Exetools

Exetools (https://forum.exetools.com/index.php)
-   Source Code (https://forum.exetools.com/forumdisplay.php?f=46)
-   -   [C++] ionCube 7 Decoder (https://forum.exetools.com/showthread.php?t=17187)

CryptXor 10-13-2015 00:56

[C++] ionCube 7 Decoder
 
1 Attachment(s)
Please keep this on exetools ONLY. NON-PROFIT USE ONLY....

Attached is the archive containing the bulk of the last "proper" ioncube decoder which was leaked out into the public domain. The below is the same source-code that dezender.net uses.
The code is from the public build of the decoder and not the private build.
The archive which I have attached is also not 100% complete and missing many of the sub-classes to prevent it from ending up on the WWW.

With all of that said. If you beleive that you are able to create a new decoder and would like the full source-code then shoot me a PM and I would be happy to share my research on PHP decoding with you. I don't have the time anymore so I will probably opensource my last decoder build at some stage.

Archive password:
Code:

exetools

Ember 10-13-2015 06:22

This was posted publicly back in 2012, and may/may not have anything to do with OP's post as I (obviously) cannot download attachments. Judging by OP's post history, this seems to be the full package that was leaked that contains the whole qinvent.com Dezender source

dezender.c is in work\php\Zend\dezender folder
Code:

Download: hxxps://yadi.sk/d/GNkaucI4To2pk
Password: sy5sgwv4ms2fpvmHt7Rvcrc2am1Eu8fOIUUkgcmzJXTE3HYhf3vDZI68dhWSTXAekBpZ06XLTZqTY4Qs1zql09wXp5SYYrCz00qA


CryptXor 10-13-2015 13:56

Quote:

Originally Posted by Ember (Post 102365)
This was posted publicly back in 2012, and may/may not have anything to do with OP's post as I (obviously) cannot download attachments. Judging by OP's post history, this seems to be the full package that was leaked that contains the whole qinvent.com Dezender source

dezender.c is in work\php\Zend\dezender folder
Code:

Download: hxxps://yadi.sk/d/GNkaucI4To2pk
Password: sy5sgwv4ms2fpvmHt7Rvcrc2am1Eu8fOIUUkgcmzJXTE3HYhf3vDZI68dhWSTXAekBpZ06XLTZqTY4Qs1zql09wXp5SYYrCz00qA


Nope. Totally different package :)

Incidently that decoder is not for ionCube, but for ZendGuard ;)

Succubus 10-20-2021 08:42

I'm also wanna start studying this now. I just cracked the Ioncube Encoder last week. I can send a proof via discord or dm honestly I don't know how dm works here, I think both should be friends first. But now all I can think is I wanna learn how to decode Ioncube. My first attempt is to load my DLL inside the entry to php7ts.dll xD then use the VLD source just the part where it dumps opcode array.. to dump the bytecode and reconstruct it since I only need to pass the op_array. I can just hook the zend_execute and get the op_array.. after getting a hand of it xD I notice it only works on plain PHP. well, I'm back to zero again. the reason I go with the hook path is that I don't want to compile and compile each xD PHP source since they exported some of its functions, I can just do something about it instead.

can you give something a hint on how it's done?


All times are GMT +8. The time now is 13:15.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX