
This means that if you want to run a proto and its code, you’ll haveto create an LClosure then set the LClosure’s proto member to, well, the proto youwant to execute.
A proto can only be ran if it’s inserted into an LClosure then fed toluaD_precall. The proto contains a whole rangeof information concerning the function, such as the constants (and how many thereis), the number of upvalues the function uses, how much stack size is necessaryfor the function to operate and most importantly, the function’s code. Each Lua function has a structure called a Proto. LuaVM::Load will then insert the resulting Proto into a Lua function (internallycalled as “LClosure”), which is then pushed onto the stack, reading for execution.To execute the function, you can simply use lua_call/lua_pcall, or lua_resume ifyou’re running said function inside of a coroutine. Roblox’s deserializer will convert bytecode into a Proto structure, which wewill see later. When a LocalScript demands execution, the client will retrieve the bytecode fromits emplacement, decompress it, deserialize it then feed it to LuaVM::Load, whichis Roblox’s routine for loading bytecode retrieved from the server.a. The client then stores the received bytecode in a safe place and leaves itserialized and compressed.ģ. Thedata received also contains the bytecode’s hash, which is important.Ģ. Upon connecting to the Roblox server, the server sends the bytecode of everyexisting LocalScript in the game to the client that’s connecting for furtherusage, along with additional information concerning security and encryption. This is what Roblox does (client/server) to get LocalScripts running on the client:ġ. Takenote that Roblox heavily modified their Lua version (more protection has been added tomake reverse engineering a pain more than anything).Once we understand how we can get code running in Lua, it’s just a matter of findinghow we could get that process to run without having the Lua compiler. Roblox usesLua for all of its in game scripts (LocalScripts, ModuleScripts and CoreScripts), so weobviously need to comprehend how we could possibly get Lua scripts running in Lua. To achieve that, we must first understand how you get code running in Lua. Therefore, we must come with our own way to do script execution. The client has no code that allows unsigned script execution, considering that thecompiler was removed entirely from the code.ģ. We want unsigned script execution the client.Ģ. I found that interresting stuff how does it work.(From Pastebin):