Post Reply 
 
Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
De-obfuscation of decoded ioncube
08-21-2012, 11:56 PM
Post: #1
De-obfuscation of decoded ioncube
Hi all,

How is it possible to deobfuscate the functions that are obfuscated such as:

$Dx = _obfuscate_DVdsMgM_EhYeOdsSc5GQIvCzIcPjk9QAEÿ( $iarr[file] );

Thanks,
suedoh
Find all posts by this user
Quote this message in a reply
09-04-2012, 01:24 PM (This post was last modified: 09-04-2012 02:19 PM by flywin.)
Post: #2
RE: De-obfuscation of decoded ioncube
you maybe make the obfuscate keywords table to filte the dezended file,
just like someone hit the MD5 password by mysql. Wink

Like the following file 'config.ini' is actioned by the dezend tool 'php5.exe'.
==== Php dump help ====
USEG: [{/}|{-}command[:attributes]]
/force{/f} set to force mode
/import{/i} import class and function name[obfuscate name] from config file
/export{/e} export class and function name[obfuscate name] to config file
/obfuscate dump obfuscate name and its url encoded name


Attached File(s)
.rar  dePHP5.rar (Size: 1.19 MB / Downloads: 335)
Find all posts by this user
Quote this message in a reply
10-29-2012, 05:57 PM (This post was last modified: 10-29-2012 07:53 PM by tiesto78.)
Post: #3
RE: De-obfuscation of decoded ioncube
(09-04-2012 01:24 PM)flywin Wrote:  you maybe make the obfuscate keywords table to filte the dezended file,
just like someone hit the MD5 password by mysql. Wink

Like the following file 'config.ini' is actioned by the dezend tool 'php5.exe'.
==== Php dump help ====
USEG: [{/}|{-}command[:attributes]]
/force{/f} set to force mode
/import{/i} import class and function name[obfuscate name] from config file
/export{/e} export class and function name[obfuscate name] to config file
/obfuscate dump obfuscate name and its url encoded name
I dont understand how use:
"/obfuscate dump obfuscate name and its url encoded name"

please give example of this command or explain to novice how use it! Angel
Find all posts by this user
Quote this message in a reply
11-02-2012, 10:21 AM (This post was last modified: 11-02-2012 10:22 AM by gerard.)
Post: #4
RE: De-obfuscation of decoded ioncube
you need the passphrase to build your own lib
Find all posts by this user
Quote this message in a reply
11-02-2012, 11:09 AM
Post: #5
RE: De-obfuscation of decoded ioncube
(11-02-2012 10:21 AM)gerard Wrote:  you need the passphrase to build your own lib

Hi

where/how we can find passphrase ?


Best Regards,
h4sh3m
Find all posts by this user
Quote this message in a reply
01-07-2013, 12:15 PM (This post was last modified: 01-07-2013 12:25 PM by DigitalGeek.)
Post: #6
RE: De-obfuscation of decoded ioncube
Hello FlyWin

Code:
Like the following file 'config.ini' is actioned by the dezend tool 'php5.exe'.
==== Php dump help ====
USEG: [{/}|{-}command[:attributes]]
/force{/f} set to force mode
/import{/i} import class and function name[obfuscate name] from config file
/export{/e} export class and function name[obfuscate name] to config file
/obfuscate dump obfuscate name and its url encoded name

i understand the concept but could you make an exemple of the command because this is not clear for me

i know this is for create a obfuscated dictionnnary but i would love to understand the way to use it

can you explain how to construct library
i have 75 k deobfuscated name & i would like to create more

thx you very much
Find all posts by this user
Quote this message in a reply
Post Reply 


Forum Jump:


User(s) browsing this thread: 1 Guest(s)

Contact Us | Homepage | Return to Top | Return to Content | Lite (Archive) Mode | RSS Syndication