luad 0.3.0

luad 0.3.0

Release 0.3.0 built from accepted revision ab173e52ce3939d3889944724c303b0f36c4865b.

Accepted CI run: https://github.com/dweekly/luad/actions/runs/35397820538

• Emit closed prototype expressions with child prototype paths and physical PC
  evidence for proven CLOSURE call-argument definitions in Lua 5.1 origin analysis
  (R-1c).
• Reconstruct constant-key table-literal origin expressions (TableLiteral) with
  deterministically sorted fields, write evidence, and visible partial cutoffs
  (incomplete: true) for request-shaped objects in Lua 5.1 origin analysis (R-1a).
• Emit closed alternatives expressions containing deduplicated, deterministically
  sorted candidate origins with reaching evidence when bounded definitions reach a
  control-flow join in Lua 5.1 origin analysis (R-1b).
• Add corpus-wide query --input-list <file|-> --where <expression> supporting streaming
  JSONL batch queries across file lists or stdin with per-input identity, stream framing,
  failure/skip retention, limit truncation, and strict-mode exit semantics (R-4).
• Fix query expression tokenizer hang on invalid expressions containing single '=' or '!'
  characters.
• Add export fact-family discovery and canonical registry (ExportFactFamily,
  EXPORT_FACT_FAMILIES) exposing export: ExportCapability in CapabilityManifest and
  luad capabilities, documenting valid families in export --help, and reporting sorted
  valid families on unknown --facts arguments (R-5).
• Add convention-gated cross-chunk linking (--link-convention luci-module-setglobal)
  enabling corpus-wide module indexing and inter-artifact call-site resolution in batch
  export, emitting auditable cross_chunk_link facts with explicit statuses (resolved,
  absent, duplicate, dynamic, unsupported, limit_exceeded), order-invariant
  indexing, fail-closed corpus and fact limits, and link.schema.json (R-2).

Checksums

89a64d8bc50f99ff74104f380dcda60504f03b613b2b1d1d53659e2a0c0d5829  evidence-index.json
3f177091c68bb643bb0acd818cc088da3dd014464a7cc34ef2a5afc3a1212b07  luad-0.3.0-linux-x86_64.tar.gz
06f20f58420dfc7d2088b2b5e2c23d63ff2159c36d47581ace3225a8ae023041  luad-0.3.0-macos-aarch64.tar.gz
e211d5e1796c2c42c250216aa083a3c99600a936f4f0520e49c8c17fb2d86c2f  luad-0.3.0.cdx.json

Build Provenance

Artifact attestations can be verified with:

gh attestation verify luad-0.3.0-<platform>.tar.gz --repo dweekly/luad

luad 0.2.0

luad 0.2.0

Release 0.2.0 built from accepted revision cfadac0b896cc14969a0771dc9bb63f11e0b5281.

Accepted CI run: https://github.com/dweekly/luad/actions/runs/35313473968

Experimental correctness and firmware-workflow release. No dialect is promoted to
supported, and machine interfaces retain their 0.x compatibility status.

• Validate declared layouts and numeric canaries for Lua 5.2, 5.3, and 5.5; decode
  implemented widths and refuse unsupported declarations with anchored diagnostics.

• Expand version-specific operand checks and refuse derived analysis for Lua 5.2,
  5.3, and 5.5 while keeping structural inspection and validation available.

• Preserve parse-failure provenance through CLI and batch export, distinguish
  unsupported formats from malformed inputs, and handle broken pipes quietly.

• Bound input reads, string declarations, traversal, diagnostics, and subprocess
  monitoring; cover hostile-input cases and budget breaches with regression tests.

• Add a public firmware-shaped walkthrough with mixed-input inventory, constants,
  global queries, raw disassembly, and explicit profile boundaries.

• Publish Linux x86-64 and macOS ARM64 archives with checksums, a deterministic
  CycloneDX source SBOM, and GitHub build-provenance attestations. Publication uses
  accepted CI artifacts and verifies fresh downloads.

• Keep stdin workers under the subprocess tripwire deadline, including descendants
  that hold only stdin open. Cleanup joins only finished workers after its grace period.

• Remove the simulated unluac oracle and pinned decompiler requirement from the
  firmware walkthrough. Required tests verify luad facts and refusal behavior;
  third-party decompilation is an optional, separately validated experiment.

• Correct the walkthrough's input glob, expected manifest exit status, and completeness
  guidance; verify every manifest exit status against the CLI.

Checksums

e2c4d2241c9b06dcc2f755582e6cf2b7e30f257653b24745465a3d46b645e741  evidence-index.json
5e06b73837975b38d33fc7c73ec54150154babbdc13a69d0991021753c6d0fe6  luad-0.2.0-linux-x86_64.tar.gz
2b491dbeb9fbf37dfb0e20c15837043de96628c0743833fbbe1cbd2a88b7c448  luad-0.2.0-macos-aarch64.tar.gz
9312068fb220cc65984c6ce520fd52d1c4c5ed1353514382cd0024d634907303  luad-0.2.0.cdx.json

Build Provenance

Artifact attestations can be verified with:

gh attestation verify luad-0.2.0-<platform>.tar.gz --repo dweekly/luad

luad 0.1.0

First public release. luad reads compiled Lua bytecode and tells you the exact format a chunk was built for, its instructions, constants, and closure bindings, with byte-level provenance for every fact — including the non-standard layouts found in extracted router firmware, which tools built on the stock Lua loader refuse or misread.

It does not decompile. When you want source back, luad identifies the profile so you can hand the chunk to a decompiler that reads it.

Experimental

No dialect is promoted to a supported tier, the supported set is empty, and no interface carries a compatibility promise. This is published as a useful 0.x tool with its flaws written down, not as something to base a security conclusion on.

Known defects. Lua 5.2 and 5.3 do not fully honor or refuse declared header widths by name, which can produce a confident wrong answer rather than an error — treat their output as a hint. EdgeTX chunks fail inside the body with a diagnostic anchored at offset 0.

"Valid" from luad validate means consistent with the selected format and the named checks. It does not mean safe to execute, or of known origin.

Install

Download the archive for your platform, verify against SHA256SUMS, and extract:

shasum -a 256 -c SHA256SUMS
tar xzf luad-0.1.0-macos-aarch64.tar.gz
./luad-0.1.0-macos-aarch64/luad --help

Or build from source with Rust 1.85+: cargo install --path crates/luad-cli --locked.

Try it

luad inspect chunk.luac      # identify the format, layout, and verdict
luad disasm chunk.luac       # annotated listing with constants resolved inline
luad validate chunk.luac     # structural and VM-invariant checks

Output formats vary by command — inspect, disasm, and explain emit text, JSON, and JSONL; validate and diagnostics emit text and JSON; export emits JSONL only. The README has the full matrix, the limitations table, and pointers to the tools to reach for next.

Artifacts

Built by CI from 019d10875e5297d5b75a2abb143e68067d7d45c4, the commit this tag points at. Each binary embeds that revision in its VERSION.json. A CycloneDX SBOM is attached.

Licensed MIT or Apache-2.0, at your option.