Need help finding lua_createtable

[Ellesar1]

I want to push a new table on the lua stack as return value for a custom function I register in WoW. However, since the Info dump thread didn't mention lua_createtable which is needed for this purpose, I tried to find it myself but failed epically.

My attempt was to create a new project which only included the sample LUA project, and to insert debug strings inside of the lua_createtable function to find it later via OllyDbg => Search for... => All referenced strings.
Afterwards, I've noticed that the functions which were already found by the MMOwned community lie all in some address range. I've looked through every function in that range manually but couldn't find a similar one than the one from the sample project.

I know that my reversing skills are not really what they should be (everyone has to start once) but I'ld like to know what the correct approach is to find such a function.
Problem is that you cannot make WoW call lua_createtable using the lua-interpreter since lua_createtable is part of the c-api and is therefore only called by C-/C++-functions.

Anybody some hints?

[ostapus]

wow 3.2.2.10505
lua_createtable - 0x00803E50

[zzgw]

Your best bet is to compile lua with debugging symbols (still run optimizations though) and then try a bytecode search in WoW for the function's body. If you get lucky they both are the same. If not, the order usually stays the same so you can derive its positions from other known lua functions.
Or you could look at the C function of a WoW API function that returns a table, etc.

[Ellesar1]

Your last point sounds very interesting. A C-function which is registered to WoW's LUA host and returns a table has to use lua_createtable to create it since it's the only possibility (other one would be to take one as an argument but let's ignore this).

Byte code search didn't work for me, but I was looking in the correct address range. Seems that the code differs too much that it can be seen by scrolling through the assembler. How is "adding debugging symbols" done in VS? will try tomorrow. Didn't think that it is common that functions stay in the same order. Will also check tomorrow.

Thanks both of you for your posts. @ostapus: thanks for the solution. Will also confirm it if it is correct. Would you mind telling us how you found it?

[ostapus]

function's order is pretty close to lua sources.
i am just looking into lua sources, found some easy to identify functions and then cross-referenced from them to unknown ones.
ex to find - lua_createtable :
from lua source you can see that lua_createtable is called from luaL_findtable
luaL_findtable is called from luaI_openlib
luaI_openlib can be found by searching string "name conflict for module"
once you found luaI_openlib - by looking in source - you can identify bunch of functions (including createtable)