Decoder For IonCube 10

apsp

Newbie
Joined
Apr 12, 2021
Messages
14
Reaction score
7
Hi everybody,
I know that we can decode and see the output of php files that encoded with ioncube loader by reverse engineering the ioncube.dll.
but I don't have enough knowledge and information about .dll files.
can anybody help me to figure this out?
thanks
 
Hi everybody,
I know that we can decode and see the output of php files that encoded with ioncube loader by reverse engineering the ioncube.dll.
but I don't have enough knowledge and information about .dll files.
can anybody help me to figure this out?
thanks


put your files i will decode it for you :)
 
well, it is impossible to get a tool online to do it.... at least I tried to find one if you know any please tell me :)

I am probably using the same tool as the member who decoded what you posted, as its output is exactly the same as he posted, only that he changed the header to personalize it as his own.

But I am not sure if it is against the rules of the forum to post it here because I guess that there are members offering a similar service in the BST thread as I read here. So I am sorry but I'm not posting it.
 
I am probably using the same tool as the member who decoded what you posted, as its output is exactly the same as he posted, only that he changed the header to personalize it as his own.

But I am not sure if it is against the rules of the forum to post it here because I guess that there are members offering a similar service in the BST thread as I read here. So I am sorry but I'm not posting it.
well, my email is [email protected] if you can send it that way, but I do understand if you don't want to.
 
I am probably using the same tool as the member who decoded what you posted, as its output is exactly the same as he posted, only that he changed the header to personalize it as his own.

But I am not sure if it is against the rules of the forum to post it here because I guess that there are members offering a similar service in the BST thread as I read here. So I am sorry but I'm not posting it.

Sorry I don't know what you tool you use it
i've own my decoder and i updated every time you can search about me in google since 2009 till now:
ttmtt منزوع
or
ttmtt iCL0udin

and if my output same like your output that not mean my tool same like your tool
it's just reverse engineering dll that output the same results .. so you can try to decode your files in another decoder like (dezender.net, dezend.ir or any one) and see the results it's same :)
so please don't say (changed the header to personalize it as his own) it's generate by my tool
thank you :)
 
Sorry I don't know what you tool you use it
i've own my decoder and i updated every time you can search about me in google since 2009 till now:
ttmtt منزوع
or
ttmtt iCL0udin

and if my output same like your output that not mean my tool same like your tool
it's just reverse engineering dll that output the same results .. so you can try to decode your files in another decoder like (dezender.net, dezend.ir or any one) and see the results it's same :)
so please don't say (changed the header to personalize it as his own) it's generate by my tool
thank you :)


Noted. So I can then say that your tool and the one I use are both good and correct. The one I use recently added PHP7.2. Before that, it used to be only up to PHP5.6

Not even IonCube is safe these days :cool:
 
I am probably using the same tool as the member who decoded what you posted, as its output is exactly the same as he posted, only that he changed the header to personalize it as his own.

But I am not sure if it is against the rules of the forum to post it here because I guess that there are members offering a similar service in the BST thread as I read here. So I am sorry but I'm not posting it.
I really appreciate if you can send me this tool. I'm looking for such decoder since 2 years ago ... :(
My email : [email protected]
Thank you very much.

Hi , Can you decode this files?
 

Attachments

Hello All.

I hope this does not break any of the forum rules. If it does, then MODs please, accept my apologies and remove the thread (or the threat :D )

What I use is an online service. This is not mine, but it is the most reliable I have found over all the internet. I have successfully decrypted ALL ion-cubed scripts I have stumbled upon. Even the AliDropship plugin from a former member here, but I bought the plugin. I just decrypted it to see if there was something malicious hidden inside.

Code:
https://easytoyou.eu/

They have a cheap 30-days membership for €10.00. It is for unlimited files and you can do it in batches.

They have decoders for PHP 5.2, 5.3, 5.4, 5.5, 5.6, 7.0, 7.1, and 7.2 for ion cube 8+ to 10+

You can use their demo to decode one file to test the service before paying.

Also, if you don't know the PHP version used and/or the IonCube version used, you may try each of the decoders they provide. If versions do not match, you will get an error until you select the correct ones.

I hope this helps your decryption ventures :D

By the way, I checked al files uploaded here asking for decryption and they all decrypt flawlessly with that service.

BUT, some of those files are not only encrypted with IonCube but also obfuscated. In those cases, you will have to find a way to put it back (de-obfuscate) after decrypting it, so it will be easier to read.

For example, if you find an already decrypted file with text like this:

fu\x6E\x63\x74\x69\x6F\x6E()

-Which is "function()"

That one is Hex Encoded ASCII. This means that you will need to replace every "\xNN" instance with a character. The same number, the same character. For example, "\x6E" = "n". That is why you will see "x\6E" twice in the word "function" as it has two "n"s.

\x66 = f
\x75 = u
\x6E = n
\x63 = c
\x74 = t
\x69 = i
\x6F = o
\x6E = n

Of course, you will ONLY replace the "\xNN" instances. In the example above, the "fu" and "()" from "function()" were written directly and you just pass it as it is and decode the rest.

You will find the codes table by searching on Google "hex coded ASCII"

Of course, there are many ways of obfuscating a script. This is just one. You will have to put your grey matter to work but it will be fun to try and succeed.

Cheers.
 
By the way, I checked al files uploaded here asking for decryption and they all decrypt flawlessly with that service.

BUT, some of those files are not only encrypted with IonCube but also obfuscated. In those cases, you will have to find a way to put it back (de-obfuscate) after decrypting it, so it will be easier to read.

For example, if you find an already decrypted file with text like this:

fu\x6E\x63\x74\x69\x6F\x6E()

-Which is "function()"

That one is Hex Encoded ASCII. This means that you will need to replace every "\xNN" instance with a character. The same number, the same character. For example, "\x6E" = "n". That is why you will see "x\6E" twice in the word "function" as it has two "n"s.

\x66 = f
\x75 = u
\x6E = n
\x63 = c
\x74 = t
\x69 = i
\x6F = o
\x6E = n

Of course, you will ONLY replace the "\xNN" instances. In the example above, the "fu" and "()" from "function()" were written directly and you just pass it as it is and decode the rest.

You will find the codes table by searching on Google "hex coded ASCII"

Of course, there are many ways of obfuscating a script. This is just one. You will have to put your grey matter to work but it will be fun to try and succeed.

Cheers.
Thank you so much for your help.
 
Back
Top