Disassemble van LUA (LUAC) bestanden (Linux)

In dit voorbeeld neem ik de LUA bestanden op de Smile/Stretch van Plugwise, er staan een aantal LUA bestanden die gecomprimeerd zijn, dit kan om verschillende redenen gedaan zijn:
– Het maken van een self executable.
– Het sneller laden van de code.
– Het moeilijker maken om deze bestanden te ontcijferen.
Het merendeel is in de BIN folder te vinden, dus als “self-executing program”.

Ps. op Windows kun je dit bestand NIET disassemblen (foutmelding met luac), dit kan te maken hebben met “endianess”? (niet duidelijk), dit verschilt per systeem/processor, meer informatie hier en hier te vinden.

Als ik dan in dit overzichtje kijk, zie ik dat het Linux systeempje op de Smile en Stretch BIG endian is, en Windows is LITTLE endian!

—
Target name, Platform, Architecture, Endianness, Developer(s), Known Issues/Notes
ramips, Ralink RT28xx/RT305X, MIPS, big, Kaloz, juhosg, blogic?, ramips?
—

Het decoderen moet dan op de Smile plaatsvinden, hiervoor gebruik je het LUAC programma:

Je kan met de -l commando een “lijst” weergeven van de “assemble” code, en de -o gebruiken om naar een bestand weg te schrijven.
De commando hieronder zou moeten werken, maar dat gaat hem niet worden…ik vermoed dat de -o commando alleen voor het comprimeren is (en niet voor de -l (list) commando)

luac -l -o /tmp/decode.out /usr/bin/p1parser

PS. WERKT NIET!

Daarom gaan we een truukje uithalen om weg te schrijven via een “pipe” naar dd, dit werkt wel

luac -l /usr/bin/p1parser | dd of=/tmp/decode.out

De praktijk:

Je kan met cat de inhoud weergeven: cat /tmp/decode.out

Of naar windows kopieren via pscp:

pscp.exe -pw [wachtwoord] -scp -r -p root@192.168.1.102:/tmp/decode.out C:\decode.out

Zo ziet een stukje van de assemble code eruit:

main <(luac):0,0> (5 instructions, 20 bytes at 0xb06d08)
0 params, 1 slot, 0 upvalues, 0 locals, 0 constants, 2 functions
    1   [-] CLOSURE     0 0 ; 0xb06dc8
    2   [-] CALL        0 1 1
    3   [-] CLOSURE     0 1 ; 0xb0b628
    4   [-] CALL        0 1 1
    5   [-] RETURN      0 1
 
main <P1TelegramParser.lua:0,0> (119 instructions, 476 bytes at 0xb06dc8)
0+ params, 14 slots, 0 upvalues, 17 locals, 37 constants, 27 functions
    1   [24]    CLOSURE     0 0 ; 0xb07840
    2   [57]    CLOSURE     1 1 ; 0xb07a30
    3   [72]    CLOSURE     2 2 ; 0xb07f70
    4   [78]    CLOSURE     3 3 ; 0xb082d0
    5   [81]    NEWTABLE    4 0 18
    6   [83]    CLOSURE     5 4 ; 0xb08448
    7   [83]    SETTABLE    4 -1 5  ; "1-3:0.2.8" -
    8   [85]    CLOSURE     5 5 ; 0xb08540
    9   [85]    SETTABLE    4 -2 5  ; "0-0:1.0.0" -
    10  [88]    CLOSURE     5 6 ; 0xb085d8
    11  [88]    MOVE        0 2
    12  [88]    SETTABLE    4 -3 5  ; "0-0:96.1.1" -
    13  [91]    CLOSURE     5 7 ; 0xb08700
    14  [91]    MOVE        0 3
    15  [91]    SETTABLE    4 -4 5  ; "0-0:96.14.0" -
    16  [100]   CLOSURE     5 8 ; 0xb08850
    17  [100]   SETTABLE    4 -5 5  ; "1-0:1.7.0" -
    18  [109]   CLOSURE     5 9 ; 0xb08aa0
    19  [109]   SETTABLE    4 -6 5  ; "1-0:2.7.0" -
    20  [111]   CLOSURE     5 10    ; 0xb08c68
    21  [111]   SETTABLE    4 -7 5  ; "0-0:17.0.0" -
    22  [113]   CLOSURE     5 11    ; 0xb08d00
    23  [113]   SETTABLE    4 -8 5  ; "0-0:96.3.10" -
    24  [115]   CLOSURE     5 12    ; 0xb08d98
    25  [115]   SETTABLE    4 -9 5  ; "0-0:96.7.21" -
    26  [117]   CLOSURE     5 13    ; 0xb08e30
    27  [117]   SETTABLE    4 -10 5 ; "0-0:96.7.9" -
    28  [119]   CLOSURE     5 14    ; 0xb08ec8
    29  [119]   SETTABLE    4 -11 5 ; "1-0:99.97.0" -
    30  [121]   CLOSURE     5 15    ; 0xb08f60
    31  [121]   SETTABLE    4 -12 5 ; "1-0:32.32.0" -
    32  [123]   CLOSURE     5 16    ; 0xb08ff8
    33  [123]   SETTABLE    4 -13 5 ; "1-0:52.32.0" -
    34  [125]   CLOSURE     5 17    ; 0xb09090
    35  [125]   SETTABLE    4 -14 5 ; "1-0:72.32.0" -
    36  [127]   CLOSURE     5 18    ; 0xb09128
    37  [127]   SETTABLE    4 -15 5 ; "1-0:32.36.0" -
    38  [129]   CLOSURE     5 19    ; 0xb091c0
    39  [129]   SETTABLE    4 -16 5 ; "1-0:52.36.0" -
    40  [131]   CLOSURE     5 20    ; 0xb09258
    41  [131]   SETTABLE    4 -17 5 ; "1-0:72.36.0" -
    42  [133]   CLOSURE     5 21    ; 0xb092f0
    43  [133]   SETTABLE    4 -18 5 ; "0-0:96.13.1" -
    44  [135]   CLOSURE     5 22    ; 0xb09388
    45  [135]   SETTABLE    4 -19 5 ; "0-0:96.13.0" -
    46  [138]   GETTABLE    5 4 -5  ; "1-0:1.7.0"
    47  [138]   SETTABLE    4 -20 5 ; "1-0:15.7.0" -
    48  [157]   CLOSURE     5 23    ; 0xb09420
    49  [157]   MOVE        0 3
    50  [159]   LOADK       6 -21   ; 1
    51  [159]   LOADK       7 -22   ; 16
    52  [159]   LOADK       8 -21   ; 1
    53  [159]   FORPREP     6 12    ; to 66
    54  [160]   GETGLOBAL   10 -23  ; string
    55  [160]   GETTABLE    10 10 -24   ; "format"
    56  [160]   LOADK       11 -25  ; "1-0:1.8.%d"
    57  [160]   MOVE        12 9
    58  [160]   CALL        10 3 2
    59  [160]   SETTABLE    4 10 5
    60  [161]   GETGLOBAL   10 -23  ; string
    61  [161]   GETTABLE    10 10 -24   ; "format"
    62  [161]   LOADK       11 -26  ; "1-0:2.8.%d"
    63  [161]   MOVE        12 9
    64  [161]   CALL        10 3 2
    65  [161]   SETTABLE    4 10 5
    66  [159]   FORLOOP     6 -13   ; to 54
    67  [219]   CLOSURE     6 24    ; 0xb09800
    68  [219]   MOVE        0 2
    69  [221]   LOADK       7 -21   ; 1
    70  [221]   LOADK       8 -27   ; 4
    71  [221]   LOADK       9 -21   ; 1
    72  [221]   FORPREP     7 30    ; to 103
    73  [222]   GETGLOBAL   11 -23  ; string
    74  [222]   GETTABLE    11 11 -24   ; "format"
    75  [222]   LOADK       12 -28  ; "0-%d:24.4.0"
    76  [222]   MOVE        13 10
    77  [222]   CALL        11 3 2
    78  [222]   SETTABLE    4 11 6
    79  [223]   GETGLOBAL   11 -23  ; string
    80  [223]   GETTABLE    11 11 -24   ; "format"
    81  [223]   LOADK       12 -29  ; "0-%d:24.1.0"
    82  [223]   MOVE        13 10
    83  [223]   CALL        11 3 2
    84  [223]   SETTABLE    4 11 6
    85  [224]   GETGLOBAL   11 -23  ; string
    86  [224]   GETTABLE    11 11 -24   ; "format"
    87  [224]   LOADK       12 -30  ; "0-%d:24.2.1"
    88  [224]   MOVE        13 10
    89  [224]   CALL        11 3 2
    90  [224]   SETTABLE    4 11 6
    91  [225]   GETGLOBAL   11 -23  ; string
    92  [225]   GETTABLE    11 11 -24   ; "format"
    93  [225]   LOADK       12 -31  ; "0-%d:24.3.0"
    94  [225]   MOVE        13 10
    95  [225]   CALL        11 3 2
    96  [225]   SETTABLE    4 11 6
    97  [226]   GETGLOBAL   11 -23  ; string
    98  [226]   GETTABLE    11 11 -24   ; "format"
    99  [226]   LOADK       12 -32  ; "0-%d:96.1.0"
    100 [226]   MOVE        13 10
    101 [226]   CALL        11 3 2
    102 [226]   SETTABLE    4 11 6
    103 [221]   FORLOOP     7 -31   ; to 73
    104 [231]   CLOSURE     7 25    ; 0xb0a5f0
    105 [303]   CLOSURE     8 26    ; 0xb0a6e8
    106 [303]   MOVE        0 4
    107 [303]   MOVE        0 0
    108 [303]   MOVE        0 1
    109 [305]   GETGLOBAL   9 -33   ; package
    110 [305]   GETTABLE    9 9 -34 ; "loaded"
    111 [305]   NEWTABLE    10 0 2
    112 [305]   SETTABLE    10 -36 8    ; "parse" -
    113 [305]   SETTABLE    10 -37 7    ; "match" -
    114 [305]   SETTABLE    9 -35 10    ; "P1TelegramParser" -
    115 [307]   GETGLOBAL   9 -33   ; package
    116 [307]   GETTABLE    9 9 -34 ; "loaded"
    117 [307]   GETTABLE    9 9 -35 ; "P1TelegramParser"
    118 [307]   RETURN      9 2
    119 [307]   RETURN      0 1
 
function <P1TelegramParser.lua:21,24> (17 instructions, 68 bytes at 0xb07840)
0 params, 7 slots, 0 upvalues, 1 local, 5 constants, 0 functions
    1   [22]    GETGLOBAL   0 -1    ; os
    2   [22]    GETTABLE    0 0 -2  ; "time"
    3   [22]    CALL        0 1 2
    4   [23]    GETGLOBAL   1 -1    ; os
    5   [23]    GETTABLE    1 1 -3  ; "difftime"
    6   [23]    MOVE        2 0
    7   [23]    GETGLOBAL   3 -1    ; os
    8   [23]    GETTABLE    3 3 -2  ; "time"
    9   [23]    GETGLOBAL   4 -1    ; os
    10  [23]    GETTABLE    4 4 -4  ; "date"
    11  [23]    LOADK       5 -5    ; "!*t"
    12  [23]    MOVE        6 0
    13  [23]    CALL        4 3 0
    14  [23]    CALL        3 0 0
    15  [23]    TAILCALL    1 0 0
    16  [23]    RETURN      1 0
    17  [24]    RETURN      0 1

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

main <(luac):0,0> (5 instructions, 20 bytes at 0xb06d08)

0 params, 1 slot, 0 upvalues, 0 locals, 0 constants, 2 functions

1 [-] CLOSURE 0 0 ; 0xb06dc8

2 [-] CALL 0 1 1

3 [-] CLOSURE 0 1 ; 0xb0b628

4 [-] CALL 0 1 1

5 [-] RETURN 0 1

main <P1TelegramParser.lua:0,0> (119 instructions, 476 bytes at 0xb06dc8)

0+ params, 14 slots, 0 upvalues, 17 locals, 37 constants, 27 functions

1 [24] CLOSURE 0 0 ; 0xb07840

2 [57] CLOSURE 1 1 ; 0xb07a30

3 [72] CLOSURE 2 2 ; 0xb07f70

4 [78] CLOSURE 3 3 ; 0xb082d0

5 [81] NEWTABLE 4 0 18

6 [83] CLOSURE 5 4 ; 0xb08448

7 [83] SETTABLE 4 -1 5 ; "1-3:0.2.8" -

8 [85] CLOSURE 5 5 ; 0xb08540

9 [85] SETTABLE 4 -2 5 ; "0-0:1.0.0" -

10 [88] CLOSURE 5 6 ; 0xb085d8

11 [88] MOVE 0 2

12 [88] SETTABLE 4 -3 5 ; "0-0:96.1.1" -

13 [91] CLOSURE 5 7 ; 0xb08700

14 [91] MOVE 0 3

15 [91] SETTABLE 4 -4 5 ; "0-0:96.14.0" -

16 [100] CLOSURE 5 8 ; 0xb08850

17 [100] SETTABLE 4 -5 5 ; "1-0:1.7.0" -

18 [109] CLOSURE 5 9 ; 0xb08aa0

19 [109] SETTABLE 4 -6 5 ; "1-0:2.7.0" -

20 [111] CLOSURE 5 10 ; 0xb08c68

21 [111] SETTABLE 4 -7 5 ; "0-0:17.0.0" -

22 [113] CLOSURE 5 11 ; 0xb08d00

23 [113] SETTABLE 4 -8 5 ; "0-0:96.3.10" -

24 [115] CLOSURE 5 12 ; 0xb08d98

25 [115] SETTABLE 4 -9 5 ; "0-0:96.7.21" -

26 [117] CLOSURE 5 13 ; 0xb08e30

27 [117] SETTABLE 4 -10 5 ; "0-0:96.7.9" -

28 [119] CLOSURE 5 14 ; 0xb08ec8

29 [119] SETTABLE 4 -11 5 ; "1-0:99.97.0" -

30 [121] CLOSURE 5 15 ; 0xb08f60

31 [121] SETTABLE 4 -12 5 ; "1-0:32.32.0" -

32 [123] CLOSURE 5 16 ; 0xb08ff8

33 [123] SETTABLE 4 -13 5 ; "1-0:52.32.0" -

34 [125] CLOSURE 5 17 ; 0xb09090

35 [125] SETTABLE 4 -14 5 ; "1-0:72.32.0" -

36 [127] CLOSURE 5 18 ; 0xb09128

37 [127] SETTABLE 4 -15 5 ; "1-0:32.36.0" -

38 [129] CLOSURE 5 19 ; 0xb091c0

39 [129] SETTABLE 4 -16 5 ; "1-0:52.36.0" -

40 [131] CLOSURE 5 20 ; 0xb09258

41 [131] SETTABLE 4 -17 5 ; "1-0:72.36.0" -

42 [133] CLOSURE 5 21 ; 0xb092f0

43 [133] SETTABLE 4 -18 5 ; "0-0:96.13.1" -

44 [135] CLOSURE 5 22 ; 0xb09388

45 [135] SETTABLE 4 -19 5 ; "0-0:96.13.0" -

46 [138] GETTABLE 5 4 -5 ; "1-0:1.7.0"

47 [138] SETTABLE 4 -20 5 ; "1-0:15.7.0" -

48 [157] CLOSURE 5 23 ; 0xb09420

49 [157] MOVE 0 3

50 [159] LOADK 6 -21 ; 1

51 [159] LOADK 7 -22 ; 16

52 [159] LOADK 8 -21 ; 1

53 [159] FORPREP 6 12 ; to 66

54 [160] GETGLOBAL 10 -23 ; string

55 [160] GETTABLE 10 10 -24 ; "format"

56 [160] LOADK 11 -25 ; "1-0:1.8.%d"

57 [160] MOVE 12 9

58 [160] CALL 10 3 2

59 [160] SETTABLE 4 10 5

60 [161] GETGLOBAL 10 -23 ; string

61 [161] GETTABLE 10 10 -24 ; "format"

62 [161] LOADK 11 -26 ; "1-0:2.8.%d"

63 [161] MOVE 12 9

64 [161] CALL 10 3 2

65 [161] SETTABLE 4 10 5

66 [159] FORLOOP 6 -13 ; to 54

67 [219] CLOSURE 6 24 ; 0xb09800

68 [219] MOVE 0 2

69 [221] LOADK 7 -21 ; 1

70 [221] LOADK 8 -27 ; 4

71 [221] LOADK 9 -21 ; 1

72 [221] FORPREP 7 30 ; to 103

73 [222] GETGLOBAL 11 -23 ; string

74 [222] GETTABLE 11 11 -24 ; "format"

75 [222] LOADK 12 -28 ; "0-%d:24.4.0"

76 [222] MOVE 13 10

77 [222] CALL 11 3 2

78 [222] SETTABLE 4 11 6

79 [223] GETGLOBAL 11 -23 ; string

80 [223] GETTABLE 11 11 -24 ; "format"

81 [223] LOADK 12 -29 ; "0-%d:24.1.0"

82 [223] MOVE 13 10

83 [223] CALL 11 3 2

84 [223] SETTABLE 4 11 6

85 [224] GETGLOBAL 11 -23 ; string

86 [224] GETTABLE 11 11 -24 ; "format"

87 [224] LOADK 12 -30 ; "0-%d:24.2.1"

88 [224] MOVE 13 10

89 [224] CALL 11 3 2

90 [224] SETTABLE 4 11 6

91 [225] GETGLOBAL 11 -23 ; string

92 [225] GETTABLE 11 11 -24 ; "format"

93 [225] LOADK 12 -31 ; "0-%d:24.3.0"

94 [225] MOVE 13 10

95 [225] CALL 11 3 2

96 [225] SETTABLE 4 11 6

97 [226] GETGLOBAL 11 -23 ; string

98 [226] GETTABLE 11 11 -24 ; "format"

99 [226] LOADK 12 -32 ; "0-%d:96.1.0"

100 [226] MOVE 13 10

101 [226] CALL 11 3 2

102 [226] SETTABLE 4 11 6

103 [221] FORLOOP 7 -31 ; to 73

104 [231] CLOSURE 7 25 ; 0xb0a5f0

105 [303] CLOSURE 8 26 ; 0xb0a6e8

106 [303] MOVE 0 4

107 [303] MOVE 0 0

108 [303] MOVE 0 1

109 [305] GETGLOBAL 9 -33 ; package

110 [305] GETTABLE 9 9 -34 ; "loaded"

111 [305] NEWTABLE 10 0 2

112 [305] SETTABLE 10 -36 8 ; "parse" -

113 [305] SETTABLE 10 -37 7 ; "match" -

114 [305] SETTABLE 9 -35 10 ; "P1TelegramParser" -

115 [307] GETGLOBAL 9 -33 ; package

116 [307] GETTABLE 9 9 -34 ; "loaded"

117 [307] GETTABLE 9 9 -35 ; "P1TelegramParser"

118 [307] RETURN 9 2

119 [307] RETURN 0 1

function <P1TelegramParser.lua:21,24> (17 instructions, 68 bytes at 0xb07840)

0 params, 7 slots, 0 upvalues, 1 local, 5 constants, 0 functions

1 [22] GETGLOBAL 0 -1 ; os

2 [22] GETTABLE 0 0 -2 ; "time"

3 [22] CALL 0 1 2

4 [23] GETGLOBAL 1 -1 ; os

5 [23] GETTABLE 1 1 -3 ; "difftime"

6 [23] MOVE 2 0

7 [23] GETGLOBAL 3 -1 ; os

8 [23] GETTABLE 3 3 -2 ; "time"

9 [23] GETGLOBAL 4 -1 ; os

10 [23] GETTABLE 4 4 -4 ; "date"

11 [23] LOADK 5 -5 ; "!*t"

12 [23] MOVE 6 0

13 [23] CALL 4 3 0

14 [23] CALL 3 0 0

15 [23] TAILCALL 1 0 0

16 [23] RETURN 1 0

17 [24] RETURN 0 1

Zoeken

Disassemble van LUA (LUAC) bestanden (Linux)