Determining Encoder Type and Version

[swank]

A general question...

Ioncube files are generally easy to identify because of the loader at the top of the php file. Are all versions like this? Is the code in the loader different between ioncube encoder versions?

How does one tell which version of the encoder was used otherwise?

One naive method would be to download all versions of the php module and try and load the script with successively newer versions until the script loads.

Is there a better way?

[sidxx55]

(03-13-2012 10:14 AM)swank Wrote:  A general question...

Ioncube files are generally easy to identify because of the loader at the top of the php file. Are all versions like this? Is the code in the loader different between ioncube encoder versions?

How does one tell which version of the encoder was used otherwise?

One naive method would be to download all versions of the php module and try and load the script with successively newer versions until the script loads.

Is there a better way?

Hmm old lession, Are you be absent?
> Basically Base64 start hash markers, but if script dont has base64 binnares encrypted, search with other markers