Input

Input

1 · Generate harness

Executors without setfenv will error on the executor variant; run that script in a plain Lua 5.1 runtime instead. The harness never alters the script, only the environment it runs in.

2 · Analyze the log

Load a loader

Pick a sample

Preview

1 · Identify what you are facing

Scan the sample first. The fingerprint decides everything downstream: Luraph builds carry their own bytecode VM, MoonSec wraps a dispatcher behind a vararg proxy, IronBrew hides a string table plus per-build XOR keys. Building against the wrong fingerprint wastes days. The Scanner tab gives you the candidate list and the evidence for each. For runtime ground truth, the Env Logger tab wraps the script in a harness that counts every global read and write the chunk actually makes, and the Analyzer tab unwraps a loadstring loader up front and reports protections before you commit to an approach.

2 · Recover the string table first

Almost every Lua obfuscator converts strings into a data structure: an escaped dump, a byte array, a base64 blob, or a table of string.byte chains. This is usually the cheapest thing to defeat and unlocks readable constants everywhere. Find the decoder call pattern, reimplement it, fold every call site back into a literal. Escaped-string dumps and plain byte arrays need no crypto at all.

3 · Build a constant evaluator

Obfuscators replace literals with arithmetic (0x1F * 4 + 2, string.char(...) math, table lookups with sequential keys). Write a small evaluator over Lua key expressions: numeric literals, string literals, unary/binary arithmetic on those, string.byte/sub on literals, table index into a known-constant table. Anything the evaluator resolves to one value, rewrite in place. This pass alone de-obfuscates a large share of light builds.

4 · Attack the dispatcher if one exists

A VM-protected build has a while true do loop switching on a program counter over a bytecode array. Dump the bytecode, map each opcode to its handler by reading the dispatcher, then emit equivalent Lua. Do not try to symbolically execute the dispatcher; transcribe it. IronBrew-class builds need the per-build key and constant-type map recovered before the bytecode decodes.

5 · Fold and clean

Run the constant evaluator again over the output, inline single-use locals where safe, drop dead branches, and re-emit readable Lua with correct indentation. Expect to iterate: fold, re-scan, fold again. The Scanner re-run tells you which weak points remain. The Renamer and Cleaner tabs are the finishing passes as ready tools: readable names first, then comment strip, escape decode and re-indent.

6 · Verify against the samples

Keep the Samples tab as your regression suite: every fix should make one more sample decode byte-exact, and none of the already-passing ones should break. Verify decoded output by running both original and deobfuscated versions side by side, comparing stdout, not by eyeballing.

Most tools deobfuscate one obfuscator. This one helps you build your own: the Scanner fingerprints a script, lists the concrete weak points (decodable string tables, foldable constants, dispatcher structure, surviving plaintext), and turns them into an ordered action plan. The Samples tab gives you clean fixtures per obfuscation style so you can test each pass of your deobfuscator as you write it.

What is inside

• Scanner: fingerprints and weak-point report
• Analyzer: loader unwrapping, strings, anti-tamper / anti-env / anti-debug report
• Renamer: readable-name rewrite pass
• Cleaner: comment strip, escape decode, re-indent
• Env Logger: runtime harness generator and log analyzer
• Samples: per-style test fixtures
• Playbook: the build order for your deobfuscator

Companion tools

• Terror Analyst — multi-obfuscator deobfuscation suite (Luraph, MoonSec, IronBrew2, more)
• Zenfuscator — keyless in-browser Lua obfuscator
• Lyzin Analyzer — Windows PE static analyzer

How it runs

Everything runs locally in your browser. Files you scan never leave your machine. There is no account, no server, no logging.