Hacking Lua - Inject new functions into built Lua

Question

I am trying to hack a game (not for cheating though) by introducing new built-in methods and functions in order to communicate with the game using sockets. Here is a small "pseudo code" example of what I want to accomplish:

Inside the Lua code I am calling my_hack() and pass the current game state:

GameState = {}

-- Game state object to be passed on
function GameState:new()
  -- Data
end

local gameState = GameState:new()
-- Collect game state data and pass it to 'my_hack' ..
my_hack(gameState)

and inside my_hack the object is getting sent away:

int my_hack(lua_State * l)
{
   void* gameState= lua_topointer(l, 1);

   // Send the game state:
   socket->send_data(gameState);

   return 0;
}

Now, the big question is how to introduce my_hack() to the game?

I assume, that all built in functions must be kept in some sort of lookup table. Since all Lua code is getting interpreted, functions like import etc. will have to be statically available, right? If that is correct, then it should be "enough" to find out where this code is residing in order to smuggle my code into the game that would allow me to call my_hack() in a Lua script.

There should be two options: The first is that the Lua built is embedded inside the executable and is completely static and the second is that all Lua code gets loaded dynamically from a DLL.

This question goes out to anybody who has a slightest clue about where and how I should keep looking for the built in functions. I've tried a few things with Cheat Engine but I wasn't too successful. I was able to cheat a bit ^^ but that's not what I'm looking out for.

RyanSquared RyanSquared · Accepted Answer · 2016-12-02T02:40:19

Sorry for not providing a full answer, but if you can provide a custom Lua VM and change the standard libraries, you should be able to to change the luaL_openlibs method in the Lua source to provide a table with my_hack() inside of it.

Hacking Lua - Inject new functions into built Lua

2 Answers