Latest Announcemnent
New thread
Status
Not open for further replies.
S

SplitIce

Active Member
2,474
2008
240
0
Its beta now!

http://decod.in

 UPDATED TO BETA. Now supporting all opcodes that I could reproduce and are documented (+some undocumented ones)

Please stop PMing me for decoding of files, Ill just ignore your pm. The interface is really not done yet, just stuck it online just then.

Any files that are compiled with the ioncube PHP5 option ticked wont work yet, nor will functions or classes compiled in encoded files.
 
204 comments
decoder?

i tried it with this files http://rapidshare.com/files/296769727/Desktop.rar.html

i get with ur script:
Code: 
** SplitIce Ioncube Decoder **<br />
[B]scroll to the bottom to see code![/B]

[DEBUG] File idenified as: ioncube. Module loaded.
Opening /var/www/virtual/thewarezscene.org/phptmp/phpF7Cz7t
[DEBUG] Start of IonCubeData...
[DEBUG] 00006AEC(27372) Bytes read.
[VERBOSE] IC_Base64_Marker: '4+oV' Decoding Base64->Bin...
 - Supported version type (3).
[VERBOSE] IonCubeVersionType: 3CCC22E1
[VERBOSE] Ioncube_Version_Type 3
[VERBOSE] Header_Size: 000000AC (InitKey for MT: FFFFFFFF957603A7)
[VERBOSE]   Chunk_Flag: C7 (and 80)-> ReadSize: 17 (and 40)-> Appending '<' to data
[VERBOSE]   Chunk_Flag: DA (and 80)-> ReadSize: 47 (and 40)-> Appending '<' to data
[VERBOSE]   Chunk_Flag: CD (and 80)-> ReadSize: 1E (and 40)-> Appending '<' to data
[VERBOSE]   Chunk_Flag: AE (and 80)-> ReadSize: 2D
[VERBOSE] decrypting Header & save it to "IC_Header.bin"
[VERBOSE] Reading IC_Header
[VERBOSE] Minimum Loader Version: 0 (for ex. ioncube_loader_win_4.3.dll requires >0301010)
[VERBOSE] VerData  0x00000003
[VERBOSE] ObfuFlags 00000000 00000000 
[VERBOSE] IncludeXorKey: FFFFFFFFE9FC23B1
[VERBOSE] EnableLicFile: 0
[VERBOSE] CustomErrCallbackHandler: 'ioncube_event_handler'
[VERBOSE] Enable_auto_prepend_Append_file: 0
[VERBOSE] Customised error messages count: 0x00
[VERBOSE] IC_Header moreData start: 0074
[VERBOSE] IC_Header moreData end: 009C   IC_Header Size: 00AC
[VERBOSE] Interpreting 'moreData'
[VERBOSE] 0001 <-PHP_Ver_Minor
[VERBOSE] 0005 <-PHP_Ver_Major

Notice:  The file [%s] was encoded with the PHP 5 ionCube Encoder, and requires PHP 5 to be installed. in /var/www/virtual/thewarezscene.org/htdocs/decoder/includes/decrypt/ioncube.php on line 742

so where is my code?
 
Dude did he say it's fully functional? it's still in early beta.

at splitice, fix so upload can't be hit without file selecting, give's bunch of errors.
 
Its far from fully working, an example file that does work can be found here: http://pastebin.com/d1e281dda

Currenly some functions in files are corrupting the output due to the compile order, Ill have a temp fix for that in the morning but as of yet we havent found the XOR key for the function opcodes.

and I repeat this is ALPHA, most likely it wont work for you, in that case unless its something special I dont really want to see it yet.
 
Looking good splitice, but make sure you deep check the files that are being uploaded dood :) i manage to upload dll files and err thing lmao ! peace
 
@litewarez the ioncube identifier is disabled to help prevent bugs at this stage in testing.

BTW if people upload files and get code at the end wite unknown opcodes in it let me know and Ill implement them for you today.
 
I get this when i try ur Test decoder out

PHP: 
<?
/* Unknown opcode: 59 (ZEND_INIT_FCALL_BY_NAME) */
/* Unknown opcode: 11 (ZEND_BW_XOR) */
/* Unknown opcode: 11 (ZEND_BW_XOR) */
/* Unknown opcode: 65 (ZEND_SEND_VAL) */
/* Unknown opcode: 61 (ZEND_DO_FCALL_BY_NAME) */
/* Unknown opcode: 84 (ZEND_FETCH_DIM_W) */
/* TMP 7 */ = 'odbc';
/* Unknown opcode: 84 (ZEND_FETCH_DIM_W) */
/* TMP 10 */ = '127.0.0.1';
/* Unknown opcode: 84 (ZEND_FETCH_DIM_W) */
/* TMP 13 */ = 'MuOnline';
/* Unknown opcode: 84 (ZEND_FETCH_DIM_W) */
/* TMP 16 */ = 'sa';
/* Unknown opcode: 84 (ZEND_FETCH_DIM_W) */
/* TMP 19 */ = '121991';
/* Unknown opcode: 73 (ZEND_INCLUDE_OR_EVAL) */
return 1;
?>
 
Which file was decoded as the above snippet?

NVM config.php decodes to:
PHP: 
<?
/* Unknown opcode: 59 (ZEND_INIT_FCALL_BY_NAME) */
/* Unknown opcode: 11 (ZEND_BW_XOR) */
/* Unknown opcode: 11 (ZEND_BW_XOR) */
/* Unknown opcode: 65 (ZEND_SEND_VAL) */
/* Unknown opcode: 61 (ZEND_DO_FCALL_BY_NAME) */
$muweb['connection'] = 'odbc';
$muweb['dbhost'] = '127.0.0.1';
$muweb['database'] = 'MuOnline';
$muweb['dbuser'] = 'sa';
$muweb['dbpassword'] = '121991';
include('includes/forestweb.php');
return 1;
?>

I had done some updates and not updated the online version.
 
I decoded the config.php files but i tryied decoding all the files with this and all same

All these files are ioncube encoded.
 
Status
Not open for further replies.
Back
Top