Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 06-23-2013, 05:34
Bunshee
 
Posts: n/a
Ioncube 7 Decode

Hello,

I'am start a new Reversing Project

I a owner of a Ioncube 8 License, but, i will try to decompile/decode my crypted ioncube php files.

I found at Google a many tools that says 'yes we can decrypt' this for XX $ amount. Haha !

My Plan is, is have a PHP 5.3 Ioncube Decoder here, not for Ioncube 7.
The Decoder is simply easy...

A php.exe for Windows, and the Librarys.

And a Manipulated Ioncube loader dll.

Facts:

The Ioncube Files have a First Bit for identify the Version.
File Content is Base64 Encoded.

Okay, now, whats the best methods to Attack this?
Or have any Body more Informations about the Ioncube Loader?

Thanks
Reply With Quote
  #2  
Old 06-23-2013, 18:46
Insid3Code's Avatar
Insid3Code Insid3Code is offline
Family
 
Join Date: May 2013
Location: Algeria
Posts: 84
Rept. Given: 47
Rept. Rcvd 60 Times in 30 Posts
Thanks Given: 24
Thanks Rcvd at 108 Times in 56 Posts
Insid3Code Reputation: 60
I heard! there is a leaked package (Official Ioncube FULL source code) about 90 MB can be a good study source.
Reply With Quote
  #3  
Old 06-23-2013, 19:07
Bunshee
 
Posts: n/a
Hey,

Yeah, i have the leaked ioncube source.

Only the source code is a little bit tricky, so also the question of the best method to attack it

I must say, the leaked source code is from an old version, or I am mistaken there? The source code also buzzing here on the board, and it the same with my own that i have?
Reply With Quote
  #4  
Old 06-23-2013, 21:55
deepzero's Avatar
deepzero deepzero is online now
VIP
 
Join Date: Mar 2010
Location: Germany
Posts: 301
Rept. Given: 114
Rept. Rcvd 64 Times in 42 Posts
Thanks Given: 183
Thanks Rcvd at 216 Times in 92 Posts
deepzero Reputation: 64
could you post a link to the new leak? I only find old stuff.
Reply With Quote
  #5  
Old 06-27-2013, 22:20
daqstar's Avatar
daqstar daqstar is offline
Family
 
Join Date: Jun 2006
Posts: 97
Rept. Given: 34
Rept. Rcvd 59 Times in 22 Posts
Thanks Given: 37
Thanks Rcvd at 31 Times in 17 Posts
daqstar Reputation: 59
This is from November 2008

This is from November 2008

IONCUBE SOURCE DOWNLOAD.rar
__________________
0z0n3
Reply With Quote
  #6  
Old 06-29-2013, 11:00
Ember Ember is offline
Friend
 
Join Date: Feb 2009
Posts: 84
Rept. Given: 68
Rept. Rcvd 25 Times in 15 Posts
Thanks Given: 36
Thanks Rcvd at 78 Times in 33 Posts
Ember Reputation: 25
Since your topic title is Ioncube 7 decode, here's a Ioncube 7 decoder/dezender whatever. It seems to work as I have tested it on Ioncube 7 files (they require minor cleanup and fixing).

Perhaps you can diff this ioncube loader against the original, if you can find the right version. I have looked for it all ready, it is the non-ts version.

Code:
hxxps://mega.co.nz/#!N5IwEAiY!OxFusV7gjDVyz1Fy0ujS8ACjOEdOuZuSNSm1_5MNquA
Reply With Quote
  #7  
Old 06-30-2013, 23:19
nikre's Avatar
nikre nikre is offline
VIP
 
Join Date: Sep 2011
Posts: 180
Rept. Given: 177
Rept. Rcvd 100 Times in 35 Posts
Thanks Given: 1
Thanks Rcvd at 10 Times in 10 Posts
nikre Reputation: 100-199 nikre Reputation: 100-199
@Ember
this bad hosting
make other link
thanks
Reply With Quote
  #8  
Old 07-01-2013, 03:29
sendersu sendersu is online now
VIP
 
Join Date: Oct 2010
Posts: 1,128
Rept. Given: 334
Rept. Rcvd 228 Times in 119 Posts
Thanks Given: 268
Thanks Rcvd at 539 Times in 299 Posts
sendersu Reputation: 200-299 sendersu Reputation: 200-299 sendersu Reputation: 200-299
Quote:
Originally Posted by daqstar View Post
This is from November 2008

Attachment 7036
when I follow your link it said "Not found"
Reply With Quote
  #9  
Old 07-01-2013, 17:00
BAHEK BAHEK is offline
Family
 
Join Date: Dec 2012
Posts: 63
Rept. Given: 33
Rept. Rcvd 89 Times in 29 Posts
Thanks Given: 47
Thanks Rcvd at 125 Times in 34 Posts
BAHEK Reputation: 89
Quote:
Originally Posted by nikre View Post
@Ember
this bad hosting
make other link
thanks
rghost.ru or mediafire or dropbox
Reply With Quote
The Following User Gave Reputation+1 to BAHEK For This Useful Post:
nikre (07-04-2013)
  #10  
Old 07-04-2013, 20:27
Bunshee
 
Posts: n/a
Hello,

Thanks BAHEK, my Anti virus, alerts that contains a virus?!
Reply With Quote
  #11  
Old 07-05-2013, 16:33
sezar21m
 
Posts: n/a
(dezender_free) not working to decoded ionCube 7
The new version of this software is available?

I could not decode the file!

My file
Code:
http://www.mediafire.com/?vo2923dxkb7ibia
Reply With Quote
  #12  
Old 07-12-2013, 01:46
Bunshee
 
Posts: n/a
Hello,

I have not found a newer Version...
Reply With Quote
  #13  
Old 10-26-2013, 16:35
uranus64 uranus64 is offline
VIP
 
Join Date: Mar 2011
Location: EE
Posts: 318
Rept. Given: 598
Rept. Rcvd 463 Times in 141 Posts
Thanks Given: 539
Thanks Rcvd at 249 Times in 85 Posts
uranus64 Reputation: 400-499 uranus64 Reputation: 400-499 uranus64 Reputation: 400-499 uranus64 Reputation: 400-499 uranus64 Reputation: 400-499
Quote:
Originally Posted by sezar21m View Post
(dezender_free) not working to decoded ionCube 7
The new version of this software is available?

I could not decode the file!

My file
Code:
http://www.mediafire.com/?vo2923dxkb7ibia
I know is a little bit old post but ... maybe still need it decoded !
Attached decoded file.
Attached Files
File Type: rar system_advertisement_update.rar (282 Bytes, 30 views)
Reply With Quote
  #14  
Old 04-03-2014, 23:05
daqstar's Avatar
daqstar daqstar is offline
Family
 
Join Date: Jun 2006
Posts: 97
Rept. Given: 34
Rept. Rcvd 59 Times in 22 Posts
Thanks Given: 37
Thanks Rcvd at 31 Times in 17 Posts
daqstar Reputation: 59
Quote:
Originally Posted by sendersu View Post
when I follow your link it said "Not found"
Sorry here is the correct link:
Attached Files
File Type: zip IONCUBE SOURCE DOWNLOAD.ZIP (283 Bytes, 49 views)
__________________
0z0n3
Reply With Quote
  #15  
Old 04-05-2014, 04:31
Bunshee
 
Posts: n/a
Hello,

I find more Infos about Decode Ioncube 7:

https://media.blackhat.com/ad-12/Saher/bh-ad-12-stealing-from-thieves-Saher-slides.pdf
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
PHP Decode S3ri@l CoDe9x General Discussion 1 04-11-2013 14:28


All times are GMT +8. The time now is 03:56.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2024 )