LUA unlocker simply reads the function's value. Using a reverse engineering program such as IDA, a programmer tries to isolate the offset which triggers such value. WoW is one of the more easier games to read, because the offsets usually has a specific string, such as "Obj_TargetGUID". Once you find these offsets, you can use a client-sided program, a bot, to run these functions. Here is a video of what I mean: https://www.youtube.com/watch?v=hABj_mrP-no
Here is an example of using a protected function. The non-protected API is the range check of the spell. The protected API is casting the spell:
Code:
if IsSpellInRange(GetSpellInfo(53),"target") -- not protected
then
CastSpellByID(53,"target") -- protected API
end