Ferib

Or try something that doesn't put immature/offensive text in your code https://luaobfuscator.com/forum/post/6/Adding-LuaObfuscator-to-your-GitHub-repo

Happy to see you are finally catching up on the conversation as this is exactly my point, all I request is to have a Lua API so that I can call `pthread_create` from the Lua context. For example, `gg.setValues` eventually calls the native `process_vm_writev` function, I don't see why extending the Lua APIs is a problem in general. I think @Feribjust doesn't want to admit he made a bad example. He's doesn't want to admit he made a mistake, so there's no point arguing about it. > Can be any process as in Can be any process **selected by GG**, meaning whatever the target process might be. The GG Daemon process was an example and has indeed to be selected, in fact, the whole GG API set will ONLY work on the selected target application. Apologise for my 'mistake' I forgot the lack of knowledge you might have had.

the GG daemon process is just an example, can be any process Your theory doesn't make much sense to me. All I requested was the use of `pthread_create` which you argue would allow code execution which can be achieved in different ways, no matter how dIfFiCuLt that is. But that is okay man, the reason we don't have it has to do with the fundamentals of Android.

You are such a joke, we can just write bytes into memory and have them executed by hooking a hot code path. Might as well hook the GG daemon and executed arbitrary code.

@shuishanJust inject frida gadget .so and then use your .JS script? xDD

Again I am not talking about multi-threading in the Lua side, just want to create a new thread on a asm function. Currently got around it by hooking a function and writing a small code cave to invoke thread creation.

Obfuscation in general is mostly used as DRM, usually to prevent sharing scripts without permission of the developer. I believe the devs should have all the rights to their own script and it would be kinda sad to have people not share their script as they are afraid to have it leaked or stolen. Of course obfuscation doesn't prevent that but it definitely makes it a bit harder and time consuming.

You are confusing encryption with obfuscation, yes when you encrypt a script it will have to get decrypted before it can be used, making encryption pretty useless. Obfuscation is different as it transforms the script BUT keeps the functionality, it will just be harder to read for humans yet GG still knows what to do. The LuaR you see is just pre-compiled Lua Bytecode, it is not safer but the Lua Script is transformed into Lua Bytecode, this is some kind of 'obfuscation as the text representation is transformed into a byte representation that is difficult to understand for humans yet GG still knows exactly what to do. However I still recommend to obfuscate any script as it will stack multiple layers of transformation, making it more difficult for an attacker. You can do a memory read 10 times and only have 1 out of 10 be used by the script, you may also write 10 times to the same number and only have the last value as the real value. Yes it will create a huge memory overhead, which hopefully forces the attacker to turn it off or disk gets f*ck. Or attacker keeps it enabled and has lots of logs to read through.

The heck you doing here ;D?

Obfuscation does not protect against that, but out of curiosity can you show me some example logs? EDIT: found an example here: this is the log file .... how to run it to simple lua (#4xa0gh75) One think you might do is to first check if a logfile is generated on the device and exit the script, or bloat the logs by having junk-values/scans being done. Might be an interesting challenge to generate automated calls to gg.getValue or gg.searchNumber with pseudo-random numbers so an attacker will have a harder time to figure out which call is correct. Combine that with some logic on the higher Lua level and you got (despite the logging) a somewhat decent protected script.

You paste your code in the window, then click either 'obfuscate' for 1-click solution or click on 'All Actions' to get more individual obfuscations

You take your lua code, obfuscate your lua code, then use THAT obfuscated lua code. (it will run just fine)

Hi folks, I doubt you guys are looking for 'encryption', but instead, are looking for 'obfuscation'. To know the difference between the two, let me explain what they mean: - Encryption: "the process of converting information or data into a code, especially to prevent unauthorized access." - Obfuscation: "the action of making something obscure, unclear, or unintelligible." The problem is that Encryption is what you want as it's the best at 'securing' your code from unauthorized access, however the receiver of your code will most likely 'decrypt' the code to use it, making it completely obsolete. The solution is Obfuscation as the Lua script will be transformed into something that still has the same functionality, however it has been "transformed' in the worst possible way so that humans will have a very hard time understanding what it does. Good obfuscation means it is simply to hard/difficult to understand what the script does for a human. So where do you get obfuscation? you can use free online tools such as https://luaobfuscator.com/, I have no experience with other tools as most of them are pay to use. Example use of LuaObfuscator.com: -- sample snippet to calculate prime numbers: do function sieve_of_eratosthenes(n) local is_prime = { } for i = 1, n do is_prime[i] = 1 ~= i end for i = 2, math.floor(math.sqrt(n)) do if is_prime[i] then for j = i* i, n, i do is_prime[j] = false end end end return is_prime end local primes = sieve_of_eratosthenes(420) for key, value in pairs(primes) do if (value) then print("Prime found: " .. key) end end end Obfuscated output (CFFv1, Strings, Minifiy ) local v0 = string.char; local v1 = string.byte; local v2 = string.sub; local v3 = bit32 or bit; local v4 = v3.bxor or v3.bxor; local v5 = table.concat; local v6 = table.insert; local function v7(v8, v9) local v12 = {}; for i = 1, #v8 do v6(v12, v0(v4(v1(v2(v8, i, i + 1)), v1(v2(v9, 1 + ((i - 1) % #v9), 1 + ((i - 1) % #v9) + 1))) % 256)); end return v5(v12); end do local v10 = 0; local v11; while true do if (v10 == 1) then for key, value in pairs(v11) do if value then print(v7("\3\43\133\37\54\121\138\39\38\55\136\114\115", "\83\89\236\72") .. key); end end break; end if (v10 == 0) then function sieve_of_eratosthenes(v13) local v14 = 0; local v15; while true do if (v14 == 0) then v15 = {}; for i = 1, v13 do v15[i] = 1 ~= i; end v14 = 1; end if (v14 == 1) then for i = 2, math[v7("\205\90\58\188\217", "\171\54\85\211")](math[v7("\7\152\255\8", "\116\233\141\124\175\201\74\192")](v13)) do if v15[i] then for j = i * i, v13, i do v15[j] = false; end end end return v15; end end end v11 = sieve_of_eratosthenes(420); v10 = 1; end end end

the pthread_create is indeed a native thing, what I meant is that I would like a Lua wrapper API to invoke the pthread_create so that I can spawn a thread on my injected assembly instructions. Lua coroutines are overrated btw

Hello, would it be possible to have a Lua wrapper for `pthread_create` so we can create threads on the fly using the GG Lua API? I think more advanced people would greatly appreciate this as this would make GG more competitive against Frida, thanks.

cool bro