[BITS 32] [CPU PRESCOTT] xrLUA_ISZ equ 0x005CC104 szluaopen_base equ 0x005C9110 szluaopen_package equ 0x005C911F szluaopen_table equ 0x005C9131 szluaopen_io equ 0x005C9141 szluaopen_os equ 0x005C914E szluaopen_string equ 0x005C915B szluaopen_math equ 0x005C916C szluaopen_debug equ 0x005C917B szluaopen_jit equ 0x005C918B szluaopen_coco equ 0x005C9199 szlua_pushcclosure equ 0x005C91A8 szlua_pushstring equ 0x005C91BB szlua_call equ 0x005C91CC xrLUA_IAT equ 0x005CC1D5 luaopen_base equ xrLUA_IAT + ( 4 * 0 ) ; 0x005C91D5 luaopen_package equ xrLUA_IAT + ( 4 * 1 ) ; 0x005C91D9 luaopen_table equ xrLUA_IAT + ( 4 * 2 ) ; 0x005C91DD luaopen_io equ xrLUA_IAT + ( 4 * 3 ) ; 0x005C91E1 luaopen_os equ xrLUA_IAT + ( 4 * 4 ) ; 0x005C91E5 luaopen_string equ xrLUA_IAT + ( 4 * 5 ) ; 0x005C91E9 luaopen_math equ xrLUA_IAT + ( 4 * 6 ) ; 0x005C91ED luaopen_debug equ xrLUA_IAT + ( 4 * 7 ) ; 0x005C91F2 luaopen_jit equ xrLUA_IAT + ( 4 * 8 ) ; 0x005C91F6 luaopen_coco equ xrLUA_IAT + ( 4 * 9 ) ; 0x005C91F9 lua_pushcclosure equ xrLUA_IAT + ( 4 * 10 ) ; 0x005C91FD lua_pushstring equ xrLUA_IAT + ( 4 * 11 ) ; 0x005C9201 lua_call equ xrLUA_IAT + ( 4 * 12 ) ; 0x005C9205 luahack_load: ; eax is state ptr push ebx ; func ptr push esi ; str ptr push edx ; edx is relocated base image ptr, becomes state ptr push edi ; call func call luahack_eip_offset luahack_eip_offset: pop ecx sub ecx, luahack_eip_offset ; get func base mov ebx, edx mov esi, edx mov edi, edx add ebx, luaopen_base add esi, szluaopen_base add edi, lua_pushcclosure xchg edx, eax ; grab state ptr passed thru eax ; base add esi, 12 add eax, luahack_postreg ; return to after luahack_reg hack push eax luahack_reg: push ebx push edx call [ edi ] add esp, 4*2 push esi push edx call [ edi + 4 ] add esp, 4*2 push dword 0x00000000 push dword 0x00000001 push edx call [ edi + 8 ] add esp, 4*3 ret luahack_postreg: ; package add esi, 11 call near luahack_reg ; table add esi, 18 call near luahack_reg ; io add esi, 16 call near luahack_reg ; os add esi, 13 call near luahack_reg ; string add esi, 13 call near luahack_reg ; math add esi, 17 call near luahack_reg ; debug add esi, 15 call near luahack_reg ; jit add esi, 16 call near luahack_reg ; coco add esi, 14 call near luahack_reg pop edi ; call func pop edx ; edx is base reloc ptr, becomes state ptr - passed by eax pop esi ; str ptr pop ebx ; func ptr xchg eax, edx ; return luaState pointer ret