[K-Pax]

@johanjohan

Have fun

Hint for sourcecop encrypted files. Found via google, because my english is not so good (still learning). Better explained:

sourcecop is supposedly suppose to "protect" your php source code

that above is a quote from their website it's a bunch of bull - it is so easily reversed

when you "protect" a file with sourcecop it will take all the source and encrypt it and stores it in a variable

then they add some junk to the source to try to cover up where the decrytion takes place

the function that decrypts the source is included in the project in an extra file /scopbin/911006.php

this file also contains some junk to try to make it harder to see what's going on but it doesn't try hard enough

in all the cases I've seen sourcecop the decryption function has had the same name "y0666f0acdeed38d4cd9084ade1739498(key as string, variable with encrypted source);"

if you go to a php file that was encrypted just search for "eval"
put it on it's own line so you can modify it easier

change eval('more code is here'');
to
echo 'more code is here';

then try to bring up the page in your browser, right click and go to view source and you should have all of the previously encrypted php source

if you don't see the source go back to the file and look for a function that will look similar to this

g0666f0acdeed38d4cd9084ade1739498(f0666f0acdeed38d 4cd9084ade1739498(__FILE__));

put this on a line of it's own and comment it out with //

now refresh and you should have the full php source

Regards,

K-Pax

[johanjohan]

wow..great, thanks k-pax for your explanation, it's very usefull.

[smashinghead]

Hello, i have a big problem.

I tried everything, but I can not do it. Someone can help me decrypt this script and tell which decoder should I use for files like this. I tried the site mentioned, I tried PHPunlockIt and I can not do it.

If anyone can help me I would be very grateful.

<?php /* This file is protected by copyright law and provided under license. Reverse engineering of this file is strictly prohibited. */$OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64');$OOO0000O0=$OOO000000{4}.$OOO000000{9}.$OOO000000{3}.$OOO000000{5};$OOO0000O0.=$OOO000000{2}.$OOO000000{10}.$OOO000000{13}.$OOO000000{16};$OOO0000O0.=$OOO0000O0{3}.$OOO000000{11}.$OOO000000{12}.$OOO0000O0{7}.$OOO000000{5};$OOO000O00=$OOO000000{0}.$OOO000000{12}.$OOO000000{7}.$OOO000000{5}.$OOO000000{15};$O0O000O00=$OOO000000{0}.$OOO000000{1}.$OOO000000{5}.$OOO000000{14}.$OOO000000{3};$O0O00OO00=$OOO000000{0}.$OOO000000{8}.$OOO000000{5}.$OOO000000{9}.$OOO000000{16};$OOO00000O=$OOO000000{3}.$OOO000000{14}.$OOO000000{8}.$OOO000000{14}.$OOO000000{8};$OOO0O0O00=__FILE__;$OO00O0000=192;eval($OOO0000O0('aWYoITApJE8wMDBPME8wMD0kT09PMDAwTzAwKCRPT08wTzBPMDAsJ3JiJyk7JE8wTzAwME8wMCgkTzAwME8wTzAwLDEwMjQpOyRPME8wMDBPMDAoJE8wMDBPME8wMCw0MDk2KTskT08wME8wME8wPSRPT08wMDAwTzAoJE9PTzAwMDAwTygkTzBPMDBPTzAwKCRPMDAwTzBPMDAsMTAwMCksJzl5MCtuRmlKZ3YvNURXSXBocWZVMmJ3TkFtUmVZM01CYTR0T0taY0NUa0xvN0VzUFh4U2psenVyVjFkR1FINjg9JywnQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLycpKTtldmFsKCRPTzAwTzAwTzApOw=='));return;?>
3u4kei2T/04kYrWZ30aKfFq22FHUqbvwqbvBbKFf2z7C2lbfbKbfNl1yU22CNfKkvtATgwbSmw3k/0YT/0VLN0VkpuZEermZRNWZewkzYcbSmbXsAuHEN01tYtZQ/04Y5tkYN0VkpSZQ/04Y5tkYN0Vkpr3r3zXsRwzP3cbkYubERCbSmNvZN01OeuzY5cvS/NXT/FXs/ZxY5tK8/NXT/FXs/ZxY5tK8eiHOAwxTerWl/fY7vn42bFyB2lbfbKbfNzmy2ZWevzWF2ZmF2ZHIh2zFvzlk/fZQB0aTRNWjmNhTvFHUqbvwqbvevl42bFyBfnHUb033/fKcvta4mNvZmuKTvSaT5tkY5tK8RwzP3cbkYubERCbSmNvZN01OeuzY5cvS/NXT/FXs/ZxY5tK8/NXT/FXs/ZxY5tK83r3rN01kewHumwZjmwzL3NvZYcbY5cWPebXsACgkB0aTN0VLNFXs/UQkB0aTN0VLNFXs/UH7euW4ei4PYrhkvSXKNzWF2ZmF2Z7CfFq22FHgUzW2vzlk/fKkmiZZ/03DRwWZeCW4gnZs3cF7Rwq4g0laAuHs3iFO3i2aecHjg0laAwxuANvPmrqOhizjet1OeulC/U7KUlQXDnQXDnQXpwbSmw3BYcbXeiFOmfaCNzHif2xFNzQC50gCgtVKUlHpDnQXUj9X5tgCgtXKUlHpD+9XDnQX/0qpUlQXD+9XDnQTvnQXUj9XUlQXD0aKUj9XDnQXUj9X50qpUj9XUj9XD+9k50Y1MU9oeKmkfc3u5jbnblZXRJFcbUvt3l1yebvZwUWWhcnl3nH5wcW+biEDej3FYzyAMFWLeJkzYZAxmn3qf+AVpfY7vlF0hlqFqK3gf2k5UnzIUzyq2ZW2bbmNwFZRAwvOmibcmu4kRcE7ew1PYJFSYrqz3C3VMNTXDUgjW+2uWja1/SQC/fKkIumOeiHjmfaKUj9XDnQXUj9X/UEZ3cF7/0qpUj9XUj9XUj9kIX==g9l/YubjYuZPeZHj3iFS30akIXl/RwATgf4jmNWjRwHsNuZjNrvZmuZj3ibSmwhTgcxPmuZsgtKah21ngJWZYrWkeu1BRNWBYcbCRNWlmNvZm0atYiFjYr3PYcht/fKkMXl/Rib4mibS/0vDeuW43iZPeOTaMiFsmi2sYi4XpryCpwbSYcQt/U7W0ClW0a==

[K-Pax]

@smashinghead

HF

BTW:
No working PhpLockIt decoder found atm.

[smashinghead]

Thanksssssssssss man, tx, tx, tx.

But see, can you tell me how to decode it? ou i post anothers (20) ??????
How the encrypt used in it?

Thanks................ Oh man... I very happy....


I try the deZender too, but nothing again....

[smashinghead]

I have more the lasts 7 files.. Can you decrypt for me plx? Ty


I try with the PHPunlockit, change echo in the order of eval, but nothin =/

[K-Pax]

@smashinghead

You need to add <?php and ?> at the beginning and end of each file.

HF

[smashinghead]

thanks for the help K-Pax.

------------------------------

I tried to put <? php ?>, how you say, but the phpunlockit says the file is invalid.

Here the code what i save in a txt to decode...

<?php echo($OOO0000O0('aWYoITApJE8wMDBPME8wMD0kT09PMDAwTzAwKCRPT08wTzBPMDAsJ3JiJyk7JE8wTzAwME8wMCgkTzAwME8wTzAwLDEwMjQpOyRPME8wMDBPMDAoJE8wMDBPME8wMCw0MDk2KTskT08wME8wME8wPSRPT08wMDAwTzAoJE9PTzAwMDAwTygkTzBPMDBPTzAwKCRPMDAwTzBPMDAsMTAwMCksJzl5MCtuRmlKZ3YvNURXSXBocWZVMmJ3TkFtUmVZM01CYTR0T0taY0NUa0xvN0VzUFh4U2psenVyVjFkR1FINjg9JywnQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLycpKTtldmFsKCRPTzAwTzAwTzApOw=='));
?>

[testuser]

Hello

Please somebody help me in debugging this code below,any help will be much appreciated

<?php eval(gzinflate(base64_decode('bVLBbtswDD13QP+B0IA5 OzS6r46Cbpcdg3ZAsVMhW4wlVDYFiYlRYB8/SU7bIO1BEiW+x0ebb6taadxRtdtgA0jZe0puGmBPEb6O2k1bdf 2lzQhwZiP2RIxR5CeAVwbsPOqEkPcjAluEBQV9ROM4gZtY9wxM kA4hUOQKymtE0Ae2FNMaisxVG+qegp5qoMFG3G/EItV5Gty0p1WTHOMh+ub7bebJOdxoM7pJCmDHHjfiIefhrrwJ9 R63Uiv4B+eFLXP4IXOF2k3Q8Xnd0yjrLcmgtdfje9ldvcMjRbO LmBL8Kbic1nFA3oinzuvpWagLwKJ7Jtu8ys7zGj32HOlmxN4W7 UY99BSxIx1N+sAUZ8wZO0uJ87A6f8gEWnp/6/YRO/i9AODnCfFJr5+gimwRlW+DSLnFaVCXc5j0iHkI2+yhE6L83V8U XqIbLMO3Poe3J6fkDyQwmnHV/K0kuPMe7gswwT0mjEc0sG5lMcFiynxW6hyeFk+tCq9kOzIvNbA 8evUf'))); ?>

Thanks

[K-Pax]

Originally Posted by testuser

Hello

Please somebody help me in debugging this code below,any help will be much appreciated

<?php eval(gzinflate(base64_decode('bVLBbtswDD13QP+B0IA5 OzS6r46Cbpcdg3ZAsVMhW4wlVDYFiYlRYB8/SU7bIO1BEiW+x0ebb6taadxRtdtgA0jZe0puGmBPEb6O2k1bdf 2lzQhwZiP2RIxR5CeAVwbsPOqEkPcjAluEBQV9ROM4gZtY9wxM kA4hUOQKymtE0Ae2FNMaisxVG+qegp5qoMFG3G/EItV5Gty0p1WTHOMh+ub7bebJOdxoM7pJCmDHHjfiIefhrrwJ9 R63Uiv4B+eFLXP4IXOF2k3Q8Xnd0yjrLcmgtdfje9ldvcMjRbO LmBL8Kbic1nFA3oinzuvpWagLwKJ7Jtu8ys7zGj32HOlmxN4W7 UY99BSxIx1N+sAUZ8wZO0uJ87A6f8gEWnp/6/YRO/i9AODnCfFJr5+gimwRlW+DSLnFaVCXc5j0iHkI2+yhE6L83V8U XqIbLMO3Poe3J6fkDyQwmnHV/K0kuPMe7gswwT0mjEc0sG5lMcFiynxW6hyeFk+tCq9kOzIvNbA 8evUf'))); ?>

Thanks

http://www.tareeinternet.com/forum/k...e.html#post429