How do you deobfuscate bytecode?

You’ll need knowledge on reverse engineering, Lua internals, and a decompiler. The obfuscation completely depends on the obfuscator, but Xen as far as I know does transformations on the bytecode which mean you can’t just plop it into a decompiler and have it work.

You’ll need to figure out how the bytecode maps to vanilla Lua’s format or write a translator for it, and then run a vanilla decompiler on it.

Alternatively, you can always look into sandboxing to get an idea of what the code is doing without getting the source.

6 Likes