Luminol, a GLua deobfuscator

The problem

Obfuscated Lua is the usual way backdoors hide in Garry’s Mod addons: hidden remote code execution, payloads that grant admin rights, data sent to outside servers. Server owners install addons they can’t read.

How it works

• Parse the code into a syntax tree with Loretta, which understands Garry’s Mod’s extensions to Lua.
• Simplify it in separate passes, each one a syntax-tree rewriter I write myself: fold constants and built-up strings, inline the obfuscator’s decoder functions, remove dead code, and give meaningless identifiers readable names.
• Re-parse the output after every pass and report any new errors, so a broken pass is caught at the step that broke it.
• Print the cleaned code back out, then scan it for suspicious behaviour, such as running code from strings, unexpected HTTP requests, or changing a player’s admin rank.
• Optionally, as the very last step, ask an AI model to suggest readable names. The source is treated as untrusted input: comments are stripped, the request is sent as escaped data, only names are accepted back, and every returned name is validated before it’s applied.

Where it is now

I prototype each pass in a public sandbox, luminol-explore, then rewrite it cleanly in Luminol. The sandbox has the pass pipeline, a tracing rewriter that shows every step, and the first pass, which folds string concatenation. Renaming comes next.

The goal is a command-line tool and a graphical one, running on Windows and Linux, where you can step through every pass and see the syntax tree and the code change as it goes.

Scope

Defensive by design. Demonstrations use known malicious samples and my own test files, not commercial addons.