LuaTools

Discord • Website • Git Mirror

A Windows desktop client for managing Steam manifest/lua configurations, built with WPF on .NET 8.

LuaTools browses and installs manifest sources, edits stplug-in lua files (depot pinning, per-depot enable/disable), manages unlocker modes, and injects a companion plugin into Steam's store pages.

This fork adds two things: an Achievements page — pick a game from your Steam library and unlock or lock its achievements without leaving LuaTools — and a banner on the Add page that offers a game's fixes right after a Fetch. See Achievements and Fixes after a Fetch below.

It ships fully translated in 29 languages and auto-updates via Velopack.
_{Found a translation error? Tell us about it over on Discord}

Achievements

Pick a game in the grid, toggle achievements, and hit Save to Steam. Nothing leaves the machine until you save, so you can flip a dozen rows and still back out with Revert. Server-awarded achievements are shown read-only, because Steam ignores any attempt to change them.

Requirements: Steam running and signed in, and the game's achievements cached by Steam (they are as soon as the game has been launched once on this machine).

Under the hood this is gibbed's Steam Achievement Manager interop, running in a small helper process (LuaTools.SamHost.exe) that ships next to LuaTools.exe. It has to be a separate process: steamclient.dll is 32-bit and cannot be loaded into a 64-bit app, and Steam binds one app id per connection. The helper targets .NET Framework 4.8, which is part of Windows, so there is nothing extra to install.

Free sources

Fetching a game on the Add page lists its manifest sources, and the top rows are the free ones — badged No limit, needing no account and no daily cap:

• Ryuu pulls a zip carrying the lua and its .manifest files, refreshed daily. Listed in lua.tools' own load_free_manifest_apis as a free source. The default, and since 2026-09-09 the only free source still current.
• Sushi pulls a full manifest zip (lua + .manifest) from its public game repo. Still works, but that repo has not been updated since November 2025, so its coverage is roughly a year behind.
• ManifestHub builds the lua locally from the public depot-key database plus Steam's own depot list. Degraded since 2026-09-09: Steam closed the route that served manifests for apps you don't own, and a keys-only source has none of its own to fall back on. Kept because it becomes useful again the day that route reopens.

Both install exactly as a lua.tools manifest does. When neither free source has a game, a banner offers to fetch it with lua.tools instead (which uses your account and its 25/day cap). The lua.tools rows stay in the list, showing their real used/limit count.

Addons

The Addons page loads community addons from %AppData%\LuaToolsGui\addons\. An addon is a folder holding an addon.json — a few lines of JSON adding a manifest source:

{
  "schema": 1,
  "id": "example.freesource",
  "name": "Example free source",
  "version": "1.0.0",
  "sources": [{
    "name": "example-zip",
    "displayName": "Example (free)",
    "kind": "manifestZip",
    "url": "https://raw.githubusercontent.com/someone/some-repo/main/{appid}.zip",
    "badge": "Free"
  }]
}

Its source then appears on the Add page alongside the built-in free ones and installs through the same pipeline, DLCs and soundtracks included. Three shapes are understood: manifestZip (<appid>.zip with lua + manifests), luaFile (<appid>.lua), and depotKeyDatabase (one flat depot → key map for every game, from which the lua is built locally).

That case is the reason this exists. Free sources rot: the ManifestHub repo upstream has been frozen since January 2026, and pointing at fresher community forks took a whole new build. An addon turns that into editing one line.

An addon is data, and only data: it can say where manifests come from, never supply code or a binary, so installing one from a stranger cannot execute anything. Nothing needs restarting — drop a folder in, open the Addons page, and its sources are live from the next fetch.

A broken addon never stops the app from starting: the Addons page lists every folder found and, for each, either what it contributed or why it was refused.

Full format and an example: ADDONS.md.

Fixes after a Fetch

Fetching a game on the Add page also checks whether it has published fixes. When it does, a banner names them — "This game has 1 fix(es) available: Online Fix." — and its button opens the Fixes page with that game already unfolded.

The kinds come from the listing's own tags, so an Online Fix is not announced as something else. The lookup never holds up the Fetch, and when the listing cannot be reached there is simply no banner.

Validator

The Validator page checks a game's Denuvo activation and repairs what it can. Pick the game from your installed library rather than looking up an appid, tick Lock the version if you want the game pinned to its installed build, and the run streams the script's own output into the page with a progress bar. The D-Report code it ends on is one click from your clipboard.

The repair itself is Devuvo.ps1, this project's script, downloaded on every run — so fixes to the checks arrive without an app update, and nothing here is frozen at build time.

It asks before it runs, and says why. The script uploads a machine report — MachineGuid, disk serial, MAC addresses, public IP, hardware, the game folder's contents — to a paste service, and the D-Report code is that page's public address, so anyone given the code can read the report. Running also turns Smart App Control off, which the script needs: a machine-wide change that takes effect after a reboot and that Windows cannot turn back on without a clean reinstall. The one consent checkbox names both, because neither can be undone.

Tokeer

The Tokeer page redeems a shared activation code: paste it, and the tickets it stands for are written into Steam's credential store, including the owner SteamID that a stale value would otherwise outrank. Then launch the game from Steam as usual. The only things that leave the machine are the code and this machine's Windows MachineGuid, which is what binds a code to one PC.

Generating one works the other way round: pick a game you own, and the tickets Steam cached the last time you launched it are sent to the code store, which verifies Valve's signature on the ownership ticket before minting anything. Codes are single use.

Two things follow from reading the tickets out of Steam's own store rather than asking the live session for fresh ones, as their app does with a helper published without source. A game that has never been launched on this PC has nothing cached yet, and the page says so instead of failing vaguely. And the account signed into Steam is checked against the ticket's owner: after redeeming someone else's code that owner's ticket sits in your registry, and without that check anyone could launder one shared code into many.

Statistics

Requirements

• Windows 10/11
• .NET 8 SDK (the released installer bundles a check for the .NET 8 Desktop Runtime and installs it if missing; building from source needs the full SDK

Installation

You can find release builds on the luatools website or in the releases tab.

Credits / Adjacent software

• Millennium: the Steam plugin framework whose injection API this app polyfills when Millennium isn't installed
• Velopack: installer and auto-update framework
• Steam Achievement Manager by Rick (gibbed): the Steam achievement interop the Achievements page is built on. Its sources are vendored under src/LuaTools.SamHost/Vendor/ under the zlib licence, unmodified; see the notice there
• DepotDownloaderMod: downloads depot content from Steam's CDN, powering the Depots page's Download action. A fork of DepotDownloader, fetched and run as a standalone tool
• SteamAutoCrack: fetched and launched from the Downloads page
• TokeerDRM by Tesla697: the activation-code scheme the Tokeer page redeems and generates against. The page talks to the same public code store their app does and reads and writes the same Steam registry values; it carries none of their code
• LuaToolsValidator by Tesla697: the front end whose job the Validator page does. Both run the same Devuvo.ps1, published by this project and fetched at run time, so neither one owns the repair logic
• Steamless: removes SteamStub from game executables
• CloudRedirect: Steam Cloud revival project, can be turned on via the mode page

Licence

MIT. See LICENSE.

The vendored Steam Achievement Manager sources under src/LuaTools.SamHost/Vendor/ stay under their own zlib licence, src/LuaTools.SamHost/Vendor/LICENSE.txt.