Onyx v15.1 payload — deobfuscation results

crack log target: loadstring(game:HttpGet("https://onyxv2.lol/main.lua"))() · 1,289,559-byte obfuscated chunk

Downloads

onyx_source.lua — 193 lifted protos (parses as valid Luau) + full decoded const/record pool + runtime strings (~990 KB)
onyx_report.md — full fingerprint, decode chain, ISA tables, open items

193protos lifted — file parses as valid Luau

3,166record offsets decoded (100% of record layer)

2,320decoded const records inlined

626real program strings recovered (514 pool + 112 runtime-materialized)

57normalized VM ops extracted

7executor families mapped (T104/T112/T122/T222/T30/T38/T91)

What was recovered

Fingerprint: Luraph-class custom VM, new "Onyx" build of the v15.1 family. Deserializer T.Ka, proto factory T.po, operand-varint biases -2097280 / -270548992.
Full decode chain: 897 KB base85-ish blob → buf_1 (717,996 B) → record layer (seed formula 1424618095 - N + 32*(bit4(N) + 8*((N mod 512)>>7))) → 3-stage po.__index field decode (pos = v<717996 ? v : v^512380484) → ctx 16-field perm of slot-ids 17–32 → 2-layer instruction decode (bxor cascade + Ik self-descramble) → fam-band op tables.
Real inner program: the lifted protos are the Onyx cheat/GUI skeleton — settings-entry copiers ({id,label,priority,payload}), sort comparators, list reorder/swap with "index" bookkeeping, proto dispatch tables, the 1,397-step fam-225 main dispatch trampoline emitted in full.
Program vocabulary: _OnyxToggleUI, minimizeKey, supermanFlyKey, KeyCode, AutoExecSection, VisualSection, NameLabel, ActiveBar, full Roblox UI API surface + exploit APIs (isfile/readfile/writefile/defer/WebSocket/task).

Honest coverage status

layer	status
outer loader / VM bodies	complete — all handlers + executors extracted verbatim
record layer (3,166 offsets)	fully decoded — pure data (consts, strings, pos-maps, decoys)
instruction decode	2-layer scheme fully reversed + verified vs live VM
materialized protos	193 emitted (boot set + lazy ctx dumps + fam-131 root bootstrap)
remaining lazy protos	materialize only at runtime — need the 178-body po/linker port (all bodies staged verbatim) or deeper live exec (Roblox-env blocked)

Sample of lifted output

function p28()
  r2 = {}
  r3 = K[0]["id"]
  r2["id"] = r3
  r3 = K[0]["label"]
  r2["label"] = r3
  r3 = K[0]["priority"]
  r2["priority"] = r3
  r3 = K[0]["payload"]
  r2["payload"] = r3
  return r2
end

function p38()  -- sort comparator
  r4 = r2["priority"]
  r5 = r3["priority"]
  if (r4 < r5) then return true end
  if (r4 == r5) then
    r4 = r2["id"]; r5 = r3["id"]
    return (r4 < r5)
  end
  return false
end

Register indices in the listing are the VM's own register-file ids — large ints are genuine descrambled values, not errors.