In progress
GLua deobfuscator
A C# tool that turns obfuscated Garry’s Mod Lua back into readable code and flags what it does, for auditing addons before they go on a server.
- Role
- Design and implementation
- Stack
- C#, .NET, Loretta (Lua parser)
- Context
- Personal security project
- Status
- In progress
The problem
Obfuscated Lua is the usual way backdoors hide in Garry’s Mod addons: hidden remote code execution, payloads that grant admin rights, data sent to outside servers. Server owners install addons they can’t read.
The plan
- Parse the code into a syntax tree with Loretta, which understands Garry’s Mod’s extensions to Lua.
- Simplify it in separate, individually tested passes: fold constants and decode built-up strings, inline the obfuscator’s decoder functions, remove dead code, and give meaningless identifiers readable names.
- Print the cleaned code back out.
- Scan the result and report suspicious behaviour, such as running code from strings, unexpected HTTP requests, or changing a player’s admin rank.
Screenshot coming soon
Obfuscated input next to the cleaned output.
assets/projects/glua-deobfuscator/before-after.png (side by side, readable text size)
Screenshot coming soon
A scan report listing suspicious calls found in a sample.
assets/projects/glua-deobfuscator/scan-report.png (tight crop)
Scope
Defensive by design. Demonstrations use known malicious samples and my own test files, not commercial addons.