Lua Virtualizer version history

Changelog for the virtualization engine, desktop clients, and hosted API.

Engine history

v1.0 - 15.10.2026

  • Initial release — first public Lua virtualization and obfuscation engine
  • Code virtualization — one mode at a time: virtualize code (VM), finite-state machine (FSM), weave tape, or mix code flow
  • Virtualize code compiles each selected function to encrypted register bytecode and runs it in a handler interpreter
  • Finite-state machine (FSM) runs that bytecode from states. Opcodes are split into states and dispatched from those states
  • Weave tape runs that bytecode on one mutable tape. Superoperators step the tape and rewrite it as execution moves
  • Mix code flow flattens dispatch into a schedule of numbered blocks. The current block selects the next one
  • Opcode encoding and generated names vary with the seed. The bytecode checksum is the integrity check
  • Automatic dialect detection — oldest parse among Lua 5.1, 5.2, 5.3, 5.4, 5.5, then Luau
  • LuaJIT only when selected explicitly — it is not inferred from the source
  • LUAVIRTUALIZER decorators — VM(VM), VM(FSM), VM(WEAVE), VM(FLAT), VM(RND), or VM(NONE) on a function, plus ENABLE and DISABLE for strategies and groups in that region
  • VM(RND) and --code-virtualization rnd — each run picks virtualize code, the finite-state machine (FSM), or the weave tape. Mix code flow is not in the draw. The same seed repeats the choice
  • Decorator groups — NAMES, STRINGS, NUMBERS, BOOLEANS, SHAPE, BUCKET, CALLS, COMMENTS, PROTECT, and ALL. ENABLE replaces that function's set and DISABLE subtracts from it
  • Demo mode — flat code virtualization only, source limit 1000 bytes
  • Licensed mode — full strategy set, source limit 10 MB
  • Self-defending — integrity probe that poisons keys if the script is patched
  • Protection linker — decoy calls, honeypot resolvers, and stack tripwires tied to helpers
  • Rename variables, parameters, and functions — scope-safe identifiers, with call retargeting
  • Rename function calls — route calls through an indirect name table
  • Shuffle functions — reorder top-level functions when execution stays valid
  • Resolve constants — inline named constants and drop unused declarations
  • Rename styles — identifier-like, O/0, hexadecimal, and mangled
  • Encrypt strings — polymorphic decrypt helpers so literals never sit in plaintext
  • Split strings, modify strings, and a char-code vault
  • Encrypt integers and floats, integer-to-float forms, array slots, affine masks, and MBA rewrites
  • Encrypted array literals — integer, character, float, and string tables decoded on use
  • Decoy value pools — integers, arrays, functions, characters, anti-regex noise, and autostart strings
  • Opaque predicates and noise — ternaries, complex booleans, opaque branches, mixer chains, dead code, and try/finally-shaped noise
  • Decoys — unused functions, anonymous functions, literal padding, fake require comments, dynamic lookups, obfuscated require, and callback stubs
  • Detect debugger, anti-VM, anti-sandbox, and anti-emulator probes
  • Remove comments — strip -- comments from the output

Client history

v1.0 - 15.10.2026

  • Initial release — first public clients
  • Windows GUI — desktop app to pick files, choose virtualize code (VM), finite-state machine (FSM), weave tape, or mix code flow, set the dialect and strategies, and virtualize
  • CLI for Windows and Linux — lua-virtualizer -i input.lua -o result.json --output-script protected.lua, with --code-virtualization vm|fsm|weave|flat|rnd and --target for an explicit dialect
  • Online virtualizer and Web API — the same virtualization modes, from the browser or HTTP
  • Visual Studio Code and compatible editors (like Cursor) extension — virtualize a single function from the action menu, with completion and hints for LUAVIRTUALIZER decorators
  • Official SDKs — PHP, Python, JavaScript, Rust, C#, PowerShell, Go, Java, and Ruby packages on the API page
  • Demo on every client — flat virtualization only, 1000 byte source limit; a license raises the limit to 10 MB and unlocks the full strategy set