Tool
LuaDec
Lua bytecode decompiler that turns compiled chunks back into Lua source, with a disassembly mode, selection of single nested functions by number and a guesser for local variable declarations that can be overridden by hand. Its -fc option recompiles each decompiled function and compares it instruction by instruction with the original. It targets Lua 5.1, marks Lua 5.2 and 5.3 support as experimental, and continues Hisham Muhammad’s LuaDec for Lua 5.0 and Zsolt Sztupak’s LuaDec51.
Requirements & limits
- The reviewed master commit, the latest on the default branch, dates from 2017-01-06, and the repository has no releases or tags. A build initialises one Lua submodule from the author’s lua5 fork (branch 5.1, 5.2 or 5.3), builds that Lua, then runs make LUAVER=5.x in luadec/, which also builds the luareplace and luaopswap helpers; Visual C++ 2008 project files are included, which the README says were tested with VC 2008 and 2013. A Travis CI configuration builds each Lua version with gcc and clang but runs no tests.
- Input is a chunk compiled by the matching standard Lua version, or a Lua source file compiled on the fly for testing. For bytecode from a virtual machine with a reordered opcode table, luaopswap compares that VM’s compilation of a bundled script using every opcode with a standard compilation, derives an opcode map and rewrites files to standard opcodes; luareplace swaps a nested function between two files. The -fc check reports per function whether the decompiled code recompiles to the same instructions, and the README’s own example shows failures, so output must be checked function by function.
- test/ holds small Lua source cases for control-flow constructs, and test-compiled/lua-5.1 bundles compiled Lua 5.1 chunks as decompiler inputs, including files named for the Xunlei downloader, JX3 add-ons and the Defense Witches game; the repository does not state their origin or rights. ChunkSpy listers for each Lua version and Ruby comparison scripts are also included. This collection reviewed source and documentation without building or running the tools.
- The README says LuaDec is free software under the same license as the original LuaDec but does not name it, the repository has no license file and GitHub detects none, so reuse terms are unclear; the Lua, LuaAssemblyTools, ilua and memwatch submodules and the bundled ChunkSpy scripts keep their own terms. The reviewed sources establish no REA connection.
About this entry
- Type
- Tool
- Category
- Native analysis tools
- Relationship
- Foundation tool
- Targets
- Binary · Game
Sources reviewed
The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.
Primary sources
- ReadMe.md GitHub · viruscamp/luadec · Revision 895d923
- .gitmodules GitHub · viruscamp/luadec · Revision 895d923
- luadec/Makefile GitHub · viruscamp/luadec · Revision 895d923
- luadec/luadec.c GitHub · viruscamp/luadec · Revision 895d923
- luadec/luaopswap.c GitHub · viruscamp/luadec · Revision 895d923
- luadec/luareplace.c GitHub · viruscamp/luadec · Revision 895d923
- .travis.yml GitHub · viruscamp/luadec · Revision 895d923
- test GitHub · viruscamp/luadec · Revision 895d923
More in Native binaries
- xpcspy · Tool
- de4py · Tool
- Dwarf · Tool
- DownUnderCTF: masked-squares flag checker · Case study
- Show Your Work: a measured dissection of REA's evidence architecture · Case study
- Windows loader: static malware analysis with REA and Codex · Case study