PHPlockit -reverse engineering (needed)

[hackingsnake]

Guys,
I had write a e-commerce portal with partners 1 half year ago, but right now I must to update systems and change some codes, but a fuck'n programmer which was fired had input lock on our system and for now I don't have the (original) source code anymore, I'll need change it in production source. After check the lock, it's seems like a phplockit, but I really don't know how does it's works and I need reverse engineering for this one:
I'll be glad for reward for this job, contact me up if you need:
Thanks

Application.php:
<?php /* Este dominio no possui uma licena vlida para este script. */$OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64');$OOO0000O0=$OOO000000{4}.$OOO000000{9}.$OOO000000{3}.$OOO00
0000{5};$OOO0000O0.=$OOO000000{2}.$OOO000000{10}.$OOO000000{13}.$OOO000000{16};$OOO0000O0.=$OOO0000O0{3}.$OOO000000{11}.$OOO000000{12}.$OOO0000O0{7}.$OOO000000{5};$OOO000O00=$OOO000000{0}.$OOO000000{12}.$OOO
000000{7}.$OOO000000{5}.$OOO000000{15};$O0O000O00=$OOO000000{0}.$OOO000000{1}.$OOO000000{5}.$OOO000000{14};$O0O000O0O=$O0O000O00.$OOO000000{11};$O0O000O00=$O0O000O00.$OOO000000{3};$O0O00OO00=$OOO000000{0}.$O
OO000000{8}.$OOO000000{5}.$OOO000000{9}.$OOO000000{16};$OOO00000O=$OOO000000{3}.$OOO000000{14}.$OOO000000{8}.$OOO000000{14}.$OOO000000{8};$OOO0O0O00=__FILE__;$OO00O0000=0xe84;eval($OOO0000O0('JE8wMDBPME8wMD0
kT09PMDAwTzAwKCRPT08wTzBPMDAsJ3JiJyk7JE8wTzAwT08wMCgkTzAwME8wTzAwLDB4NGJjKTskT08wME8wME8wPSRPT08wMDAwTzAoJE9PTzAwMDAwTygkTzBPMDBPTzAwKCRPMDAwTzBPMDAsMHgzZWMpLCdIN0I5Y1plajBKdDgrc0syZjZPV0dub1VodjNJZHlxVlBwMW
FsWUFyL1JGdW1MZ0U0aU5Dek1rVGJYRFN3UXg1PScsJ0FCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXowMTIzNDU2Nzg5Ky8nKSk7ZXZhbCgkT08wME8wME8wKTs='));return;?>EZThQXykpRIeG/0U7NvoyVIoZzhkP/JNsqtB
PgtY4gtWQ13o6XUBXaIkMd8AJNtOfa3OdmJcw4+972WCH4WCz/3UsCvUf/JZQW6nJo6nJIJMsZGYvZGYQKfGMZJMzR2N6VGznOnlnOoNyW6nJo6nJVWlZs6OyyK1pRdTsYyBPlUMsZGYvZGYmrOZ6GGZQ0WMsGJMzR2N6VGznOnlnOoNy0nZ6fUzp2GMfrUW//3UsCvUf/JcpGn
Z7VGznOnlnOUMv7GYsIJMsZGYvZGYQKfGMZJMzR2N60nZ6fUMsZGYvZGYQofnJWoNyW6nJo6nJVWlZs6OyyK1pRdTsYyBPlOZ6GGZQW6nJo6nJVnlZOGMmrOZ6GGZQ0WMsGJMzR2N60nZ6fUMsZGYvZGYQofnJWoNy0nZ6fUzp2GMfrUW/rJNlRtOlRto6RvOPlWCH4+cQ2+972
81dD0cnCyeGPveQL3oXRIN7gbkwPdeQCdTnR0jnLhO7m3osYIgyp0jIpIeYlhO74hUJp0enCyeGPdksN3U7z8Pzt6oXzdAGPvozPhkQgyeZzIN7aIkzPyAMFyz71Ik4ghkQL8AJN0j7pdAcPhkQLdjJpd17MIocPIAQkhO7m3osYIgyp81dRKN62WCH4WCH4WCHQdT6NUTJYdei
phkG/JMQV6lY+6nQVJN41JN0gJcQ2WC72+cw4+Bb1JN0mJcQ2WCH4+972+BPlWzQ2+9H4+972tB62+cw4+cQ2+9H/Jcw4+972+cw4+B4lWzw4+cw4+9H4tO4rO9yBKos3vo/4OrfbtTs8+AhkWMyjIAQn3jhCOo6Xdnvfd9ZpIZY7d1QO6rnLWeyZseYKfTRs3M61oc6WyMZbsW
zr8By7flsc6GvjOcYtOzisWlQfGnJWnZnonMpvoAZ1hk6YvAy/3oRuIeMgIT7idrszyUvTqjYD+9cN+CfMsadbKOmEJNlRtWLAhkiEdkG/Jcw4+972+cw4+BlSvUvpIBPlWzw4+cw4+cw4tWm=BAnNdAQNUTJYdeQNyeYgvNP4tWmt3ohPtepYho6YdrsVdkngyBPRtO7SBAnb3
Uf/tWmtVfR/voZlvU0/0lsEIr6YIrfLnjY4vW/PyenbyBQ/yeMmKN7a3eZNdknz2Unzv1zb01izdrnYtWmt3enpvenNtBJZqj7RdAnCK17sIkbm090k0cRMIBHiKWlT09HMKaH4KaH40cysnB0RK4R/voZlvU0/0lipdTfLWoQl3ovRvofD0B0gvkMlhU6YtBJc8B7l0czPoO70
KAlDdN0R810P6zMG01lSBApYho6Yd1P1fkZa3eGLfkQgyjJEI9/PIAwLdT6EdAGm0eXE8osphkpY8B7LyUsz8UJYyAZm3o6pyeG1tWmt3enpvenNtBJ9hos/vOM9IkXzdAQmK174ITsz8os/vosu2WHm0j7NvOMa3ena3Cz401iAhoiCvOlSBApYho6Yd1P1GjJpvkMpK17gINM
ahos/vO0RK4RRv1H/hAZCvoXpIoG/JZQW6nJo6nJI0Y70GZQW6Gie0YzR09zQ0BJpdj7m3ospyeYEI1X43jH1tO7SBA6RvOP16UszvO7pdrZM3UvE0eS9/kwPdeQlvO7CvU0PhosYdTspvewPveYNvU6pIongyeGg01lSBrzt3ohPtevMIAsz3oQgUknb3UszdNP13oXRUkyYyB
0RtO7SBAYA0BPp3oXRUkyYyBP1veYCdeipqnQYdrJEdr+1tOlPq4RRIAYVdknztBJl3Us4IeZXUknNdAQNdN0m+OlSBrzt3ohPteYg3nQrvUf/0AMpvkYaUTZMIT6YdMQCqoJpdkG1tOlPq4RRIAYVdknztBJLhoyRhMQiyoQzvUsVdTY1hUsY0144tWmtVfRRv1H/3oXRUkyYy
BP1dAnr3UszvUJVvkiEhAZmdN0RtO7SBAvEdAnphkPPtB6jWcQBfGiW0eZC0B6CUTvpdAYphAiYUkXpIoGP2WblInQkhUJRhoJmvnQkhoiMvOlPq4RRv1H/0oYgUkZNdAZXtB6CUTvpdAYphAiYUkXpIoGmhUJNhUl/0ly+WzJ7WZ+18BJpdAyk0141hUJrhN0m0YQeOGiZGN0m
0YQ9WzQ8OGG18BJVGcQWnB0m0YQj6nf18BJVGznOnlnO0141UznKn10m0YQW6nsWOGQK0141dMQkhUJRhoJmvnQghoMY0141InQkhUJRhoJmvnQkhoiMvO0RtOYSBrngdknztB6jWcQBfGiWoN6CUTvpdAYphAiYUkXpIonytWmtVfRQBrngdknztB6jWcQBfGiWoNJCUTvpdAY
phAiYUkXpIoG1UOlSBrngdknztB6jWcQBfGiWoNJLUTvpdAYphAiYUTvpIjnY0YzRK4RQBrztvenA3oXYtBJcGN0m6cYO6GsGWMJvUMsZGcZOfn62G1lSBA6YvAYgvOP1GlQ2nB0mJZQW6nJo6nJI0l62fMns6GXGUMJ2WMf1UOlSBA6YvAYgvOP1flZW6n77ncP18eyYyesTvB
PR8l6WtWmtvenA3oXYtBJOWzQG6cYOUMnOWB0m0ApzyjHD8Nw1816VGznOnlnOoNy0nZ6fUzp2GMfrUOXl3UJghoMYtB6VGznOnlnOoNJfOZ7VGzn+61JytOlSBA6YvAYgvOP1OGMj6cYO01iBfnsZGcZGOBbrho6L3obr8l6W81ypdrZM3UvEdNdg6Z+gJkMRveYpJNXcGNlSB
A6YvAYgvOP1OGMj6cYOUMnOWB0mGlQ2nc6JGYQnGl4gJkZlIoYgJNXcGNbrhUJiyoYkIT+r8l6W81yL3o6RhOdg6Z+RK4RlvovRIAG/0l67ncnV6lQOWGZG0141vBQL8MlPO9RRUeP1tWmtvenA3oXYtBJcfn6ZUzv2GlM7nZQWGG418BJv8ozLvB70KAlDdN0RK4RlvovRIAG/
0Y6JWGnV6lQOWGZG0141O9RRKr+1tWmtdknCdkYEIYQCyeZNyBPRK4RCvUsC3oQgUTJYvkYCyenNtBJCvUsChoQ+voYmhow1tWmtdAniyoYNvnQEIAsY0BJLqUsiIBXRIA+gdep40amtdAniyoYNvnQEIAsY0BJAyoXayeYEI1XRIA+gdep40amtJj6RyeiY+OHQ0jZMvUJXtBJ
W6GiZfMfPt17eGlQs0enNhU7RveQVhkQgvAYryUJphkQYdN7UOcnO6O7aIkXA3oyVIAZLvOHQ0Byz3U6mvOd1tWmtJj6RyeiY+OHQ0B6z3U6mvWcL2AvYyes/UkZCdkQatBlSB16z3U6mvOHQ0B6z3U6mvWZIJksEIAvRvMQkhoiMvOyyK4/l3eQCyeXpIoGP2O7iyonNqOP1Gz
n+6GsG0B/P6YJ2WO7YdAZ43o6EUksEIAvRvTnNhosEvU+PnzpZGlGPhkQgvAYrUkXpIoGP2OHrdkMzdZQ/ITszIAZLvOd1tWmtJepEdT6ghoMY09zPJepEdT6ghoMY8WXAvU6a3ZQpdTsEhNPRK4/lyUsYdAXpIoGP2O7iyonNqOP1Gzn+6GsG0B/P6YJ2WO7YdAZ43o6EUksEI
AvRvTnNhosEvU+PnzpZGlGPhkQgvAYrUkXpIoGP2OHrdkMzdZQMdknNIAZLvOd1tWmtJjnCvUJghoMY09zPJjnCvUJghoMY8WXAvU6a3ZQpdTsEhNPRK4/ldeZCdTyEdAfP2O7iyonNqOP1Gzn+6GsG0B/P6YJ2WO7YdAZ43o6EUksEIAvRvTnNhosEvU+PnzpZGlGPhkQgvAYr
UkXpIoGP2OHrdkMzdZQ4hUsCykQNvBd1tWmtJj7pdTsTITJl09zPJj7pdTsTITJl8WXAvU6a3ZQpdTsEhNPRK4/ldeQNyBHQ0jZMvUJXtBJW6GiZfMfPt17eGlQs0enNhU7RveQVhkQgvAYryUJphkQYdN7UOcnO6O7aIkXA3oyVIAZLvOHQ0ByCIU64UT7Edrfr01lSB164ITJ
z09zPJj7EdrfL2AvYyes/UkZCdkQatBlSB16YIoZRIBHQ0jZMvUJXtBJW6GiZfMfPt17eGlQs0enNhU7RveQVhkQgvAYryUJphkQYdN7UOcnO6O7aIkXA3oyVIAZLvOHQ0ByYIoZRI9cr01lSB16YIoZRIBHQ0B6YIoZRIBzxvAnzhkpVhUsCIk+/tWmtJj7pvTsYvTnNINHQ0j
ZMvUJXtBJW6GiZfMfPt17eGlQs0enNhU7RveQVhkQgvAYryUJphkQYdN7UOcnO6O7aIkXA3oyVIAZLvOHQ0ByYIoZRI9+r01lSB164hoyCvoyMdAwP2OHldeZrdknryUJE8WXAvU6a3ZQpdTsEhNPRK4RlvovRIAG/0YssnZ7VOcQWncX7WGG18B6/ITszIAZLvnmrhkQgvAYrU
TvpIjnYJMzRK4RlvovRIAG/0YssnZ7VnnsZGlX7WGG18B6MdTJghoMYoNyaIkXA3oyVyAZmyoGrUOlSBA6YvAYgvOP1GzMGGZQffnsWnzQO6B0mJj7pdTsTITJloNyaIkXA3oyVyAZmyoGrUOlSBA6YvAYgvOP1GzMGGZQfWMJG014ldeQNyZmrhkQgvAYrUTvpIjnYJMzRK4Rl
vovRIAG/0l6Z6lZnWZ6V6GM7OG418B6YIoZRIZmrhkQgvAYrUTvpIjnYJMzRK4RlvovRIAG/0lnsfGY+UM776MsZ6MnOWN0mJj7pvTsYvTnNIMmrhkQgvAYrUTvpIjnYJMzRK4/SrBdx^?RTNPfC}MV|yeg^?Q



noscript.inc.php: <?php /* Este dominio no possui uma licena vlida para este script. */$OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64');$OOO0000O0=$OOO000000{4}.$OOO000000{9}.$OOO000000{3}.$OOO00
0000{5};$OOO0000O0.=$OOO000000{2}.$OOO000000{10}.$OOO000000{13}.$OOO000000{16};$OOO0000O0.=$OOO0000O0{3}.$OOO000000{11}.$OOO000000{12}.$OOO0000O0{7}.$OOO000000{5};$OOO000O00=$OOO000000{0}.$OOO000000{12}.$OOO
000000{7}.$OOO000000{5}.$OOO000000{15};$O0O000O00=$OOO000000{0}.$OOO000000{1}.$OOO000000{5}.$OOO000000{14};$O0O000O0O=$O0O000O00.$OOO000000{11};$O0O000O00=$O0O000O00.$OOO000000{3};$O0O00OO00=$OOO000000{0}.$O
OO000000{8}.$OOO000000{5}.$OOO000000{9}.$OOO000000{16};$OOO00000O=$OOO000000{3}.$OOO000000{14}.$OOO000000{8}.$OOO000000{14}.$OOO000000{8};$OOO0O0O00=__FILE__;$OO00O0000=0x198;eval($OOO0000O0('JE8wMDBPME8wMD0
kT09PMDAwTzAwKCRPT08wTzBPMDAsJ3JiJyk7JE8wTzAwT08wMCgkTzAwME8wTzAwLDB4NGJjKTskT08wME8wME8wPSRPT08wMDAwTzAoJE9PTzAwMDAwTygkTzBPMDBPTzAwKCRPMDAwTzBPMDAsMHgzZWMpLCdIN0I5Y1plajBKdDgrc0syZjZPV0dub1VodjNJZHlxVlBwMW
FsWUFyL1JGdW1MZ0U0aU5Dek1rVGJYRFN3UXg1PScsJ0FCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXowMTIzNDU2Nzg5Ky8nKSk7ZXZhbCgkT08wME8wME8wKTs='));return;?>FeQ^yXykpRIeG/0U7NvoyVIoZzhkP/JNsqtB
PgtY4gtWQ13o6XUBXaIkMd8AJNtOfa3OdmJcw4+972WCH4WCz/3UsCvUf/JZQW6nJo6nJIJMsZGYvZGYQKfGMZJMzR2N6VGznOnlnOoNyW6nJo6nJVWlZs6OyyK1pRdTsYyBPlUMsZGYvZGYmrOZ6GGZQ0WMsGJMzR2N6VGznOnlnOoNy0nZ6fUzp2GMfrUW//3UsCvUf/JcpGn
Z7VGznOnlnOUMv7GYsIJMsZGYvZGYQKfGMZJMzR2N60nZ6fUMsZGYvZGYQofnJWoNyW6nJo6nJVWlZs6OyyK1pRdTsYyBPlOZ6GGZQW6nJo6nJVnlZOGMmrOZ6GGZQ0WMsGJMzR2N60nZ6fUMsZGYvZGYQofnJWoNy0nZ6fUzp2GMfrUW/rJNlRtOlRto6RvOPlWCH4+cQ2+972
81dD0cnCyeGPveQL3oXRIN7gbkwPdeQCdTnR0jnLhO7m3osYIgyp0jIpIeYlhO74hUJp0enCyeGPdksN3U7z8Pzt6oXzdAGPvozPhkQgyeZzIN7aIkzPyAMFyz71Ik4ghkQL8AJN0j7pdAcPhkQLdjJpd17MIocPIAQkhO7m3osYIgyp81dRKN62WCH4WCH4WCHQdT6NUTJYdei
phkG/JMQV6lY+6nQVJN41JN0gJcQ2WC72+cw4+Bb1JN0mJcQ2WCH4+972+BPlWzQ2+9H4+972tB62+cw4+cQ2+9H/Jcw4+972+cw4+B4lWzw4+cw4+9H4tO4rO9yBKos3vo/4OrfbtTs8+AhkWMyjIAQn3jhCOo6Xdnvfd9ZpIZY7d1QO6rnLWeyZseYKfTRs3M61oc6WyMZbsW
zr8By7flsc6GvjOcYtOzisWlQfGnJWnZnonMpvoAZ1hk6YvAy/3oRuIeMgIT7idrszyUvTqjYD+9cN+CfMsadbKOmEJNlRtWLAhkiEdkG/Jcw4+972+cw4+BlSvUvpIBPlWzw4+cw4+cw4tWm=vos/INHr2eXEdksN3U7z2PztBWil3UhPhkipdT+Q0AXEdksN3U7z0absBPlJ2
e6Ry17aIeZCdCz1IAQChTJRdjfL3oXgvU012PztBflJ2jHx2jszdAQgvCXcvU6YhT6pIoQC0jZMvO7CvUGPOAZkhnsadAY4yB74hUJYhkGPvUszhU0PvenChU6RyAZlINbw8TszdAQgvCbw8THx9f/JBflwd9XoIk29F174dAna3Usp0j6Yd17E0cRpyAZWhTJRdjfP3eZ13oiR
yeZlIN7gIN7CvUGPIAZkvoypveQN0j7pdAcPyU6RIeYDhU0PhU+PvrnghkYEIAZm3o6pvenC0e6YdT6Y0jsRyeGg2BQ42PztBflw8k6RyabsBPlw8k6RyabsBa4EIAQChTJRdjfxJCmSZbNoM]

 

[NetDevil]

pls upload the file

 

[hackingsnake]

Roger That...!

Follow in attached

The files is in ZIP, because php is not allowed by forum.

Thx.

 

[coderjeff]

 

[hackingsnake]

OMFG,


For now I'm just need noscript.php to be completely unlocked and free.
Thx so much.!

 

[hackingsnake]

Guys...

There are 2 more files encrypted, it?s in attached the all files encrypted of my system.
Thx so much.

coderjeff, try to help me up with these files, and send me your contact in pvt, I want to send you a gift

 

[thevil]

Guys...

There are 2 more files encrypted, it's in attached the all files encrypted of my system.
Thx so much.

coderjeff, try to help me up with these files, and send me your contact in pvt, I want to send you a gift

http://www.mediafire.com/?e9mwcm4u38c126j
http://www.mediafire.com/?66bh5dlrnoq7306

 

[coderjeff]

application2.php

<?php
error_reporting(0);
if (headers_sent()) {
exit();
}
header("Content-Type: text/html; charset=utf-8",true);
if (basename($_SERVER["PHP_SELF"]) == "application2.php") {
die("Este arquivo não pode ser acessado diretamente.");
}
define("DS",DIRECTORY_SEPARATOR);
define("ROOT",$_SERVER["DOCUMENT_ROOT"]);
define("BASEPATH",getcwd().DS);
define("ROOTDIR_URL","http://".$_SERVER['HTTP_HOST'].dirname($_SERVER["PHP_SELF"]));
define("IMGDIR",BASEPATH.'admin'.DS.'arquivos'.DS.'midia'.DS);
define("IMGDIR_URL",ROOTDIR_URL.'admin'.DS.'arquivos'.DS.'midia'.DS);
define("DATE_FORMAT","d/m/Y H:i\h");
define("DATE_FORMAT_SQL","Y-m-d H:i:s");
define("TIME_FORMAT","H:i:s");
define("SMTP_HOSTNAME",'smtp.lancedegenio.com');
define("SMTP_USERNAME",'[email protected]');
define("SMTP_PASSWORD",'xxxttt');
define("SMTP_PORT",25);
define("DEFAULT_EMAIL","[email protected]");
define("EMAIL_PAGSEGURO","[email protected]");
$title = "LancedeGenio - O leilão de centavos diferente!";
session_start();
session_register("sessaoLeilao");
require_once "mysql.inc.php";
require_once "function.inc.php";
;

 

[thevil]

Just to let you know, replace " ; " with "?>" (last line) if youre going to use coderjeffs's code.

 

[hackingsnake]

Brother... really thx.!

 

[coderjeff]

Just to let you know, replace " ; " with "?>" (last line) if youre going to use coderjeffs's code.

I agree that the final semicolon is pointless, but is was included in the encrypted script and it won't matter.

However, there's no reason to end PHP code with "?>" and many good reasons not to do so. It's best NOT to get in the habit of adding one (unless you want to follow a block of PHP with additional html.)

From php.net:

The closing tag of a PHP block at the end of a file is optional, and in some cases omitting it is helpful when using include() or require(), so unwanted whitespace will not occur at the end of files, and you will still be able to add headers to the response later. It is also handy if you use output buffering, and would not like to see added unwanted whitespace at the end of the parts generated by the included files.