[PHP]Anyone that knows a bit about decrypting/decoding?

[kstor1234]

I'm not doing anything illegal here, I'm just not really experienced in the matter and its fucking stupid to share php code encrypted and I hate it when people does it, but I was asked to do it as a favor and oh well why not ask if anyone here knows how it works and if they don't mind giving up a couple of tips on how to get it sorted...

If there's anyone who has an idea, please tell me xd

I was asked to decode something like this in order to make some changes and then code it back up:

$x2f="bas\145\x5f\x63\157\x6ev\145\162\164";

The file is full with the strings u_u

Thanks a lot guys!

[MentaL]

[s-p-n]

It's possible to hack away at someone else's encoding/encryption, but it's not easy or ideal.

If somebody needs you to decode/decrypt something, it probably means they didn't get provided the encryptor/encoder themselves. So whatever it is you're supposed to do, it's kind of a waste of time, or more trouble than it's worth.

When you encrypt something, you make an encryption engine that works with a decryption engine. They usually require some kind of base or key (random string and/or password and/or timestamp). What the encryptor actually does is up to the programmer. The point of an encryption engine is to distort the data given to it so it's unreadable by hackers/reverse software engineers and their programs.

When you encode something, I'm pretty sure that it shoudn't require a key. Encoding looks at each character, and uses some computational code to change them into a different character/string of characters/binary/hex/integer/float number or something different. The point is, using the decoder you can change it back to UTF-8 or ASCII- whatever it's designed to do- without the use of a key, contrary to encryption. The point of an encoding engine isn't really to hide the source code, since it doesn't require a key, anyone with the same decoder can easily reveal what lie beneath an encoded string.

Not to say web developers don't use encoders to hide data, though the ones that do either aren't skilled or aren't applying their skills- that's not what an encoder is supposed to be for. base64encode(), for example, isn't for hiding your code.

Base64 encoding schemes are commonly used when there is a need to encode binary data that needs be stored and transferred over media that are designed to deal with textual data. This is to ensure that the data remains intact without modification during transport. Base64 is commonly used in a number of applications including email via MIME, and storing complex data in XML.

PHP developers who use base64 as a way to hide source code are using it incorrectly, but there are plenty of people who do it, because it's so easy to use, reliable, and accessible.

Back to your problem:

If you have the encryptor/encoder, we might be able to help you. Looking at one of several strings (or even the entire project), isn't something I or anyone else would like to dedicate much time to- especially if it's well implemented encryption... Which is, by design, very time-consuming, if not impossible, for a normal human (or program) to look only at the end result in order to decrypt.

[SheenBR]

The first thing you should know to decrypt something, is to find out which packer/encryptor they used.

[spikensbror]

The file is not encrypted, it is obfuscated.
Made for a specific purpose to not let anyone modify it.
However, take a look at how the string is processed, if it isn't decrypted at all, it's most likely just raw hex in there which is very easy to decrypt.

[kstor1234]

Thanks for the feedback spikensbror, I'll see what I can do :)

BTW, got some info on the code few minutes ago, it seems like they used http://www.codeeclipse.com/ to obfuscate it, might be useful for anyone.