Ioncube decoder v12/v13

buzzbreak

Newbie
Joined
Sep 25, 2023
Messages
5
Reaction score
3
Sorry for my bad english after all.

Before ioncube 12 i can get the opcode with this extension https://github.com/phppan/opcodedump. But when ioncube 12 release i only can dump the meta information about executed function like function arg, total properties and so on not include with opcodes.

Then i try to look the ioncube loader i see method zend_attach_symbol when this function get executed the opcodes will return and not 0 anymore (it execute 2 times, first time when zend_execute the opcodes return NULL / 0, and the second one the struct field op_array not null anymore).

but the problem is when i wanna to see the function table it only return the meta from this function (like function name, function arg, and so on) the op_array is NULL. I try to get this function table / class table from global macros CG(function_table) / CG(class_table) or EG(function_table) / CG(class_table).

When i try debugging it with IDA i see the function table opcode value from the function, but i dont know how to get it because it only show generated name like debug:09, i dont know where this opcode placed in the original php source code struct

my question is, how to dump the op_array / opcodes from the function_table, i have no idea to do this, i'm stucking now. Can i access this function table or class table from the zend_execute_data struct from function zend_attach_symbol.
 
Last edited:
Sorry for my bad english after all.

Before ioncube 12 i can get the opcode with this extension https://github.com/phppan/opcodedump. But when ioncube 12 release i only can dump the meta information about executed function like function arg, total properties and so on not include with opcodes.

Then i try to look the ioncube loader i see method zend_attach_symbol when this function get executed the opcodes will return and not 0 anymore (it execute 2 times, first time when zend_execute the opcodes return NULL / 0, and the second one the struct field op_array not null anymore).

but the problem is when i wanna to see the function table it only return the meta from this function (like function name, function arg, and so on) the op_array is NULL. I try to get this function table / class table from global macros CG(function_table) / CG(class_table) or EG(function_table) / CG(class_table).

When i try debugging it with IDA i see the function table opcode value from the function, but i dont know how to get it because it only show generated name like debug:09, i dont know where this opcode placed in the original php source code struct

my question is, how to dump the op_array / opcodes from the function_table, i have no idea to do this, i'm stucking now. Can i access this function table or class table from the zend_execute_data struct from function zend_attach_symbol.
Did you get any help?
 
You can try phpstub for ioncube 12/13
Not working anymore, the way i do just like above, ioncube now do override function and class caller so any opcode from class or function store at internal memory of ioncube not from global PHP variable
 
Not working anymore, the way i do just like above, ioncube now do override function and class caller so any opcode from class or function store at internal memory of ioncube not from global PHP variable
Ohh i see, we got a decoding programme but It's have issues, require key, do you have experience about assamble code? It’s have ic 12 decoding feature
 
Ohh i see, we got a decoding programme but It's have issues, require key, do you have experience about assamble code? It’s have ic 12 decoding feature
Can you pm me on tg? @Codexzord it’s my users. We are working for make a decoder programme. We are 9 people there, already tried many stuff. And now got a programme but it’s have issues
 
Ohh i see, we got a decoding programme but It's have issues, require key, do you have experience about assamble code? It’s have ic 12 decoding feature
When i look to the assemble code, they have some encrypt and decryption method before some overriding function access those script. It's tricky obfuscation way i think
 
Ohh i see, we got a decoding programme but It's have issues, require key, do you have experience about assamble code? It’s have ic 12 decoding feature
Can send pm me the file I can try.
Thanks
 
Oof, that's a tricky one with Ioncube's obfuscation in the mix. Have you tried hooking into the zend_compile_file function? It might give you a cleaner shot at the opcodes before they get too mangled.
 
some one please decode this one https://mega.nz/file/yc0m0AQC#7wF3rX1lQ04Vg6zFSaDAXiQBIGzeevbHhWdbt8EBrB0
 
Back
Top