Cheat Engine

[okmeow]

There is plenty of information on using lua to perform operations, however there is not any info on how to read lua stack from cheat engine, regardless of approach. That is what I am wondering how to do? That is, use cheat engine to read lua from ANOTHER process.

I know that it is a script language, so hooking functions is impossible. Perhaps hooking the lua C funcs is, in order to grab the luastate global, and thus access the stack --- but that is just a theory...
Does anyone have any advice on this, or experience?

My goal is take a hello world type application with an infinite loop powered by lua, and access information stored within a table, externally from cheat engine whilst it runs. A monitor application is the end-goal, one that monitors lua table data. I could provide source if really desired, but it really is literally a simplistic inf loop w/ lua modules loaded, and table data pushed to the stack.
Any help appreciated..


What i have tried is: Convert table to a json string(for ease of testing), and attempt to locate a way of determining the DMA address for it, but am not having any luck. Sure I can find the string, but that changes (of course) each time it's written and/or on-app-load.
So I would have to scan the app mem pool each time I want to find it at the exact moment I want to find it, which is obviously not ideal.

[Dark Byte]

It depends on the implementatiln of lua on how easy/hard it will be. If it makes use of dll's to use lua you can do a lot and easy (e.g replace the dll's and at launch setup for debug mode)
If it's statically linked,or even directly compiled in you will have to do signature scanning, and keep in mind that each compiler might generate a different entry point

[okmeow]

cool thank you very much for your reply. Just like any other dll I suppose hehe... asm at it's core.

So in essence I could, for simplicity, just detour something such as loadstring or loadfile to obtain the _G stack. Hmm I'm going to need to dig into the lua source.

Out of curiosity, would it be possible to access the stack pointer/data without injection(for sigscan)?
Or would it be too difficult to identify the indices needed for such a set of data(assuming former is even likely), without direct access to the running lua system?


Thanks a lot, I think I'm on the right track now.