TERROR ANALYST
A monochrome Luau deobfuscation suite. Static analysis, env logging and obfuscator fingerprinting run fully in your browser. Nothing you paste ever leaves this page unless you use the AI module.
01Deobfuscate
Beautify, decode string escapes, fold constants and rename obfuscated identifiers. Drop a file or paste code in the Deobfuscator tab.
02Fingerprint
The Obfuscator Detector identifies Luraph, PSU, MoonSec, IronBrew, Xen, HF and more from structural signatures.
Deobfuscator
Static deobfuscation pipeline. Everything runs locally in your browser.
Input
Output
Luraph v15.1 offline engine
The v15.1 VM is devirtualized by the offline Luraph engine (Node + Python + a Luau runtime), not in the browser: it traces the protected VM live, decrypts the lazy constants and lifts the control flow back into clean Luau with recovered names. The browser engine above handles the static pass; the toolkit below does the full lift.
node deob.js script.lua # writes output/script.deobf.luau (clean source) + a behaviour trace
Needs Node 18+ and Python 3.10+. On Windows the bin folder already ships luau.exe and luau-ast.exe; on Linux build them once with python build_luau.py. It also handles Luraph v14.x (experimental).
File Uploader
Load .lua / .luau / .txt scripts. Loaded files fill the editor, the analyzer and every other tool in the suite.
File Analyzer
Runs on whatever is in the Deobfuscate editor.
Load code first.
AI Deobfuscation
Optional second pass. Bring your own Gemini API key — it is stored only in your browser's localStorage and sent straight to Google, never to this site.
Idle. The local engine result is used as the AI's input when present.
Env Logger
Static scan of the globals, environment functions and endpoints the script touches. Great first look before deobfuscating.
Scan
No code loaded. Paste code in the Deobfuscator or drop a file first.
Obfuscator Detector
Fingerprints the obfuscator that produced a script. Uses structural signatures, not just name strings.
Sample
Updates
Changelog and roadmap.
v1.0 — initial release
- Deobfuscator engine: tokenizer-based beautifier, string escape decoding, constant folding and obfuscated identifier renaming.
- File uploader: multi-file drag & drop for .lua / .luau / .txt.
- File analyzer: line, size, string and function stats with an obfuscation-density meter.
- AI deobfuscation: optional bring-your-own Gemini key, stored browser-side only.
- Env logger: static report of globals, executor APIs and endpoints a script touches.
- Obfuscator detector: fingerprints Luraph, PSU, MoonSec, IronBrew, Xen, HF, LuaObfuscator and more.
- Monochrome UI with sidebar navigation, fully client-side.
Luraph v15.1 support
- Versioned detection: the detector reads the Luraph header and reports the exact build (v15.0, v15.1, v14.x), and still fingerprints the VM shape when the header is stripped.
- Header repair: the Deobfuscator splits the protection header when it runs into the code line before processing.
- Offline devirtualization engine: the full v15.1 pipeline (live VM trace, constant decryption, CFG lift, name recovery) ships as a toolkit download in the Deobfuscator tab.
Planned — v1.1
- Deeper string-table recovery for VM-based obfuscators.
- Diff view between input and output.
- Batch processing of multiple files.
Suggestions
Tell me what the next version should do.
Title
Type
Details
Saved suggestions
Stored locally in your browser.
Nothing yet.
FAQ
Short answers, no fluff.