LuaReSym: Recovering Variables Liveness Range in Stripped Lua Bytecode via Multi-Stage Static Analysis
Lua is a lightweight scripting language widely adopted in diverse application domains. In practice, Lua applications are usually distributed as compiled bytecode to protect intellectual property and improve loading efficiency. Existing Lua decompilers rely heavily on debugging symbols embedded in bytecode to generate human-readable code. When these symbols are stripped, they utilize heuristic-based methods to infer variable liveness ranges. However, existing heuristic methods often produce inaccurate predictions, significantly reducing readability of the decompilation results. In this paper, we present LuaReSym, a multi-stage static analysis approach to recover the variable liveness ranges in stripped Lua bytecode. LuaReSym first extracts fragmented liveness ranges through dataflow analysis and Lua-specific heuristic rules. It then iteratively refines these ranges using nesting and dominance constraints from Lua’s stack-based register allocation. We conducted extensive experiments on a public dataset containing 400,587 real-world Lua scripts. LuaReSym achieves an F1-score of 0.9741 for liveness range recovery task, outperforming approaches used by existing decompilers like unluac and LuaDec. Meanwhile, when integrated with the recovered ranges, unluac, one of the state-of-the-art Lua decompilers, can successfully decompile about 98.61% scripts with readable output.