Is there an easy way to stop php before it show ioncube output, so I can save the code?

[aktso]

Hey guys!

I saw the user @Magd Almuntaser in a topic talking to @Gogol about this and I got interested in the idea.
Since Ioncube is a kind of compressor, I really think this is possible.
Browsing Google I was able to find this:
https://media.blackhat.com/ad-12/Saher/bh-ad-12-stealing-from-thieves-Saher-slides.pdf
Is there any open source project with this applied so we can study?
I have this script here for test and I'd like to see its content (PHP 7.2):
https://www114.zippyshare.com/v/XeRbGtcx/file.html
Thanks guys

 

[aktso]

Please, help!

 

[Ababba2]

I don't know but probably you can decrypt ioncube

 

[aktso]

I don't know but probably you can decrypt ioncube

But these files are encrypted using Ioncube for PHP 7.2, I have never seen any tool available (with open source code) to understand how the decrypt work.

 

[Gogol]

Look into modifying the php binary may be? You can always make it from source.

 

[aktso]

Look into modifying the php binary may be? You can always make it from source.

Do you mean compile my own php binary with modified source so it prints the exact code instead of interpreting it?
But wouldn't encryptors like Ioncube mess with the code? The latest ioncube version has a key stuff rolling, so I'm not sure how this would work in this case.

 

[Gogol]

Do you mean compile my own php binary with modified source so it prints the exact code instead of interpreting it?
But wouldn't encryptors like Ioncube mess with the code? The latest ioncube version has a key stuff rolling, so I'm not sure how this would work in this case.

Exactly what I meant. I haven't done this myself before, because firstly; I am a dev too and I respect other devs. Secondly because I don't have access to ioncube environment, and I guess it's not free to install.

Yes, it might actually uglify the source code as well, but atleast u will have something to work with. Anyhow, ioncube Ultimately has to pass some php for the server to evaluate, otherwise it wouldn't work atall. You catch it at that stage.

What I said in the other thread isn't anything unique as well. I know people who have done this before. Should be fairly easy to do.

 

[The Undefined]

At the end of the day, IonCube encryption is an encryption mechanism, and just like any encryption mechanism, it's a two-way function. However, based on my previous tries on an older IonCube version (PHP 5.6 era); it isn't that easy to catch the code right before execution.

After some trial and error, you might be able to get PHP to output some bearable code, but I couldn't do the same thing with 7.x. So, I'm guessing they've created some sort of protection for those versions.

 

[Gogol]

At the end of the day, IonCube encryption is an encryption mechanism, and just like any encryption mechanism, it's a two-way function. However, based on my previous tries on an older IonCube version (PHP 5.6 era); it isn't that easy to catch the code right before execution.

After some trial and error, you might be able to get PHP to output some bearable code, but I couldn't do the same thing with 7.x. So, I'm guessing they've created some sort of protection for those versions.

Hmm well, then it became much harder to crack lol. Should still be possible. I mean cmon, people reverse machine code, what's php?

 

[The Undefined]

Hmm well, then it became much harder to crack lol. Should still be possible. I mean cmon, people reverse machine code, what's php?

I might be wrong, but as it's a higher level of abstraction, it's harder to decode (than a low-level language, in this case, the lowest level of software abstraction.)

 

[Gogol]

I might be wrong, but as it's a higher level of abstraction, it's harder to decode (than a low-level language, in this case, the lowest level of software abstraction.)

Yeah you are correct. It indeed is another level of abstraction ultimately. The white rum is playing tricks on me.

 

[aktso]

it isn't that easy to catch the code right before execution.

Yeah you are correct. It indeed is another level of abstraction ultimately. The white rum is playing tricks on me.

Damn it, I'm not that skilled to proceed then.

Would you guys be able to help me and decode the code posted in the topic?

I thought it would be as easy as editing VB scripts with Reflex.

 

[The Undefined]

Damn it, I'm not that skilled to proceed then.

Would you guys be able to help me and decode the code posted in the topic?

I thought it would be as easy as editing VB scripts with Reflex.

Unfortunately, due to my workload and the scale of the project, I cannot help you with it; however, if you want something to be done quickly, start a HAF (hire a freelancer thread).

 

[Gogol]

Unfortunately, due to my workload and the scale of the project, I cannot help you with it; however, if you want something to be done quickly, start a HAF (hire a freelancer thread).

Same here lol. It would have been a cool project nevertheless. It's not about this particular file, but more about learning how php parses, compiles and executes the code.

Try the haf section like @The Undefined suggested. I am sure someone has already done it on the newer php versions.