Dll vs Lua - what do you prefer

Injected dynamic library, of course... You should be undetected unless you mess with clientside Lua state... Make a proxy state, and do your dirty work via Lua scripting. VAC is disabled in gmod, so you don't even need "Steam Client" service installed (VAC lives there). VAC is something you can completely ignore in GMod, you are free from VAC ban, I have proofed this with theory and practice multiple times... If you want to do engine drawing, hook PaintTraverse directly, and use just use Source SDK 2013, also be sure to implement "clean screenshots", because clientside Lua can take screenshots which server admins can request, return them a black screen or dick picture :D