I didn't even bother to look this time. Maybe just custom, not sure. Probably not helpful, but for reference, here.
Sorry it took me so long to reply, the script works, but not all files are decrypted, so I've uploaded an archive in which I found unknown opcodes and files that contain these unknown opcodes. If you don't have enough examples for a certain opcode, let me know.
I think UnLua is confusing opcodes, because I don't see any logic in them.
I think it's mostly okay. I switched lt and le (still hard to tell apart). bnot is a wild guess. It seems like it is either a meta-op invocation which I have found no context for in which case it is probably still unary, so bnot or I suppose unm by process of elimination, maybe taking the address or returning an ID; or I guess maybe it could be a custom op; or I'm just blanking on something, but it doesn't seem like there's many options (it almost certainly writes to register A, and is almost certainly unary or nullary, and probably results in a number when the parameter if any is not a number). It's not doing anything particularly interesting here, I don't think. Here it will decompile as bnot (or unm), so...
Hi, I've uploaded an archive where all missing opcodes are located, the names indicate which opcode they are and their number.
I also added files with a lot of bnot opcodes. Thanks for the work you have done.
Some are non-standard ops. For example op34 is an increment operation, like C's ++. I think there's also a +=. I can write a patch to unluac for at least some of these (haven't finished looking), but I thought I'd ask what semantics would be most useful for you? I could decompile using custom operators (probably matching C's where possible; -- couldn't be used if that comes up...) which represents the binary more precisely (and I think is most likely to be the original semantics), but then can't be compiled by a normal Lua compiler; or I could decompile into the equivalent Lua.
-- option 1
x++
x += f()
-- option 2
x = x + 1
x = x + f()
(It's weird to implement these features as custom ops, but best I can tell that's what's happening. Anyway, there are certainly more opcode bytes in use than are needed for standard Lua 5.3.)
Last edit: tehtmi 2025-03-04
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Yeah, interesting. I still think this is a really silly way to implement this feature...
It looks like just ++ and +=, but different ops for the target being local vs table member vs upvalue (and by the opmap pattern, we could guess maybe there are tabup versions as well but I didn't bother implementing those yet), although not all combinations are observed.
Patch and build decompiling via ++and +=, but it would be easy to convert to normal Lua too (although, frankly, probably easy to do by hand as well...). Maybe a bit awkward if you care about re-evaluating the target which probably doesn't really matter in these files anyway.
hello, I tried to decompile a .lua binary file but I failed because of size_of_Instruction. I understand your program doesn't support 0x08 bytes?
Source of compiled lua file: https://github.com/Tencent/UnLua.
Last edit: tehtmi 2025-02-28
1.
Non-standard header prevents parsing. Insert byte (hex) 08 between offset 0C and offset 0D (containing 04 04). Or; modify unluac to expect this header.
(Build of current head with this patch attached.)
2.
Non-standard op encodings, needs to use unluac's
--opmap
option with the correct opmap file. I can usually decode the ops that appear in the sample with only a little guessing. (E.g.lt
andle
can be tricky to distinguish from only context.) Files using other ops won't work unless you add them (or if I'm nice enough to help again; usually I don't mind decoding opmaps).3.
Someone posted UnLua before, but it was 5.4; this is 5.3. That also had a non-standard chunk format. I didn't see any of the non-standard stuff reflected in the github repo, so I didn't even bother to look this time. Maybe just custom, not sure. Probably not helpful, but for reference, here.
Last edit: tehtmi 2025-02-28
Sorry it took me so long to reply, the script works, but not all files are decrypted, so I've uploaded an archive in which I found unknown opcodes and files that contain these unknown opcodes. If you don't have enough examples for a certain opcode, let me know.
I think UnLua is confusing opcodes, because I don't see any logic in them.
I think it's mostly okay. I switched
lt
andle
(still hard to tell apart).bnot
is a wild guess. It seems like it is either a meta-op invocation which I have found no context for in which case it is probably still unary, sobnot
or I supposeunm
by process of elimination, maybe taking the address or returning an ID; or I guess maybe it could be a custom op; or I'm just blanking on something, but it doesn't seem like there's many options (it almost certainly writes to register A, and is almost certainly unary or nullary, and probably results in a number when the parameter if any is not a number). It's not doing anything particularly interesting here, I don't think. Here it will decompile asbnot
(orunm
), so...Last edit: tehtmi 2025-03-02
Hi, I've uploaded an archive where all missing opcodes are located, the names indicate which opcode they are and their number.
I also added files with a lot of bnot opcodes. Thanks for the work you have done.
Some are non-standard ops. For example op34 is an increment operation, like C's
++
. I think there's also a+=
. I can write a patch to unluac for at least some of these (haven't finished looking), but I thought I'd ask what semantics would be most useful for you? I could decompile using custom operators (probably matching C's where possible;--
couldn't be used if that comes up...) which represents the binary more precisely (and I think is most likely to be the original semantics), but then can't be compiled by a normal Lua compiler; or I could decompile into the equivalent Lua.(It's weird to implement these features as custom ops, but best I can tell that's what's happening. Anyway, there are certainly more opcode bytes in use than are needed for standard Lua 5.3.)
Last edit: tehtmi 2025-03-04
Yeah, interesting. I still think this is a really silly way to implement this feature...
It looks like just
++
and+=
, but different ops for the target being local vs table member vs upvalue (and by the opmap pattern, we could guess maybe there are tabup versions as well but I didn't bother implementing those yet), although not all combinations are observed.Patch and build decompiling via
++
and+=
, but it would be easy to convert to normal Lua too (although, frankly, probably easy to do by hand as well...). Maybe a bit awkward if you care about re-evaluating the target which probably doesn't really matter in these files anyway.Last edit: tehtmi 2025-03-04