How to obfuscate lua code?

Question

I can't find anything on Google for some tool that encrypts/obfuscates my lua files, so I decided to ask here. Maybe some professional knows how to do it? (For free).

I have made a simple game in lua now and I don't want people to see the code, otherwise they can easily cheat. How can I make the whole text inside the .lua file to just random letters and stuff?

I used to program in C# and I had this .NET obfuscator called SmartAssembly which works pretty good. When someone would try check the code of my applications it would just be a bunch of letters and numbers together with chinese characters and stuff.

Anyone knows any program that can do this for lua aswell? Just load what file to encrypt, click Encrypt or soemthing, and bam! It works!?

For example this:

print('Hello world!')

would turn into something like

sdf9sd@@@&/sdfsdd9fd0f0fsf/&

Solution 1

Just precompile your files (chunks) and load binary chunks. luacallows you to strip debugging info. If that is not enough, define your own transformations on the compiled lua, stripping names where possible. There's not really so much demand for lua obfuscators though...

Also, you loose one of the main advantages of using an embedded scripting language: Extensibility.

Solution 2

The simplest obfuscation option is to compile your Lua code as others suggested, however it has two major issues: (1) the strings are still likely to be easily visible in your compiled code, and (2) the compiled code for Lua interpreter is not portable, so if you target different architectures, you need to have different compiled chunks for them.

The first issue can be addressed by using a pre-processor that (for example) converts your strings to a sequence of numbers and then concatenates them back at run-time.

The second issue is not easily addressed without changes to the interpreter, but if you have a choice of interpreters, then LuaJIT generates portable bytecode that will run across all its platforms (running the same version of LuaJIT); note that LuaJIT bytecode is different from Lua bytecode, so it can't be run by a Lua interpreter.

A more complex option would be to encrypt the code (possibly before compiling it), but you need to weight any additional mechanisms (and work on your part) against any possible inconvenience for your users and any loss you have from someone cracking the protection. I'd personally use something sufficiently simple to deter the majority of curious users as you likely stand no chance against a dedicated hacker anyway.

Solution 3

You could use loadstring to get a chunk then string.dump and then apply some transformations like cycling the bytes, swapping segments, etc. Transformations must be reversible. Then save to a file.

Note that anyone having access to your "encryptor" Lua module will know how to decrypt your file. If you make your encrypted module in C/C++, anyone with access to source will too, or to binary of Lua encryption module they could require the module too and unofuscate the code. With interpreted language it is quite difficult to do: you can raise the bar a bit via the above the techniques but raising it to require a significant amount of work (the onlybreal deterent) is very difficult AFAIK.

If you embed the Lua interpreter than you can do this from C, this makes it significantly harder (assuming a Release build with all symbols stripped), person would have to be comfortable with stepping through assembly but it only takes one capable person to crack the algorithm then they can make the code available to others.

Yo still interested in doing this? :)

Solution 4

I thought I'd add some example code, since the answers here were helpful, but didn't get us all the way there. We wanted to save some lua table information, and just not make it super easy for someone to inject their own code. serialize your table, and then use load(str) to make it into a loadable lua chunk, and save with string.dump. With the 'true' parameter, debug information is stripped, and there's really not much there. Yes you can see string keys, but it's much better than just saving the naked serialized lua table.

function tftp.SaveToMSI( tbl, msiPath )
    assert(type(tbl) == "table")
    assert(type(msiPath) == "string")

    local localName = _GetFileNameFromPath( msiPath )
    local file,err = io.open(localName, "wb")
    assert(file, err)
    -- convert the table into a string
    local str = serializer.Serialize( tbl )

    -- create a lua chunk from the string.  this allows some amount of 
    -- obfuscation, because it looks like gobblygook in a text editor
    local chunk = string.dump(load(str), true)

    file:write(chunk)
    file:close()

    -- send from /usr to the MSI folder
    local sendResult = tftp.SendFile( localName, msiPath )
    -- remove from the /usr folder
    os.remove(localName)

    return sendResult
end

The output from one small table looks like this in Notepad++ :

LuaS У

Vx@w( @ АKА└АJБ┴ JА @ & А &  name Coulombmetervalue?С╘ ажў

View more solutions