Wizzard fork: security-hardened PAYDAY 2 on Diesel 3.0 (64-bit). Rooted in znixian/payday2-superblt (full history below). Diesel 3.0 is 64-bit and uses LuaJIT, so the running core is the engine from diesel-modding/PAYDAY2-SuperBLT (RAID-SuperBLT lineage), ported on top of that history. Cross-built for Windows x64 with MinGW-w64. GPL-3.0. See Security hardening for what this fork changes.

SuperDuperBLT

An open-source Lua hook for PAYDAY 2, designed and created for ease of use for both players and modders.

This is an unofficial continuation of the BLT and SuperBLT mod loader for PAYDAY 2, with additional features aimed at allowing things not possible in standard Lua, such as patching XML files that are loaded directly by the engine or playing 3D sounds.

This is the developer repository and should only be used if you know what you're doing. If you don't, grab a build from the Releases page instead. The Lua component of the BLT, which controls mod loading, lives in its own repository: see the upstream payday2-superblt-lua project.

Security hardening

Upstream SuperBLT lets a mod read, write, and load native code almost anywhere it wants. This fork closes the worst of that. Normal mods behave exactly as before; only the paths and operations that were never legitimate get rejected.

• Filesystem sandbox. Every Lua and Wren binding that takes a path now resolves it against a fixed root and refuses anything that escapes: absolute paths, drive letters, UNC paths, .. traversal, and symlinks pointing outside. Reads are limited to the game install directory. Writes, moves, deletes, and extraction are limited to mods/, so a mod can no longer overwrite the game's own DLLs or EXEs. This covers dofile/loadfile, directory listing and hashing, file and directory existence checks, unzip, the async read/write calls, the Wren tweaker's IO.read/listDirectory/info and module loader, and the Wren asset-redirect hooks.
• Zip-slip blocked. Archive extraction throws out any entry whose path points outside the extraction directory (../../evil.dll) instead of writing it wherever the entry name said.
• TLS verification on. HTTP requests now check the peer certificate and hostname. Upstream disabled both, which left every download open to a man-in-the-middle.
• Native code needs your consent. A native plugin (.dll) never loads on a mod's say-so. It has to be a .dll under the game tree, can't have been written after the game started (kills the "download a payload, then load it in the same session" trick), and - most importantly - you have to list it in superblt_config.json first. Covers both blt.load_native and the Wren IO.load_plugin path.

Configuration (superblt_config.json)

Created in the game folder with safe defaults the first time you run the game. It lives next to the loader, not under mods/, so a mod can't edit it to grant itself permissions.

{
    "developer_mode": false,
    "allowed_native_plugins": []
}

• allowed_native_plugins - the list of native plugins you permit. When a mod tries to load a .dll that isn't listed, the load is refused and the log tells you the exact line to add. Paste it in, restart, and the plugin loads. Example: "allowed_native_plugins": ["mods/somemod/plugin.dll"].
• developer_mode - set to true only if you are developing plugins. It bypasses the consent list and the written-after-start check, and forces pcalls early. Insecure; leave it false otherwise. (This replaces the old mods/unsafe_developer.txt flag.)

Download

Grab SuperDuperBLT.zip from the Releases page and extract it straight into your PAYDAY 2 install folder. It contains HID.dll (the loader) plus the updater/ folder it needs. The release also has the raw HID.dll and SBLT_DLL_UPDATER.exe files individually, those are what the in-game auto-updater fetches, you don't need to grab them by hand.

Documentation

Documentation for SuperBLT can be found on the SuperBLT Website.

Development

How to contribute to SuperDuperBLT:

First, clone this repository and pull all required projects and repositories into one folder (Note: you NEED to do this, otherwise you'll get runtime and compile errors):

git clone --recursive https://git.deadzone.lol/Wizzard/PAYDAY2-SuperDuperBLT.git

if you cloned without --recursive, do this in the root of your repo:

git submodule update --init --recursive

Building with MSVC (Visual Studio)

You can use Visual Studio or the command line to generate the files and build SuperDuperBLT.

For Visual Studio, select File -> Open -> CMake and select the top-level CMakeLists.txt file.

In Visual Studio, select the configuration box (at the top of the window, which may, for example, say x64-Debug) and select x64-Debug if it isn't already. Select Project->Generate Cache and wait for it to run cmake - this may take some time.

You can now open the generated solution file in /out/build/x64-Debug/SuperDuperBLT.sln

If you do not see the out folder, click "Show All Files" in the top bar of the Solution Explorer.

If you don't see the solution file, please ensure the configurations have Visual Studio 16/17 Win64 selected as the cmake generator.

At this point, you can compile your project. In Visual Studio, press F7. This will take some time as it compiles all of SuperDuperBLT's dependencies and, finally, SuperDuperBLT itself.

Finally, you can make PAYDAY 2 use your custom-built version of SBLT instead of having to copy the built file to the game directory each time you change something. Go to your PAYDAY 2 directory and open PowerShell to do this. Run:

cmd /c mklink HID.dll <path to SBLT>\out\build\x64-Debug\HID.dll

For the command line, navigate to your SuperDuperBLT folder using cd

Make a new directory named build using mkdir build and enter it using cd

Then enter the following commands: cmake .. -A x64 -G "Visual Studio 17 2022" -DCMAKE_BUILD_TYPE=Debug

msbuild SuperDuperBLT.sln /t:Build /p:Configuration=Debug

You can symlink using the following in your PAYDAY 2 directory. Run:

cmd /c mklink HID.dll <path to SBLT>\build\Debug\HID.dll

Cross-compiling with MinGW-w64 (Linux, no Visual Studio needed)

This fork adds a Linux-native build path that doesn't need a Windows host. It's the same path the CI uses (.gitea/workflows/create_build.yml):

./docker/build.sh

This builds a pinned debian:trixie-slim + mingw-w64 Docker image, then cross-compiles HID.dll into build-mingw/. See docker/Dockerfile.mingw and cmake/toolchains/mingw-x64.cmake for the toolchain details.

Code Conventions

• Avoid std::shared_ptr and the likes unless you have a decent reason to use it. If you need the reference counting, go ahead, but please don't use it when a regular pointer works fine.
• Don't ever use CRLF.
• Please ensure there is a linefeed (\n) as the last byte of any files you create.
• Please use git patch. Don't commit multiple unrelated or loosely related things in a single commit. Likewise, please don't commit whitespace-only changes. git blame is a valuable tool.
• Please run the source code using clang-format to ensure stuff like brace positions and whitespace are consistent.
• Please ensure your code doesn't cause any compiler warnings (not counting libraries). This is enforced for GCC; please watch your output if you're using Visual Studio.