corsix

Exploiting Lua 5.1 on 32-bit Windows

The following Lua program generates a Lua bytecode program called ignore-unsigned-sga.fnt, which in turn loads a DLL from within an extremely locked down Lua 5.1 sandbox in a program called RelicCOH2.exe. The remainder of this document attempts to explain how this program works by a whirlwind tour of relevent bits of the Lua 5.1 virtual machine.

if string.dump(function()end):sub(1, 12) ~= "\27Lua\81\0\1\4\4\4\8\0" then
  error("This generator requires a 32-bit version of Lua 5.1")
end

local function outer()
  local magic -- In bytecode, the stack slot corresponding to this local is changed

muupan

" A sintax file for Game Description Language (GDL) in Knowledge
" Interchange Format (KIF).
"
" Put this file in .vim/syntax/ and and add set filetype gdl-kif
" Example:
" au BufRead,BufNewFile *.kif set filetype=gdl-kif

syntax region gdlKifLineComment start=+;+ end=+$+
syntax match gdlKifArrow '<='
syntax keyword gdlKifFactRelation base init true next