LUA Scripts being decoded by 3rd parties

In my game I have a few LUA scripts. One in particular I am using to accept numbers as a passcode for a door. The whole idea of the game is to go through these doors (puzzle game) so if you know them at the beginning the game is pretty much pointless.
My problem is that a couple of my "friends" have somehow (they won't tell me and they are acting like they are hackers or something) have found the codes IN THE SAME ORDER I HAVE THEM IN THE SCRIPT! (so I am pretty sure they are not just guessing)

Where are the LUA scripts saved when creating the game? Visionaire has an option for saving Videos/Scenes/etc on different files...but not for LUA scripts. Where are those?
How can I hide/decode them even better?

I think they would be saved into the main .vis data file which if you open up in a text editor is already encoded as you will see. I'm not sure how they are finding out the codes unless they have some tool for extracting the data from the .vis file. I know there are some floating about which let you extract the resources from deponia & edna & harvey etc so if they could get at the xml data then it would be simple enough to find out the codes at a guess?

Any way around it? I was thinking of "sealing" the game using VMWare so they can't get to it but usually those kinds of programs are buggy and get picked up as viruses since they are trying to run a .exe file inside another software.
Is there any other way to encrypt the .vis file or "hide" the LUA code?

My other option was instead of having the code built-in , to have the code online but there is no way for LUA to interact with an online website (it only calls a link).

It is not something that takes time to do.

To give you a background on the game and what is going on, I use it to create Math Puzzles for my students at school. They go through various questions in their "adventure" and when they find the answer all they have to do is to click it in. It works like an interactive Math test. Having a few students finishing a Game/Test in less than 5-10 minutes when it normally takes 1-2 hours gives you an idea how quickly the game is "cracked".

The only thing I can think of is that the game when I had some bugs into my LUA code , was generating a .txt file in the :

C:\Users\Class-PC\AppData\Local\Matester

Which was posting the Code along with it's bug. Once I fixed the bug the Code is no longer appearing BUT... Is it possible that users may be able to insert somehow an error using the config.ini file of the game and have the code revealed to them?

ps. It works great for giving it to students for revisions too. ! ^_^

The only thing they can do with the config.ini is set the log level to "info" which will add any print() messages inside of your script to the messages.txt file as well as any errors.

Are you sure that some of them haven't obtained the answers from someone else who has already finished it?

If someone is getting at the xml data then David might have an idea how as I think he writes the protection code whatsit for VS.

If you have anything in memory that includes the resolution, there is no way protect hat. Only protected is to not have readable info in memory, that can be done by destructive hashing, for example with sha1. So you would prehash your values and then compare them. That is not reversible and would stop anyone without the necessary knowledge.

Simon , how would I go about doing that?
AFRL , I change the answers everytime so even if they got the codes the first time , the next times it shouldn't had worked.
Any ideas?

I was going to say maybe a hex editor could get the code, it depends on what happens to the xml elements, its not that hard to make a decoder, 5 minutes Googling and Visual Basic can do it if its a simple xml structure.
I'm trying todo one for my program but the binary xml is to complicated but if I remember right VS is just a line between tags

Sound an interesting project!
Is it something you can share?

Basis is http://lua-users.org/wiki/SecureHashAlgorithm
That copied into a script.
Next you need the sha2 values, use this tool: http://www.xorbin.com/tools/sha256-hash-calculator
You would insert something like "Result", which gets you "6e7d50e84f4731ef74187cf8cfa2672184eed8866b0b0074a772f4a64e0f4ba2"

Thanks Simon
I will try it and get back to you

Nigec, my plan is to make it widely available as a math supporting application and in the future to add an ad system to support the website and hosting.
I am currently testing it (as you can see) for problems and once I have a good beta I'll post it on the community here for ideas