Threaded Mode | Linear Mode

xavi · (This post was last modified: 08-07-2011 06:36 AM by xavi.)

HI,

I recently got a bunch of scripts from unknown source and need to reverse it. Unfortunately, I couldn't get the config of PHP on the server. All i got is the PHP files only, but it seems they're encoded with unknown encoder.

Anyone familiar with this format?

PHP files are in the attachment.

warhawk · (This post was last modified: 08-07-2011 11:02 PM by warhawk.)

Very hard to define what encode solution was used... No plain text... Nothing... Only specs chars...

**Cyko** · 08-08-2011, 02:41 PM

They've been compiiled, not sure with what though...check your "bunch" of files to see if theirs any loaders or hints as to what with.

But in simple terms that won't be an easy decode as its not straight readable PHP.

xavi · (This post was last modified: 08-09-2011 04:38 AM by xavi.)

(08-08-2011 02:41 PM)Cyko Wrote: They've been compiiled, not sure with what though...check your "bunch" of files to see if theirs any loaders or hints as to what with.

But in simple terms that won't be an easy decode as its not straight readable PHP.

All the scripts in the package is in this binary format, with same header ( first bytes ) so I think it must be an encoder. I double checked but no hints or whatsoever related to this.

There is also some Smarty files, like this one (
.rar

install.sql.rar (Size: 9.89 KB / Downloads: 15) ), which i think its encoded but in plaintext format. Its not base64 but I think it would be easier to guess. Anyone ?

http://forum.ioncube.com/viewtopic.php?p...010775a512

The smarty file I uploaded above is encoded with ionCube. But even so, the PHP file arent, they dont look like encoded with ionCube.