Chao7

[BITS 32]
[CPU PRESCOTT]
xrLUA_ISZ          equ 0x005CC104
szluaopen_base     equ 0x005C9110
szluaopen_package  equ 0x005C911F
szluaopen_table    equ 0x005C9131
szluaopen_io       equ 0x005C9141
szluaopen_os       equ 0x005C914E
szluaopen_string   equ 0x005C915B
szluaopen_math     equ 0x005C916C
szluaopen_debug    equ 0x005C917B
szluaopen_jit      equ 0x005C918B
szluaopen_coco     equ 0x005C9199
szlua_pushcclosure equ 0x005C91A8
szlua_pushstring   equ 0x005C91BB
szlua_call         equ 0x005C91CC

xrLUA_IAT          equ 0x005CC1D5
luaopen_base       equ xrLUA_IAT + ( 4 *  0 ) ; 0x005C91D5
luaopen_package    equ xrLUA_IAT + ( 4 *  1 ) ; 0x005C91D9
luaopen_table      equ xrLUA_IAT + ( 4 *  2 ) ; 0x005C91DD
luaopen_io         equ xrLUA_IAT + ( 4 *  3 ) ; 0x005C91E1
luaopen_os         equ xrLUA_IAT + ( 4 *  4 ) ; 0x005C91E5
luaopen_string     equ xrLUA_IAT + ( 4 *  5 ) ; 0x005C91E9
luaopen_math       equ xrLUA_IAT + ( 4 *  6 ) ; 0x005C91ED
luaopen_debug      equ xrLUA_IAT + ( 4 *  7 ) ; 0x005C91F2
luaopen_jit        equ xrLUA_IAT + ( 4 *  8 ) ; 0x005C91F6
luaopen_coco       equ xrLUA_IAT + ( 4 *  9 ) ; 0x005C91F9
lua_pushcclosure   equ xrLUA_IAT + ( 4 * 10 ) ; 0x005C91FD
lua_pushstring     equ xrLUA_IAT + ( 4 * 11 ) ; 0x005C9201
lua_call           equ xrLUA_IAT + ( 4 * 12 ) ; 0x005C9205

luahack_load:

; eax is state ptr
push ebx ; func ptr
push esi ; str ptr
push edx ; edx is relocated base image ptr, becomes state ptr
push edi ; call func

call luahack_eip_offset
luahack_eip_offset:
pop ecx
sub ecx, luahack_eip_offset ; get func base

mov ebx, edx
mov esi, edx
mov edi, edx

add ebx, luaopen_base
add esi, szluaopen_base
add edi, lua_pushcclosure

xchg edx, eax ; grab state ptr passed thru eax

; base
add esi, 12

add eax, luahack_postreg ; return to after luahack_reg hack
push eax

luahack_reg:
push ebx
push edx
call [ edi ]
add esp, 4*2
push esi
push edx
call [ edi + 4 ]
add esp, 4*2
push dword 0x00000000
push dword 0x00000001
push edx
call [ edi + 8 ]
add esp, 4*3
ret

luahack_postreg:

; package
add esi, 11
call near luahack_reg

; table
add esi, 18
call near luahack_reg

; io
add esi, 16
call near luahack_reg

; os
add esi, 13
call near luahack_reg

; string
add esi, 13
call near luahack_reg

; math
add esi, 17
call near luahack_reg

; debug
add esi, 15
call near luahack_reg

; jit
add esi, 16
call near luahack_reg

; coco
add esi, 14
call near luahack_reg

pop edi ; call func
pop edx ; edx is base reloc ptr, becomes state ptr - passed by eax
pop esi ; str ptr
pop ebx ; func ptr

xchg eax, edx ; return luaState pointer

ret