Reconstructor
Paste a loading string. ZENV12 unwraps it and hands you back the original source, 1 of 1, byte for byte. Cleanup passes stay off unless you turn them on.
Input · obfuscated loading string
or drop a .lua / .txt file here
Result
Analysis
History
Your last runs, saved in this browser only.
Usage
How to feed ZENV12.
- 1. Copy the whole obfuscated loading string, the full thing from start to end, and paste it in the input box (or drop a .lua file).
- 2. Press
RECONSTRUCT. The pipeline runs left to right: unwrap loaders, decode payloads, fold constants, rebuild formatting. - 3. Read the output. Every run stamps the header
-- this file was generated by zenv12 DEobfuscatorat the top of the file output. - 4. Copy it or hit
Download .lua. Or grabLoader .lua: that file is the one you execute in your executor, and running it writes the reconstructed source into your workspace as zenv12-reconstructed.lua.
What 1 of 1 means here. A loading string carries the original source inside it, only encoded or wrapped. ZENV12 is a reconstructor, not a rewriter: it unwraps the loaders and decoders and emits what was inside so the output reads like the original source, same functions, same names, same UI, same behavior, everything, reconstructed 1 of 1. Nothing is renamed or reflowed unless you switch on the two optional cleanup passes. If a payload turns out to be compiled bytecode there is no source text left inside it to recover, and the tool says so instead of guessing.
About
ZENV12 DEOBFUSCATOR · v12 · Luau
- Engine — loader unwrapper (loadstring / load / table.concat chains, up to 10 layers deep)
- Decoder — string escapes (\ddd \xHH \u{...} \z), base64, hex, reversed strings, single-byte XOR (key brute-forced by Luau keyword scoring)
- Bytecode guard — detects Lua / Luau compiled dumps (\27Lua) and reports them instead of mangling them
- Folding — string.char, string.byte, string.sub, string.rep, string.reverse, table.concat, tostring, literal concatenation, integer arithmetic, #length
- Rebuilder — statement splitting and block-aware re-indentation
- Privacy — everything runs in your browser. Nothing is uploaded, nothing is logged anywhere but your own local history.