So, I have a lua compiled file and I couldn't decompile it using LuaDec or another tool, all tools give me "bad header". As I saw on HxD the header starts with "LuaQ" so it's a Lua 5.1 file.
This is the header: 1B = Escape 4C 75 61 = Lua signature "Lua" 51 = version (5.1) 00 = Format 01 = Endianness (Little endian) 04 04 04 04 00 = Size of types
I can't decompile this script and I don't know why. I think quickbms can help me out with it, if someone can provide a quickbms script for this or can help out, I'll be really appreciated.
I'm attaching the file on this topic if someone needs it to analyse it.
The header looks fully in tact as-is. However, the byte code looks like it was probably altered. You'd need to reverse the target and check to see if they modified the order in which Lua is handling the byte code, as well as if they altered how the byte code is stored/interpreted.
atom0s wrote:The header looks fully in tact as-is. However, the byte code looks like it was probably altered. You'd need to reverse the target and check to see if they modified the order in which Lua is handling the byte code, as well as if they altered how the byte code is stored/interpreted.
Thanks! This will certainly help me to figure it out.
