A standalone, high-performance deobfuscator for Roblox Luau scripts protected by Luraph v15.

Luraph v15 compiles Luau scripts into an interpreted virtual machine (VM) with flattened dispatch loops, encrypted memory buffers (LPH_ENCSTR, LPH_ENCFUNC), and anti-tamper crash traps (LPH_CRASH()).

This tool acts as a reverse compiler:

• Recovers original control flow structures (if/else, while, for, repeat/until) from low-level VM dispatchers.
• Decrypts lazy in-memory constants using a live sandboxed Luau runtime.
• Isolates and bypasses anti-tamper traps to discover hidden code paths.

The deobfuscator operates across 5 stages:

┌────────────────────────┐
│ Protected Luraph Script│
└───────────┬────────────┘
            │
            ▼
┌────────────────────────┐
│ 1. AST Hooking         │ ➔ Discovers VM dispatchers & hooks closure makers
└───────────┬────────────┘
            │
            ▼
┌────────────────────────┐
│ 2. Sandboxed Simulation│ ➔ Runs in offline Roblox VM; isolates anti-tamper traps
└───────────┬────────────┘
            │
            ▼
┌────────────────────────┐
│ 3. Live REPL Decryption│ ➔ Queries in-memory Luau VM to decrypt lazy constants
└───────────┬────────────┘
            │
            ▼
┌────────────────────────┐
│ 4. CFG & SSA Lifting   │ ➔ Reconstructs control flow graph & loop structures
└───────────┬────────────┘
            │
            ▼
┌────────────────────────┐
│ 5. Polish & Naming     │ ➔ Infers local variable names from Roblox API usage
└───────────┬────────────┘
            │
            ▼
┌────────────────────────┐
│ Clean Luau Source Code │
└────────────────────────┘

1. AST Analysis & Hooking (vmmap): Parses the input script with luau-ast to map out the VM interpreter loop and closure constructors. Injects non-destructive telemetry hooks to track proto execution and register states.

2. Sandboxed Simulation (harness): Executes the script inside an isolated, offline Roblox engine emulator (envlog.luau). If execution encounters an anti-tamper trap (LPH_CRASH()), the engine identifies the responsible function, disables the trap path, and reruns along stable branches.

3. Live REPL Memory Decryption (devirt): Luraph's lazy encryption requires dynamic decryption keys. The engine communicates directly with an active Luau REPL process via IPC to decrypt string and numerical constants live in memory.

4. Control Flow Graph (CFG) Reconstruction (structure, loops): Uses Sparse Conditional Constant Propagation (SCCP) to trace virtual register values. Basic blocks are assembled into a control flow graph, restoring nested loops (while, for, for-in) and branching logic (if/elseif/else).

5. Polish & Variable Naming (backend, names): Virtual registers are analyzed across basic blocks using Static Single Assignment (SSA) web analysis. Variables are assigned context-aware names based on Roblox API usage (e.g. Players, TweenService, ReplicatedStorage), and the output is verified through syntax compilation.

For compiler theory, opcode mechanics, and detailed analysis passes, see TECHNICAL.md.

• Full Devirtualization: Recovers high-level control flow, closures, and scoping instead of simple trace logging.
• Optimized Symbolic Engine: Shared mode-dispatch cache, iterative AST traversal, and declaration memoization deliver up to 2.1x faster devirtualization.
• Robust Table Lifting: Handles table.pack-style packed lists ({n = count}) in VM registers, plus symbolic indexing, comparison, and boolean coercion on packed values.
• Fast-Path Engine: Skips redundant verification passes once all constants are decoded live.
• Offline Roblox Sandbox: Includes offline models for Roblox services, Path2D, UDim2, Vector3, CFrame, and executor globals. No Roblox client needed.
• Self-Contained: Luau binaries, runtime emulators, and analysis modules are bundled directly inside this repository.

Support for older Luraph builds is experimental and does not yet recover full source for every script. Honest status per version:

The v14 engine shares the v15 core (trace harness, SCCP walk, structuring, codegen) and layers the v14 quirks on top:

• version detection from the header or the return({...}) / local init = (function(... shapes;
• VM chunk extraction: for bytecode-wrapper samples the VM lives inside a loadstring'd chunk, which is captured and instrumented automatically (the first pass aborts right after the chunk dump instead of executing the raw VM);
• dispatch loops of both shapes (while true do local op=(ARR[pc]); ... and v14.8/v14.9's repeat ... until false), with parenthesised and type-asserted opcode fetches;
• closure factories whose prototype is maker argument 0, often installed inside an initializer whose locals the VM closes over (recovered from the __venv runtime captures where the initializer builds them statically);
• flattened handler state that reads an unresolved table or does arithmetic on a missing value stays symbolic instead of aborting the walk;
• native LPH_NO_VIRTUALIZE closures are preserved as Luau source with their upvalue bindings rebuilt.

What is still missing for full v14.8/v14.9 source recovery: the runtime-built VM-object tables whose methods are re-indexed numerically at run time (e.g. obj[54]) are not yet bound back to their AST definitions, so those lifts abort and the behaviour trace is written instead.

node deob.js sample/v14/v14.7/<sample>.lua -o out.lua

Large v14.8/v14.9 samples (1-2 MB) need longer budgets because the bytecode blob decode is slow in the emulator:

node deob.js sample.lua --timeout 1200 --budget 1200 -o out.lua

Batch mode can process a folder with parallel jobs:

node deob.js sample/v14/v14.7 --jobs 4

• Node.js: v18.0.0 or higher
• Python: 3.10 or higher (powers the backend symbolic execution engine)

Clone the repository and install dependencies:

git clone https://github.com/caomod2077/Deobfuscator-Luraph-V15.git
cd Deobfuscator-Luraph-V15
npm install

# Deobfuscate a single script (saves to ./output/<filename>)
node deob.js input.lua

# Save to a specific output path
node deob.js input.lua -o output.lua

# Batch mode: process a whole folder of scripts
node deob.js ./my_scripts_folder/

# Batch mode: process multiple files at once
node deob.js file1.lua file2.lua file3.lua

# Fast trace-only mode (~2 seconds, skips bytecode lifting)
node deob.js input.lua --no-devirt

# Detect if a script is protected by Luraph without running it
node deob.js input.lua --detect

Note: If your system uses a different Python command (py, python3, or a virtual environment binary), set the PYTHON_BIN environment variable:

set PYTHON_BIN=py        # Windows
export PYTHON_BIN=python3   # Linux / macOS

The engine has been heavily optimized (symbolic AST caching, iterative tree walks, single-pass state analysis, shared dispatch-loop cache, and a bounded SCCP walk). Measured on the bundled sample/ scripts, the current build is 1.6x to 1.8x faster than the previous release, and scripts that previously crashed now lift completely:

Additional stress tests on fresh scripts (run once with the current build, no baseline):

Every input and its reference deobfuscated output is committed in sample/ and sample/output/. All outputs pass luau-ast syntax validation (COMPILE OK). StealAnEgg.lua lifts 99.97% of its 1,723 functions; the remaining 46 blocks (0.03%) are guarded with an explicit error("devirt: unexplored successor ...") marker instead of silently emitting wrong code.

Reproduce it yourself — every input in the table above ships in sample/ and the expected deobfuscated result for each one is committed in sample/output/, so you can verify both the timings and the output quality on your own machine:

node deob.js "sample/Blox Fruit.lua" -o "output/Blox Fruit.lua"
node deob.js "sample/9eccab05cff67267.lua" -o "output/9eccab05cff67267.lua"

Hardware used for the table: consumer Windows machine, Node.js 24, Python 3.12. Exact times vary with CPU and background load; the relative speedup holds.

Luraph v15 is a virtual machine obfuscator, not simple encryption. The deobfuscator performs full compiler-grade reverse compilation:

1. It symbolically simulates virtual registers across thousands of instruction paths.
2. It sends requests to an in-memory Luau VM to decrypt 2,000–2,600 constants on-the-fly.
3. It performs dominator tree analysis to reconstruct nested control flow loops.
4. It analyzes register lifetimes to assign clean local variables across 10,000+ lines of code.

The current build cuts this cost with a shared dispatch-loop cache (mode resolution is computed once per VM instead of once per function), iterative AST walkers with declaration caching, a single-pass state-variable analysis, and a converged SCCP walk limit that keeps CFG minimization proportional to real code size.

If you only need to see what a script does (URLs fetched, remotes fired, UI setup, webhooks) without needing the full lifted source code, use the --no-devirt flag:

node deob.js input.lua --no-devirt

This runs the script in the sandboxed Luau runtime and extracts the complete execution trace in ~2 seconds.

For in-depth explanations of the reverse-engineering methodology, SCCP symbolic evaluation, opcode dispatcher mapping, and SSA register renaming, see TECHNICAL.md.

This project is open-source under the MIT License.

Thanks source to ccjvwsod on Discord This version was rebuilt by me using Node so that multiple Deobf instances can run simultaneously

If this tool saved you time, consider buying me a coffee. Every donation keeps the updates coming (new obfuscator versions, faster lifts, better structuring).

Bitcoin (BTC)

Ethereum (ETH)

Litecoin (LTC)

Tron (TRX)

Mb bank (cho ai ng việt muốn donate)