Threaded Mode | Linear Mode

berka · 06-08-2013, 04:04 PM

i have some scripts but all func and vars OBF
what to do with this?
1. find same script with different encoding
2. find same script but early ver.

what else?

thanks

**sidxx55** · 06-08-2013, 07:08 PM

i think IC OBF is 1 way hashing, or need explore more This 'hashes ', anyway make "replace" OBF with any you like Vars and Functions.

berka · (This post was last modified: 06-09-2013 08:28 PM by berka.)

thanks sidxx55
this 'hashes' always random or its some dict like in zend?
how you can do your decript so clean?

**sidxx55** · 06-09-2013, 10:02 PM

IC has pass closed hashing of vars functions, all hashes has 1 length with oxd marker, and OBF seed of pass inside byte-code header, why need it there IDK its not logic for 1 way destruction, or it use pass-hash for values table offset position call, any way 1sly need answer why need this seed.
I dont decrypt Obf, Sg dont has any Obf, only Zend and IC has it. Decoders use solution as replacing Binaries with numeric-alpha-bet algo like dezender of RM has _obfuscate_ marker and than castom base64 binary encryption of "key-closed" data.