caomod2077 / Deobfuscator-Luraph-V15
git clone https://github.com/caomod2077/Deobfuscator-Luraph-V15.git
A standalone, high-performance deobfuscator and devirtualizer for Roblox Luau scripts protected by Luraph v15.
—
stars, 24h
—
stars, 7 days
+173
stars, 30 days · #1,441
173
★ total
89
forks · 5 open issues
Star history starts 2026-10-20; the chart appears after the second daily snapshot.
LanguageJavaScript
LicenseMIT
Created2026-09-26 (24d ago)
Last push16d ago
Watchers2
OwnerUser
GitHub topics
Links
README excerpt
# Luraph v15 Deobfuscator
A standalone, high-performance deobfuscator for Roblox Luau scripts protected by **Luraph v15**.
---
## Overview
Luraph v15 compiles Luau scripts into an interpreted virtual machine (VM) with flattened dispatch loops, encrypted memory buffers (`LPH_ENCSTR`, `LPH_ENCFUNC`), and anti-tamper crash traps (`LPH_CRASH()`).
This tool acts as a reverse compiler:
- Recovers original control flow structures (`if/else`, `while`, `for`, `repeat/until`) from low-level VM dispatchers.
- Decrypts lazy in-memory constants using a live sandboxed Luau runtime.
- Isolates and bypasses anti-tamper traps to discover hidden code paths.
---
## How It Works
The deobfuscator operates across 5 stages:
[code]
1. **AST Analysis & Hooking (`vmmap`)**:
Parses the input script with `luau-ast` to map out the VM interpreter loop and closure constructors. Injects non-destructive telemetry hooks to track proto execution and register states.
2. **Sandboxed Simulation (`harness`)**:
Executes the script inside an isolated, offline Roblox engine emulator (`envlog.luau`). If execution encounters an anti-tamper trap (`LPH_CRASH()`), the engine identifies the responsible function, disables the trap path, and reruns along stable branches.
3. **Live REPL Memory Decryption (`devirt`)**:
Luraph's lazy encryption requires dynamic decryption keys. The engine communicates directly with an active Luau REPL process via IPC to decrypt string and numerical constants live in memory.
4. **Control Flow Graph (CFG) Reconstruction (`structure`, `loops`)**:
Uses Sparse Conditional Constant Propagation (SCCP) to trace virtual register values. Basic blocks are assembled into a control flow graph, restoring nested loops (`while`, `for`, `for-in`) and branching logic (`if/elseif/else`).
5. **Polish & Variable Naming (`backend`, `names`)**:
Virtual registers are analyzed across basic blocks using Static Single Assignment (SSA) web analysis. Variables are assigned context-aware names based on Roblox API usage (e.g. `Players`, `TweenService`, `ReplicatedStorage`), and the output is verified through syntax compilation.
> For compiler theory, opcode mechanics, and detailed analysis passes, see TECHNICAL.md.
---
## Features
- **Full Devirtualization**: Recovers high-level control flow, closures, and scoping instead of simple trace logging.
- **Optimized Symbolic Engine**: Shared mode-dispatch cache, iterative AST traversal, and declaration memoization deliver up to 2.1x faster devirtualization.
- **Robust Table Lifting**: Handles `table.pack`-style packed lists (`{n = count}`) in VM registers, plus symbolic indexing, comparison, and boolean coercion on packed values.
- **Fast-Path Engine**: Skips redundant verification passes once all constants are decoded live.
- **Offline Roblox Sandbox**: Includes offline models for Roblox services, `Path2D`, `UDim2`, `Vector3`, `CFrame`, and executor globals. No Roblox client needed.
- **Self-Contained**: Luau binaries, runtime emulators, and a