How does it work?

[kevin25]

Hey there,

Thanks for sharing this code. I wonder how I can decrypt the files?

Best Regards,
Kevin

[kevin25]

It seemed not to work. I tried to decode this file but got the hex

init.php.zip

[kevin25]

And here is the result.

test.php.zip

[kevin25]

While EasyToYou decoded like this

<?php
/**
 * @ PHP 5.6
 * @ Decoder version : 1.0.0.4
 * @ Release on : 24.03.2018
 * @ Website    : http://EasyToYou.eu
 *
 * @ Zend guard decoder PHP 5.6
 **/

function ads_the_title_filter($title, $id = NULL)
{
	if (!is_admin()) {
		$status = get_post_status($id);

		if (ads_check_status_access($status)) {
			$title = '<strong>' . ads_name_status_access($status) . ':</strong> ' . $title;
		}
	}

	return $title;
}

function ads_test_queries()
{
	if (current_user_can('level_9')) {
		printf('<!-- %s queries in %s seconds.-->', get_num_queries(), timer_stop(0));
	}
}

function ads_set_rewrite()
{
	add_rewrite_tag('%buy%', '([0-9]{1,})');
	add_rewrite_rule('cart/?$', 'index.php?pagename=cart', 'top');
	add_rewrite_rule('cart/([^/]+)/?$', 'index.php?pagename=cart&buy=$matches[1]', 'top');
	add_rewrite_rule('account/?$', 'index.php?pagename=account', 'top');
	add_rewrite_rule('orders/?$', 'index.php?pagename=orders', 'top');
	add_rewrite_rule('userlogin/?$', 'index.php?pagename=userlogin', 'top');
	add_rewrite_rule('register/?$', 'index.php?pagename=register', 'top');
	add_rewrite_rule('confirmation/?$', 'index.php?pagename=confirmation', 'top');
	add_rewrite_rule('customersgallery/?$', 'index.php?pagename=customersgallery', 'top');
	add_rewrite_rule('thankyou/?$', 'index.php?pagename=thankyou', 'top'

[Tools2]

could you tell me the specific operation you decode the 'init.php' to 'test.php'?
and...Are you sure you did use 'Zend-Decoder' to decode?
I had also try to decode 'init.php', but the result is different with yours 'test.php'

[kevin25]

@Tools2 Thank you for your reply. I used the command line:

php index.php init.php

Then I saved the result and sent you.

Are you sure you did use 'Zend-Decoder' to decode?

How can I confirm that?

[kevin25]

Here is my php module output

kevin@ubuntu:~/Zend-Decoder$ php -m
[PHP Modules]
calendar
Core
ctype
date
ereg
exif
fileinfo
filter
ftp
gettext
hash
iconv
json
libxml
mhash
openssl
pcntl
pcre
PDO
Phar
posix
readline
Reflection
session
shmop
sockets
SPL
standard
sysvmsg
sysvsem
sysvshm
tokenizer
XCache
XCache Cacher
XCache Disassembler
Zend OPcache
zlib

[Zend Modules]
XCache
XCache Cacher
Zend OPcache

[Tools2]

you can install 'Zend Guard Loader' and try again

[kevin25]

@Tools2 That's what i missed. Thank you. However, i saw this error in the decoded output:

PHP Catchable fatal error: Object of class Decompiler_Fetch could not be converted to string in /home/kevin/Zend-Decoder/Decompiler4.class.php on line 2204

[kevin25]

And can you make it work with ioncube?

[Tools2]

are you sure your file is encrypt by ‘Zend Guard'？
i find it's format is similar to encrypt by ioncube

[kevin25]

@Tools2 Yes, the init.php is encrypted with Zend Guard.

[kevin25]

@Tools2 Can you please write another one for ioncube? Thank you!

[kevin25]

@Tools2

I created a file Decompiler5.class.php and decoded the ion.php (encoded by ioncube) and it was promising. I'm not good at this. Can we make a full decoder then?

function adsw_config_menu()
{
}

function adsw_admin_init()
{
}

function adsw_wp_loader()
{
}

function adsw_admin_init_content()
{
}

function ads_admin_activities()
{
}

function ads_admin_tracking()
{
}

function adsw_admin_ali_import()
{
}

function adsw_admin_ali_review()
{
}

function adsw_admin_ali_settings()
{
}

function adsw_admin_ali_updates()
{
}

function adsw_admin_pricing()
{
}

function adsw_admin_currency()
{
}

function adsw_admin_attributes()
{
}

function adsw_license()
{
}

function adsw_manage_posts()
{
}

function adsw_pays_init_handler_too()
{
}

function adsw_init_product()
{
}

function adsw_delete_product($pid)
{
}

function adsw_init_footer()
{
}

?>

ion.php.zip
Decompiler5.class.php.zip

[Tools2]

You can also get the function name via 'Decompiler4.class' or 'Decompiler3.class'。
my work is busy recently, I will study this issue in depth after a while.

[kevin25]

@Tools2 Thank you. Please don't forget it.

[bzy39]

there a project for ioncube, but it private, xdasm

[kevin25]

@bzy39 How to join it?

[bruno-args]

@bzy39 really, how? I need to decode some code encoded by ioncube.

[bzy39]

well, same, i'm also still finding out how to join it, the first thread about it is on russian forum, nulled.cc

[mdecoder]

work in ioncube encryption ?

[bzy39]

work in ioncube encryption ?

decode ioncube?
yes, but still have alot of bug.

[mdecoder]

yes, i try install more zend loader error...

[mdecoder]

decrypt files ioncube with v9 or v10 with license?

[bzy39]

decrypt files ioncube with v9 or v10 with license?

text file license?
not sure, send me the link sample, with the license file, i will check it.

[mdecoder]

ok!
functions.zip

[bzy39]

error.
`Fatal error:
The encoded file E:\xcache\functions.php has been included by the unauthorised file ƒÄÇG
in Unknown on line 0
error compling E:\decoder\xcache\decoder/functions.php

`

[mdecoder]

dezend ioncube php7.1?

[mdecoder]

dinamyc keys...

[bzy39]

nope, this repo only for php 5.6

[mdecoder]

this file i send for you is no decryptable is php5.6 more is dynamic keys ...

[mdecoder]

no decrypt file with dynamic keys?

[bzy39]

no decrypt file with dynamic keys?

no, some class like codeigniter controller or model also not decoded

[stmaske]

i need help me pls, how can i use it

[mdecoder]

who try decode ioncube? no have keys

[cs16lover]

Any updates?