编辑“模块:Deep2 MetaEscape”


local p = {}
function p.test()
    -- Try to use __gc finalizer in a userdata to escape
    local results = {}

    -- Method 1: Metatable chain traversal
    local current = _G
    local depth = 0
    while depth < 10 do
        local mt = getmetatable(current)
        if not mt then break end
        depth = depth + 1
        local keys = {}
        for k in pairs(mt) do keys[#keys+1] = k end
        results[depth] = "level" .. depth .. "=" .. table.concat(keys, ",")
        if mt.__index then
            current = mt.__index
        else
            break
        end
    end
    results[#results+1] = "depth=" .. depth

    -- Method 2: Try to set __gc on a table
    local t = {}
    local ok, err = pcall(setmetatable, t, {__gc = function() end})
    results[#results+1] = "set_gc_table=" .. tostring(ok) .. ":" .. tostring(err)

    -- Method 3: Try to access function environments
    local custom_funcs = {}
    for name in pairs({"log", "addWarning", "executeFunction", "loadData", "getCurrentFrame"}) do
        if mw[name] and type(mw[name]) == "function" then
            local ok, info = pcall(debug.getinfo, mw[name], "S")
            if ok and info then
                custom_funcs[#custom_funcs+1] = name .. ":src=" .. tostring(info.short_src):sub(1,50)
            end
        end
    end
    if #custom_funcs > 0 then
        results[#results+1] = "func_sources: " .. table.concat(custom_funcs, " | ")
    end

    return table.concat(results, " | ")
end
return p