Warm tip: This article is reproduced from serverfault.com, please click

lua code deobfuscation

发布于 2013-04-12 00:30:45

I've recently downloaded some lua code and what I found inside was some obfuscated string. That made me wonder what sort of obfuscation technique was used there. Does anybody have an idea?

local code='\27\76\117\97\81\0\1\4\4\4\8\0\64\0\0\0\64\67\58\92\85\115\101\114\115\92\65\108\101\120\92\68\101\115\107\116\111\112'
loadstring(code)()

EDIT: Some more (encrypted?) code.

'\196\2\28\66\0\1\198\193\194\2\25\128\129\3\22\64\14\128\197\193\0\0\198\193\195\3\6\2\196\2\220\129\0\1\218'

Questioner
Robin64
Viewed
0
Netfangled 2013-04-12 08:58:15

Doesn't look encrypted at all. Seems like it's just a sequence of bytes. Each backslash represents a character with its byte code.

27 is escape, 76 is 'L', 117 is 'u', 97 is 'a' and so on.

Running it through a short script gives me this string (symbols are special characters, such as escape, start of heading and null): ←LuaQ ☺♦♦ @ @C:\Users\Alex\Desktop

You can look up the bytes on an ascii table.

Update: A bit of research told me that LuaQ means that it's a precompiled script or something of the sort. I could be way off though.