Dekodowanie Skryptów

[Dagger0ne]

Jak to z tym jest? Znalazłem poradnik: 

 

It's easy to decode, hard to reverse, i'll give a explanation on how to decode here, since BoL 2.0 is incomming, and most devs are good at doing a good online auth, it's not like a big thing anyway.

Just take the data from either LoadProtectedScript or LoadVIPScript and insert in base64 converter on ex. mobobit website, choose to decode, to save as file and save it on your harddrive.

Now you need to remove the xor, the key is really simple to find, infact if you take the decoded data and convert it to ascii, you will proberly be able to see it in plain text, cause of the way XOR'ing works, but keys are:

LoadVIPScript: MyVIPL33tKEy
LoadProtectedScript: MyFreEL@m3KEy

So we just use a simple xor program, can be found on ex softpedia, and execute in commandline: xor "base64decoded(.)bin" "out(.)bin" "Xorkey".

Now we have a compiled lua file, if you open it in ex. notepad you would see some plaintext and rest looks like junk, and this is how many scripts was "cracked", by simply replacing a name on the authlist with your own.
But these days devs use real authchecks, to patch these, you would need to alter the code.
To do this we need to convert to lua bytecode.
Use LuaAssemblyTools, and edit the Decompiler52(.)lua file to output to a file instead of the console.

Now you just execute the lua file like this: "lua52 Decompiler52(.)lua out(.)bin"

lua52 can be found at luabinaries website under download.

Now open the file you created with the decompiler, and you can start editing the lua assembly.

When you made your patches, you just use the lasm compiler, convert file to base64 using the website, and load with Base64Decode in a lua script in BoL.

 

 

 

Próbuję coś z tym zrobić ale już przy tym dekodowaniu base64 pojawiają się problemy. Jest tu ktoś kto się na tym zna i mógłby pomóc? Z góry bardzo dziękuję

[LSowiec]

Dzień dobry! Jestem archeologiem!

 

poza tym tematem, znalazłem jeszcze coś takiego:

 

Short explanation of cracking scripts:
1) Rewrite your own "load" function, so that it writes the first passed parameter ( lua bytecode ) into a file, heres a sample:

Code:

_G.load = function(data)
  file = io.open("C:/out.luac", "wb")
  file:write(data)  
  file:close()
end

2) Decompile this luac file using Lua Assembly Tools, you can google it up
3) Edit the decompiled Lasm file to suit your needs ( Remove auth checks, etc)
4) Recompile to bytecode
5) Encrypt the bytecode with base64encode
6) Load it like this:

Code:

load(Base64Decode(...), nil, b, _ENV)()

 

ale nie bardzo rozumiem jak to "Lua Assembly Tools" działa, może macie jeszcze jakieś pomysły, jak dekodować te skrypciki z bola?

[LSowiec]

- ~'~.~.~_~_~  UP!  ~_~_~.~.~'~ -

 

...............

.............

.........

.....

...

.

[ᕦ( ͡° ͜ʖ ͡°)ᕤ]

Musisz znać LASM, i.e. instrukcje wirtualnej maszyny Lua. Modyfikujesz je, w prostszych skryptach po prostu zmieniasz EQ czy TEST na JMP. (i dostosowując ilość instrukcji)
W przypadku loaderów możesz użyć unluac i zdumpować funkcję decodującą.

 

//edit: metoda z nadpisywaniem funkcji load słabo działa, bo we większości skryptów jest:

if debug.getinfo(load, "S").what ~= "C" then return end