[NEED HELP]lua_getfield is puzzling me

[zys924]

Im trying to find out a _G lua var value by calling 'lua_getfield'

First take a look at the standard lua_getfield signature:
void lua_getfield (lua_State *L, int index, const char *k);

But with IDA+HexRays, Ive located lua_getfield as:
int __cdecl lua_getfield(int a1, int a2, int Str, signed int a4);

As you can see, the lua_getfield in WOW has one more param "a4" of type "int" which quite puzzles me...

Furthormore, using C# Injection, Ive tried in-process call to it. Each time got failed as a result of illegal memory operations.

Here's my declaration and call in C#:

[UnmanagedFunctionPointer(CallingConvention.Cdecl)]
private delegate int Lua_GetFieldDelegate(uint luaState, int tableindex, string varname, int unknown);
private static Lua_GetFieldDelegate Lua_GetField;
private static const LUA_GLOBALSINDEX = -10001;

private static void TryGetField()
{
    Lua_GetField(Lua_GetState(), LUA_GLOBALSINDEX, "someluavarname", 0);
}

This code doesnt work and cause memory operation exception...
Would anybody plz give me a way out?

[flo8464]

Are you assigning an address to your delegate?

[abdula123]

L = Lua_GetState()
lua_gettable(L, LUA_GLOBALSINDEX)
lua_getfield(L, -1, "somename")

this works for me.
getting table LUA_GLOBALINDEX on top of stack
and then getting field from table at top of stack

[zys924]

L = Lua_GetState()
lua_gettable(L, LUA_GLOBALSINDEX)
lua_getfield(L, -1, "somename")

this works for me.
getting table LUA_GLOBALINDEX on top of stack
and then getting field from table at top of stack

ehh...as you said, then how come the "somename" is retrieved? (By calling lua_gettop(L))?
One more confusionoes the return val of lua_getfield make some sense?

By the way: 3.3.3a lua_getfield @ 0x00974A50, of course i've set the delegate value of Lua_GetField to this address by:

Lua_GetField = Marshal.GetDelegateForFunctionPointer((IntPtr)0x00974A50, typeof(Lua_GetFieldDelegate)) as Lua_GetFieldDelegate;

[abdula123]

lua_gettop_addr         = 0x00488A80
lua_gettable_addr       = 0x00488D00
lua_getfield_addr       = 0x00489440
lua_pcall_addr          = 0x00489B00
lua_remove_addr         = 0x00488B00

        L = Lua_GetState()
        reset_security()
        stack_begin = lua_gettop(L)

        lua_gettable(L, LUA_GLOBALSINDEX)
        lua_getfield(L, -1, name)

        if lua_typename(L, lua_type(L, -1)) != "function":
            print "function %s not found (%s)" % (name, lua_typename(L, lua_type(L, -1)))
            return
        lua_remove(L, -2) # remove table from stack

        .....
        push fn args on stack (if any)
        .....

        lua_pcall(L, len(args), LUA_MULTRET, 0)

        stack_end = lua_gettop(L)
        .....
        get fn results from stack (if any) and remove it from stack
        .....

this code is from my Python -> Lua bridge. its works in 3.3.3a (except reset_security - still not fixed after changes in 3.3.2 -> 3.3.3)

[zys924]

lua_gettop_addr         = 0x00488A80
lua_gettable_addr       = 0x00488D00
lua_getfield_addr       = 0x00489440
lua_pcall_addr          = 0x00489B00
lua_remove_addr         = 0x00488B00

        L = Lua_GetState()
        reset_security()
        stack_begin = lua_gettop(L)

        lua_gettable(L, LUA_GLOBALSINDEX)
        lua_getfield(L, -1, name)

        if lua_typename(L, lua_type(L, -1)) != "function":
            print "function %s not found (%s)" % (name, lua_typename(L, lua_type(L, -1)))
            return
        lua_remove(L, -2) # remove table from stack

        .....
        push fn args on stack (if any)
        .....

        lua_pcall(L, len(args), LUA_MULTRET, 0)

        stack_end = lua_gettop(L)
        .....
        get fn results from stack (if any) and remove it from stack
        .....

this code is from my Python -> Lua bridge. its works in 3.3.3a (except reset_security - still not fixed after changes in 3.3.2 -> 3.3.3)

GODD.. Find pattern out a wrong addr... thx a lot!