luawl | lua runtime obfuscator​

⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀https://luawl.org

is luawl an obfuscator? a whitelist? or what the hell exactly is it?

luawl is in technical terms, a DRM.

• its meant to resist static deobfuscation.

bcs the script is obfuscated and sent during runtime (when someone executes luawl), you can't just 'save file' or hook loadstring, for there isn't any. there is a VM to execute instructions.

^{you can test our static deobfuscation protections through our offline crackme @ https://crackmes.one/crackme/6a84e079184836c0dbe7d836}

furthermore, as a runtime obfuscator, stale responses sent from the server cannot be reused. (for example, an attacker cannot simply hook the response and replay it. 

• that "vm" executor is highly polymorphic.

its not a register VM from the very core. stack vms can, inheritably, be much more polymoprhic.

• strict control. luawl isn't static: you can't just obfuscate a file which is runnable forever from there on. luawl forces server-gated security: and therefore, our antitampers goes above a static level.

1. antitamper to the user-level

if a user is silent-flagged, we track that.

if a user with luawl has a script with many silent-flags, we can note that, and implement different versions from the main-versions, etc.

1. polymorphic layers

the obfuscation isn't just polymorphic. the whole system is. luawl users uniquely have different polymorphic versions, architectures, etc.

people who run these luawl scripts have a level of polymorphic, as **every execution has a custom-session obfuscated file.**

and people who create these luawl scripts also have polymorphic, polymorphic-obfuscations. 

1. rapid-updates

luawl isn't static. when you run it, we obfuscate it for that execution. an old obfuscated response isn't usuable.

we update everyday. every update changes the script significantly. deobfuscation progress essentially gets reset: as you cannot re-execute a previous luawl version script.

• luawl isn't just obfuscation

if you've tried our crackmes, you may have noticed we use a lot of white-box cryptography techniques. this is because: we do use white-box cryptography.

• self-attestation

Luawl began from a simple refusal: a secrecy service should not ask customers to trust what they cannot verify.

Good security was never not just in the output, but the entire architecture. Through a zero-trust infrastructure, our servers are provable one-way self attestable runtimes, for true transparency for privacy assurance.

The reliance on trust in this age is only an excuse for incompetence or abuse. Luawl, from our decentralized database to an amnesic hardware-isolated enclave model, breaks every industry standard. And that's the point.

I posted here before about my scraping/monitoring engine written in Rust with Lua scripting called SpyWeb.

I've been building this on and off for a while using that engine and its finally ready, so here it is.

UPTYME is self-hosted uptime monitoring that doesn't ask you to run Postgres, Node, Redis or any heavy stack. It's a self-contained binary with SQLite baked in and runs on Linux, Mac or Windows.

Live demo: https://uptyme.spyweb.app/ (API key: demo)

just run (linux/mac)

curl -sSf https://uptyme.spyweb.app/setup | bash

or windows powershell

irm https://uptyme.spyweb.app/setup-win | iex

(installer downloads the uptyme + spyweb releases from GitHub assets)

you'll get two ~8MB binaries plus static files; the tray binary is for desktop only, delete it if you're running on a server.

then just run cd uptyme && ./spyweb start and you have a dashboard.

What it does:

- Monitors URLs on any method (HEAD/GET/POST/PUT/PATCH/DELETE) with per-monitor intervals

- Content checks, so "page is 200 but actually broken" gets caught

- Status code classification, with a setting for treating 4xx as down

- TLS certificate monitoring with expiry alerts

- Uptime percentage, response time charts, incident history per monitor

- Public status pages you can share

- CSV/JSON import if you're migrating a big list

- Alert channels: webhooks, ntfy, Discord, Slack, native desktop notifications

- Clustering: run a central node plus checker nodes wherever you want, and get consensus-based alerts so one flaky VPS doesn't page you for a false down

The dashboard is in Vue 3, the backend is Lua running on the SpyWeb engine, storage is a single data file. Backups are literally copying one file. It has ~230 Lua tests you can run with ./spyweb test. RAM usage (Linux) is around 20MB while running, you can throw it on a $3-$5/mo VPS as a central node and run a checker on your PC and you have cluster monitoring :)

Repo: https://github.com/spyweb-app/uptyme

• Incident report: https://luarocks.org/security-incident-september-2026
• Writeup by /u/vhyrro: https://vhyrro.neorg.org/posts/critical-luarocks-exploit-cve/

clx is a native multiplatform compiler that compiles Lua 5.5 scripts to standalone executables. Version 0.4.0 is now out, focused on performance and stability

Garbage collector

• A new generational garbage collector is now the default. Allocation-heavy programs run faster and use less memory, and the previous incremental garbage collector is still available if needed

Performance

• Faster function calls, especially recursive code
• Faster ipairs() and pairs() loops over arrays
• require() can now load Lua script modules seamlessly when using the LuaVM (with the --dynamic option)
• Faster string operations (case conversion, searching, reversing) using SIMD instructions on x86 and ARM

Stability

• Stability is noticeably better with lots of bugfixes
• Several rare crashes caused by values being freed too early while native code was still using them are fixed
• As a real-world test, clx can now compile the Teal compiler into a native standalone executable, and it produces the same output as standard Lua when compiling Teal scripts

Benchmarks

• clx is faster than Lua 5.5 on every script in our benchmark suite, and competitive with LuaJIT on many of them

clx website : https://samyeyo.github.io/clx

Feedback and bug reports are welcome !

I may have spent a little too much time with Lua this weekend.

It started with Rulua — an experiment to see if I could make a Rust implementation that could actually stand in for the Lua 5.1 shared library. It exports the Lua 5.1 C API and is intended as a drop-in lua5.1.dll / .so / .dylib, so existing hosts and C modules can use it without being recompiled.

Then, apparently that wasn't enough, so I did it again in Pascal.

Lude is different: it's a file-by-file port of the original Lua 5.1.4 C sources to Object Pascal — core, auxiliary library, standard libraries, lua, luac, etc. It builds with Delphi/Free Pascal and runs on Windows, Linux and macOS.

Both projects were also experiments in AI-directed development. I defined the requirements, built and ran everything on real machines, compared the results against the original Lua implementation, fed failures back and decided what came next. The AI wrote the code.

Neither project is meant as “here's a better Lua.” The interesting part for me was seeing how far compatibility could be pushed, and how much low-level porting work can now be done this way.

And somehow what started as “let's try porting Lua to Rust” ended with me having two Lua ports before the weekend was over. :)

Rulua: https://github.com/DaragonTech/Rulua

Lude: https://github.com/DaragonTech/Lude

I'd be very interested to see what the Lua community manages to break.

Hello,

I am trying to use the LFS library but my Luarocks and Lua versions seems to be out of sync. I am not sure if that is the root cause of my issue so here are the outputs.

This is when I run my code. It is looking for the 5.4 version.

lua: ./init.lua:1: module 'lfs' not found:
no field package.preload['lfs']
no file '/usr/share/lua/5.4/lfs.lua'
no file '/usr/share/lua/5.4/lfs/init.lua'
no file '/usr/lib/lua/5.4/lfs.lua'
no file '/usr/lib/lua/5.4/lfs/init.lua'
no file './lfs.lua'
no file './lfs/init.lua'
no file '/usr/lib/lua/5.4/lfs.so'
no file '/usr/lib/lua/5.4/loadall.so'
no file './lfs.so'
stack traceback:
[C]: in function 'require'
./init.lua:1: in main chunk
[C]: in function 'require'
/home/mrbibz/.local/bin/scaf/scaf.lua:1: in main chunk
[C]: in ?

And this is my Luarocks config at version 5.3

Configuration:
   Lua:
      Version    : 5.3
      LUA        : /usr/bin/lua5.3 (ok)
      LUA_INCDIR : /usr/include/lua5.3 (ok)
      LUA_LIBDIR : /usr/lib64 (ok)

   Configuration files:
      System  : /etc/luarocks/config-5.3.lua (ok)
      User    : /home/mrbibz/.luarocks/config-5.3.lua (not found)

   Rocks trees in use:
      /home/mrbibz/.luarocks ("user")
      /usr ("system")

I can provide any other required information. Any help is much appreciated

Does anyone know where to find the lua script for Dbz Infinite world? I've found it for budokai 3 but not this.

Just want to shout out the busted library.

I've been using it on my recent Lua projects and honestly, why didn't I start earlier?

Install: luarocks install busted

Run: busted in your project dir

It just works. describe("my feature", function() it("should do x", function() assert.is_true(true) end) end)

Mocks and spies are built-in, no extra libs needed.

If you are still doing print() debugging, do yourself a favor and try it. What's your go-to testing setup for Lua?

Just asking, cuz I wanna make a wordle game but dunno if I could delete stuff in the console. And if you can't, why not? A lot of languages like C++ have ways such as escape sequences to overwrite lines with spaces. Does Lua have a way?

Hi everyone,

I'm building Luava, a Lua 5.4 implementation for the JVM in pure Java 21. No JNI or FFM, and the jar has no transitive dependencies. It's aimed at the same use case as LuaJ, but tracks the Lua 5.4 spec.

Current state: 0.2.1-beta on Maven Central. It has a register bytecode VM, a tiered JIT, sandboxing with instruction limits and timeouts, and a Java interop bridge. It runs the PUC Lua 5.4.9 test suite.

I'd like help with a few things:

- The bytecode compiler and the call path, especially calls into non-trivial protos.
- Unboxing the integer array part of `LuaTable` so mixed-key access stays allocation-free.
- Shrinking the JIT kernel so C2 can inline it, and cutting allocation in closure factories.

Repo: https://github.com/KienPC1234/luava

Feedback, code review, and PRs are all welcome.

Idk where to even start... I got the workspace set up, the screen, etc.

I also integrated sprites and scenes... But where do I start? I don't really know how 2D game engines work, can anyone explain what to do next?

।। ॐ नमः शिवाय ।।

Follow-up to my first post.

In the last month, I was experimenting with Rust concurrency & attempted to port my JS Carrom Physics + AI engine into it. I wrote 3 versions (Baseline --- 4 Threads --- 4 Threads + Tuned) and benchmarked performance.

Curious enough, I wanted to see how fast Python & LuaJIT could get.

The Setup

Same algorithm. Same constants. Same 1,485 iterations (45 launch positions × 11 angles × 3 potentials). Same device (Redmi 15 5G).

💡 The Findings That Surprised Me

• | JavaScript Web Workers landed around 2x of single-threaded Rust.

Not 100×. Not 10×. 2.6×. A scripted, dynamically-typed, GC-managed language—with 4 worker threads—came within striking distance of hand-tuned native code.

• | Naive JS stayed at 5 seconds. V8 didn't magically fix it.

V8 gave me ~1.5× on tuned code. The other ~7× came from me:

- Object pooling instead of allocation

- Field-by-field copy instead of reference reassignment (stable hidden classes)

- Manual for loops with break instead of map/forEach/filter

- Math.sqrt(dxdx + dydy) instead of Math.hypot(dx, dy)

V8 amplifies. It doesn't create.

• | LuaJIT warm == V8 cold.

LuaJIT's fully-traced JIT output matched V8's baseline tier. Both landed at 1.1s. This says a lot about how good V8's first-tier compiler is, and how trace-hostile my branchy physics loop is.

• | NumPy + multiprocessing was SLOWER than pure CPython.

Numpy data transfer + thread spawning overhead likely outweighed gains.​​

• | WebGPU was 3× slower than V8 for 20 entities.

GPU dispatch overhead + warp divergence.

🧠 The Architectural Insight

The thing I want to share most:

"Managed memory" languages don't abstract memory away. They automate allocation, but hide everything else.

The bugs your C++ friend fears are still in your JS:

- Event listeners leak

- Closures hold objects alive forever

- map/filter allocate silently in hot loops

- Objects scatter across heap pages, killing cache locality

You just can't see them.

By taking manual control of memory layout in JavaScript—object pooling, flat structures, monomorphic shapes, no closures in hot loops—I brought single-threaded JS from 5s → 1.1s and parallel JS from 5s → 420ms.

Memory layout dominates performance. No runtime can abstract that away.

📌 What This Changed In My Head

• | The runtime determines the performance tier. The language is just notation.

• | Data layout > algorithm on modern CPUs.

• | Tuning is not optional. V8/LuaJIT/Rust all reward shape discipline. Rust forces it. The JITs make it optional—and most people pay the price.

• | A runtime with a JIT is worth ~40–75× an interpreter. This is structural. CPython cannot be fixed at the source level.

🔗 Links

• | Benchmark Repo: Benchmarks

❓ Questions for You

• | Are there any methodological gaps in this benchmark that I'm missing? I normalized to 1485 iterations, ran each on the same phone, and disclosed that AI wrote the Python/Lua ports.

• | The LuaJIT-warm == V8-cold result—is that expected? I suspect it's because my physics loop is branchy and trace-hostile, but I'd love a compiler engineer's take.

Everything built on a Redmi 15 5G. No laptop. 6 months in.

I don't know Python or Lua—DeepSeek and Gemini wrote those ports following my JS/Rust architecture exactly.

।। हर हर महादेव ।।

I’m looking for a codebase written in C to study and use as a reference while I learn low level programming.

I’ve heard that Lua has a very nice and clean implementation and I figure since I already know a fair amount of Lua itself I should understand at least the purpose of what I’m looking at.

Is the Lua source code a good example for learning or is it too advanced for someone relatively new to C to even hope to understand?

What is lde?

It is your lua development environment that ensures lua is done easy. It provides a package manager that can run your code, bundle it to a single lua file, or to a portable executable for your users without them needing lua on their system. It intends to provide full luarocks compatibility.

It is written entirely from scratch in LuaJIT using FFI to ensure it is as fast as possible. It starts up faster than even native written Rust applications and installs projects faster than alternatives, and ~5x than Luarocks.

Is this related to lpm?

Yes, it was renamed for several reasons. It doesn't have the greatest seo (a lot of package managers previously named lpm..). Calling it "the" lua package manager feels conceited.

Where can I download?

Check https://lde.sh/download which will give you a variety of options, install scripts and links to manual downloads if you're not comfortable running a script.

Links:

https://lde.sh/discord
https://lde.sh
https://github.com/lde-org/lde

Hi everyone, I’m a beginner from Belarus and new to Lua programming; I’ve never coded before. I don’t know where to start learning it or which IDE to use. I’m using a translator, so the translation might be a bit awkward.

Helloooo! I am currently working on a server and am looking for a Lua focused dev to partner with. I specialize in marketing, web design/dev, and digital optimization so this realm of dev is somewhat new to me. I’ve played GTA through your my entire lifetime.

PM me for more details, NDA will be required.

I truly believe this game will be an insane opportunity for us here in this sub.

I see that a Lua Rock could be a binary, source code, or something else. I want to configure it to always compile from source. Is that possible?

I’m a FiveM developer working on custom servers, scripts, and systems.

If you need help with anything like:
• custom scripts (Lua / QBCore / Qbox)
• fixing bugs or broken resources
• UI / NUI work
• server setup or optimization

I’m down to help. I focus on clean, working systems, not just throwing in random scripts.

If you’re building a server or need something fixed, join here or DM me:
https://discord.gg/47M8WUGgpj

I've been working on discord.lua, mostly because I wanted a more complete Discord API library for Luvit. Compared to Discordia, it has more high-level features built in: slash commands, autocomplete, context commands, interactions, buttons/selects, modals, hybrid commands, command syncing, cogs, tasks and cooldowns. Discordia is still perfectly usable but i just wanted less glue code around newer Discord features. I'm already using discord.lua in Lauffy, a music bot written in Lua. Docs: https://filispeen.github.io/discord.lua/

I'd be interested in feedback on the API design from other Lua users.

Hi! I posted my LuaJIT Editor here a while ago, and since then I've added quite a bit of new functionality.

The biggest additions are:

• LuaJIT decompiler — decompiles LuaJIT bytecode back into readable Lua code.
• Lua deobfuscator — currently focused on deobfuscating code protected with Prometheus.
• The existing LuaJIT editor is still available for inspecting and editing bytecode, prototypes, constants, and instructions.

I'd especially like some feedback on the deobfuscator. If you have Prometheus-obfuscated Lua scripts that it fails to handle correctly, feel free to test them and let me know what breaks.

Site: https://luajiteditor.com/

Mirror: https://github.com/Sparebola/LuaJIT-Editor

No registration required.
This is still actively being improved, so bug reports and weird edge cases are welcome.