I've got help hacking a mobile game 1 year ago.
For this same game the process was something like this:
Frida would to find
libslua and export/dump the game logic,
from those files I would look into the game logic and make easy game modifications.
Using Frida again, would listen for game start and inject the script (moded game functions)
So, this was 1 year ago, upon extrating the
.apk i could find those
Lua files and even if they were encrypted i could manage to find the key and decrypt them.
Now, upon extrating the
.apk, the game
only contains unity files, i can't find the Lua files directly, and even using frida after game starts i never finds the main file "libslua".
If you interested in working on this send me DM pls
extra info about how I Lua in the project before:
lua_gettop:
[Only registered and activated users can see links. Click Here To Register...]
lua_gettop gets the top of the lua stack, it is called alot, anytime the lua C API needs to get info from the lua virtual machine.
(for example: when a lua function is called) lua_gettop will be called to get the top of the stack since the function parameters will be ontop of the stack.
luaL_loadbufferx:
[Only registered and activated users can see links. Click Here To Register...]
Loads lua files into memory and usually calls through to lua_load to actually load the files.
luaL_loadfile:
[Only registered and activated users can see links. Click Here To Register...]
Loads lua from file but does not actually run it.
luaL_loadstring:
[Only registered and activated users can see links. Click Here To Register...]
Loads lua from a string (simply: loadstring("print("Hello"))) but does not actually run it.
lua_pcall:
[Only registered and activated users can see links. Click Here To Register...]
After loading a file with luaL_loadfile, this function is used to actually execute it.
lua_tolstring:
[Only registered and activated users can see links. Click Here To Register...]
Only used for logging errors, not one hundred percent required, but can make debugging easier if lua fails to run custom file.
NOTE: There is also a lua function called luaL_dofile:
[Only registered and activated users can see links. Click Here To Register...]
This is a combination of luaL_loadfile and lua_pcall in one, the only issue with this is for debugging.
This requires less code but will cannot specifiy if luaL_loadfile failed or if it was lua_pcall that failed.
Due to the fact they the two calls are merged.