| View previous topic :: View next topic |
| Author |
Message |
iamdeath Master

Joined: 11 Feb 2005 Posts: 323 Location: *HeLL*
|
Posted: Sun Oct 14, 2007 2:14 am Post subject: decode |
|
|
| Code: | \151\u66 \u37\u36\x30\x37\u35\61\62 [\u73\u74\u72\x69\u6e\147 \155\x61\u70 {n > | = h \} b < y | 2 \{ S {;} G : : z * 9 = y E 8 \} x a w {;} 7 c v {"} 6 ( u 5 5 p t q s l 3 u r \\ 2 {$} 1 z q t 0 v p 8 / , o { } . F n 1 - r m D l e , M k m + w * T i V ) & h A ( g g + f {
} & P e 6 % I {$} \] d > # x c U {"} k b o a 0 { } - \] N \\ f {[} C Y 7 X 3 V ) U L T X S \{ R Y P H O 9 N . M i L R {
} # I < H s G d F O E / D {[} C % A} vu,x0FP\}propx&02FTxM0(&,qp0&oF\]DP0x&oFFPD0pP\}ph02RR00>1110/,aFD,o\]0#F+,R00T+02fxopx&02qPp0q,xM0Ufq,xMPp0x,FpPFp1(qo\ xuTxTF+,\ x,r0Et-Uh0Puu,u-0||0UtUh02R0000v(pq0Iq,xM0UsOL08xT8x,FpPFp8ropx&8+T\}p(uPq8DTcP\ &prD0<LLY8\$\ tUR0000v(pq0Iq,xM0U%xxPvpG0pP\}p8&prDUR0000v(pq0Iq,xM0U<,qpG0x,FpPFp1(qo\ xuTxTF+,\ x,rUR0000v(pq0Iq,xM0U)qPu1%gPFpG0.,:TDDo85\ t0A7\$\$S0)S0iTF(\}0T\"E\"S0PF1)XS0ucGt\ *\ *VUR0000v(pq0Iq,xM0U\[,FFPxpT,FG0xD,qPUR0000v(pq0Iq,xM0UUR0000+D(q&0Iq,xMRR0000>1110<Po\]PuR0000v(pz(TxM0UY\{#3.Xs0IFTxM0GNtl\;Nttlttet\"d,up&x,rTFg0iTcP0\[,cPuogPNttlNtl\;UR0000v(pz(TxM0UY\{#3.Xs0IFTxM0GNtl\;/opP0000000000LTrP0000000000000.opx&Ntl\;URR0000>1110dTDpPuTFg0#F+,R0000a&TDP02fgPpq0Iq,xM0&prD-0n|0UtUh02R000000T+02fqpuTFg0ropx&01F,xoqP0Uwbpu0coDTgF|p,vwnwU0I&prD-0||0U\$Uh02R00000000qPp0\}0UtUR00000000qPp0DTFP0UUR00000000qPp0x,D,u0UI&prDUR000000h0PDqPT+02fqpuTFg0ropx&01F,xoqP0Uwbp\]0F,auovnwU0I&prD-0||0U\$Uh02R00000000qPp0DTFP0UI2DTFPhfDuoFgP0fgPpq0Iq,xM-0t0\$-0URR00000000T+02fTFxu0\}-0n|0U\\Uh02R0000000000gPpq0Iq,xM0&prDR0000000000gPpq0Iq,xM0&prDR0000000000a&TDP02fgPpq0Iq,xM0&prD-0n|0UtU0\n\n0fqpuTFg0ropx&01F,xoqP0Uwnd,uPxoqpbwU0I&prD-0||0UtUh02R000000000000T+02fqpuTFg0ropx&01F,xoqP0UwbkunwU0I&prD-0||0U\$U0yy0fqpuTFg0ropx&01F,xoqP0Uwb8p\]nwU0I&prD-0||0U\$Uh02R00000000000000uPgP\}v02\ &prDUnA\ mVb8onh0I&prD0ropx&0&prDR00000000000000uPgP\}v02A\ mVbkunh0I&prD0ropx&0&prDR00000000000000uPgP\}v02A\ mV0b8p\]nh0I&prD0ropx&0&prDR00000000000000qPp0DTFP0UI2DTFPh0I2&prDh\ UR000000000000hR0000000000hR0000000000FP\}propx&GDTFP0IFTxM0Ix,D,u0IDTFPR00000000hRR000000hR0000hRR0000>1110d,,pPuR0000v(pz(TxM0UY\{#3.Xs0IFTxM0GNtl\;Nttlttet\"\[(uuPFp0/opPG0fqpu+pTrP0U6oe06\]06k06C06<G6.G6XU-NttlNtl\;URR0000xD,qP0Iq,xMR00h0PDqP02R0000v(pz(TxM0U9HL#\[O0IFTxM0GLTrP,(p0a&TDP0z(Pu=TFg0XPucPu\ UR00hRh] |
Hi can this be decoded any how? is that possible because the author of that tcl is missing so if it is decoded I will be able to modify it for my needs and fix some bugs.
Thanks
iamdeath _________________ |AmDeAtH @ Undernet
Death is only the *Beginning*... |
|
| Back to top |
|
 |
rosc2112 Revered One

Joined: 19 Feb 2006 Posts: 1454 Location: Northeast Pennsylvania
|
Posted: Sun Oct 14, 2007 2:38 am Post subject: |
|
|
| Looks like its been obfuscated.. Search the forum for other threads where obfuscation and such have been discussed.. Good luck. |
|
| Back to top |
|
 |
nml375 Revered One
Joined: 04 Aug 2006 Posts: 2857
|
Posted: Sun Oct 14, 2007 9:01 am Post subject: |
|
|
De-obfuscating this is pretty easy... just try something like this:
| Code: | | set myvar "\151\u66 \u37......." |
_________________ NML_375, idling at #eggdrop@IrcNET |
|
| Back to top |
|
 |
KrzychuG Master

Joined: 16 Aug 2003 Posts: 306 Location: Torun, Poland
|
Posted: Sun Oct 14, 2007 9:45 am Post subject: |
|
|
| Code: |
proc nextmatch {nick uhost handle channel text} {
#--- Download Info
if {[catch {set sock "[socket content-usa.cricinfo.com 80]"} error] == "0"} {
puts $sock "GET /ci/content/match/fixtures/live.html HTTP/1.0"
puts $sock "Accept: text/html"
puts $sock "Host: content-usa.cricinfo.com"
puts $sock "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.9)"
puts $sock "Connection: close"
puts $sock ""
flush $sock
#--- Header
putquick "PRIVMSG $nick :\037\00300,06Forthcoming Live Coverage\003\037"
putquick "PRIVMSG $nick :\037Date Time Match\037"
#--- Filtering Info
while {[gets $sock html] >= "0"} {
if {[string match -nocase "*<tr valign=top*>*" $html] == "1"} {
set x "0"
set line ""
set color "$html"
} elseif {[string match -nocase "*<td nowrap>*" $html] == "1"} {
set line "${line}[lrange [gets $sock] 0 1] "
if {[incr x] >= "2"} {
gets $sock html
gets $sock html
while {[gets $sock html] >= "0"
[string match -nocase "*>Forecast<*" $html] == "0"} {
if {[string match -nocase "*<br>*" $html] == "1" || [string match -nocase "*</td>*" $html] == "1"} {
regexp {.html">(.+)</a>} $html match html
regexp {(.+)<br>} $html match html
regexp {(.+) </td>} $html match html
set line "${line} ${html}."
}
}
nextmatch:line $nick $color $line
}
}
}
#--- Footer
putquick "PRIVMSG $nick :\037\00300,06Current Date: [strftime "%a, %d %b %Y %H:%M:%S"]\003\037"
close $sock
} else {
putquick "NOTICE $nick :Timeout while querying Server."
}
}
|
That's it ;-) _________________ Que? |
|
| Back to top |
|
 |
iamdeath Master

Joined: 11 Feb 2005 Posts: 323 Location: *HeLL*
|
Posted: Sun Oct 14, 2007 3:07 pm Post subject: |
|
|
| KrzychuG wrote: | | Code: |
proc nextmatch {nick uhost handle channel text} {
#--- Download Info
if {[catch {set sock "[socket content-usa.cricinfo.com 80]"} error] == "0"} {
puts $sock "GET /ci/content/match/fixtures/live.html HTTP/1.0"
puts $sock "Accept: text/html"
puts $sock "Host: content-usa.cricinfo.com"
puts $sock "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.9)"
puts $sock "Connection: close"
puts $sock ""
flush $sock
#--- Header
putquick "PRIVMSG $nick :\037\00300,06Forthcoming Live Coverage\003\037"
putquick "PRIVMSG $nick :\037Date Time Match\037"
#--- Filtering Info
while {[gets $sock html] >= "0"} {
if {[string match -nocase "*<tr valign=top*>*" $html] == "1"} {
set x "0"
set line ""
set color "$html"
} elseif {[string match -nocase "*<td nowrap>*" $html] == "1"} {
set line "${line}[lrange [gets $sock] 0 1] "
if {[incr x] >= "2"} {
gets $sock html
gets $sock html
while {[gets $sock html] >= "0"
[string match -nocase "*>Forecast<*" $html] == "0"} {
if {[string match -nocase "*<br>*" $html] == "1" || [string match -nocase "*</td>*" $html] == "1"} {
regexp {.html">(.+)</a>} $html match html
regexp {(.+)<br>} $html match html
regexp {(.+) </td>} $html match html
set line "${line} ${html}."
}
}
nextmatch:line $nick $color $line
}
}
}
#--- Footer
putquick "PRIVMSG $nick :\037\00300,06Current Date: [strftime "%a, %d %b %Y %H:%M:%S"]\003\037"
close $sock
} else {
putquick "NOTICE $nick :Timeout while querying Server."
}
}
|
That's it  |
Thanks alot man, but how did you do that? could you please teach me.
Thanks
iamdeath _________________ |AmDeAtH @ Undernet
Death is only the *Beginning*... |
|
| Back to top |
|
 |
iamdeath Master

Joined: 11 Feb 2005 Posts: 323 Location: *HeLL*
|
Posted: Sun Oct 14, 2007 3:15 pm Post subject: |
|
|
| nml375 wrote: | De-obfuscating this is pretty easy... just try something like this:
| Code: | | set myvar "\151\u66 \u37......." |
|
Can you please be more specific
Thanks
iamdeath _________________ |AmDeAtH @ Undernet
Death is only the *Beginning*... |
|
| Back to top |
|
 |
Alchera Revered One

Joined: 11 Aug 2003 Posts: 3344 Location: Ballarat Victoria, Australia
|
Posted: Sun Oct 14, 2007 8:09 pm Post subject: |
|
|
Authors find it necessary to obfuscate (obscure) their code because there are users that simply ignore the GNU General Public Licence and (apparently) have no concept of the The Open Source Definition.
Many excellent coders have simply "packed their bags" and left because of this continuous code ripping and credit being taken for another's hard effort.
Every effort should be made to contact author's regarding any modification to their code a particular user would like (or a feature added).
It is interesting that the original poster simply stated "because the author of that tcl is missing" without actually revealing the author or posting the script. _________________ Add [SOLVED] to the thread title if your issue has been.
Search | FAQ | RTM |
|
| Back to top |
|
 |
iamdeath Master

Joined: 11 Feb 2005 Posts: 323 Location: *HeLL*
|
Posted: Sun Oct 14, 2007 8:29 pm Post subject: |
|
|
| Alchera wrote: | Authors find it necessary to obfuscate (obscure) their code because there are users that simply ignore the GNU General Public Licence and (apparently) have no concept of the The Open Source Definition.
Many excellent coders have simply "packed their bags" and left because of this continuous code ripping and credit being taken for another's hard effort.
Every effort should be made to contact author's regarding any modification to their code a particular user would like (or a feature added).
It is interesting that the original poster simply stated "because the author of that tcl is missing" without actually revealing the author or posting the script. |
I do agree with you Alchera but I with no intension want this code to be decode so that I could change authors credit. All I wanted is to decode the script so that I could fix some bugs and use it for my channel. Credits are changed by kids who know nothing about what they're doing, I think I know a little about tcl scripting what I have learnt from this forum. If this decode thing is easily to understand it will be easier for me to tackle or solve my problem but if it is not possible then I am dont mind I can find any other way or try making that script again which will be kind of hard for me.
Thanks
iamdeath _________________ |AmDeAtH @ Undernet
Death is only the *Beginning*... |
|
| Back to top |
|
 |
nml375 Revered One
Joined: 04 Aug 2006 Posts: 2857
|
Posted: Sun Oct 14, 2007 8:51 pm Post subject: |
|
|
Actually, obfuscating is'nt quite in line with GPL or similar licenses, as the main objective with most of these licenses are re-usable code.
Actually, when speaking in terms of the General Public License, there is no requirement whatsoever in contacting anyone in the chain of authors, as long as the resulting code complies with the GPL license. You'd usually only have to contact those if you would like to use your code outside the context of the GPL, requesting concent from any and all contributing authors of the work you based your on work upon.
Also, whenever releasing any work under GPL, you are required to provide a sourcecode copy to whomever have recived a license for the work in question. Not releasing an un-obfuscated version of the (GPL'd) work might in itself be a violation of GPL.
Now, wether this speciffic script was released under GPL or some other licensing (open source or otherwize) was never specified in the original post. _________________ NML_375, idling at #eggdrop@IrcNET |
|
| Back to top |
|
 |
iamdeath Master

Joined: 11 Feb 2005 Posts: 323 Location: *HeLL*
|
Posted: Mon Oct 15, 2007 7:25 am Post subject: |
|
|
well it was coded by one of my friend who has quit IRC the problem is that we encoded those scripts so that no one on the shell will ever steal the code and the backup I had in my harddisk was gone due to harddisk failure. So now I have some problems coming up using that tcl. If I had that decoded I mean the whole script I have just shown half of it.. I will be able to use it further. _________________ |AmDeAtH @ Undernet
Death is only the *Beginning*... |
|
| Back to top |
|
 |
nml375 Revered One
Joined: 04 Aug 2006 Posts: 2857
|
Posted: Mon Oct 15, 2007 9:31 am Post subject: |
|
|
As stated in an earlier post, these kind of obfuscations are very easy to break.
In this case, the first part is simply escaped characters in a poor attempt to hide this string: "if 7607512 [string map ......]"
Now we know the rest of the block is simply two arguments for "string map", so we extract them;
| Code: | set key {n > | = h \} b < y | 2 \{ S {;} G : : z * 9 = y E 8 \} x a w {;} 7 c v {"} 6 ( u 5 5 p t q s l 3 u r \\ 2 {$} 1 z q t 0 v p 8 / , o { } . F n 1 - r m D l e , M k m + w * T i V ) & h A ( g g + f {
} & P e 6 % I {$} \] d > # x c U {"} k b o a 0 { } - \] N \\ f {[} C Y 7 X 3 V ) U L T X S \{ R Y P H O 9 N . M i L R {
} # I < H s G d F O E / D {[} C % A} |
Finally, we know that the rest of the data must be the last parameter:
| Code: | | set crypt "vu,x0FP\}propx&02FTxM0(&,qp0&oF\]DP0x&oFFPD0pP\}ph02RR00>1110/,aFD,o\]0#F+,R00T+02fxopx&02qPp0q,xM0Ufq,xMPp0x,FpPFp1(qo\ xuTxTF+,\ x,r0Et-Uh0Puu,u-0||0UtUh02R0000v(pq0Iq,xM0UsOL08xT8x,FpPFp8ropx&8+T\}p(uPq8DTcP\ &prD0<LLY8\$\ tUR0000v(pq0Iq,xM0U%xxPvpG0pP\}p8&prDUR0000v(pq0Iq,xM0U<,qpG0x,FpPFp1(qo\ xuTxTF+,\ x,rUR0000v(pq0Iq,xM0U)qPu1%gPFpG0.,:TDDo85\ t0A7\$\$S0)S0iTF(\}0T\"E\"S0PF1)XS0ucGt\ *\ *VUR0000v(pq0Iq,xM0U\[,FFPxpT,FG0xD,qPUR0000v(pq0Iq,xM0UUR0000+D(q&0Iq,xMRR0000>1110<Po\]PuR0000v(pz(TxM0UY\{#3.Xs0IFTxM0GNtl\;Nttlttet\"d,up&x,rTFg0iTcP0\[,cPuogPNttlNtl\;UR0000v(pz(TxM0UY\{#3.Xs0IFTxM0GNtl\;/opP0000000000LTrP0000000000000.opx&Ntl\;URR0000>1110dTDpPuTFg0#F+,R0000a&TDP02fgPpq0Iq,xM0&prD-0n|0UtUh02R000000T+02fqpuTFg0ropx&01F,xoqP0Uwbpu0coDTgF|p,vwnwU0I&prD-0||0U\$Uh02R00000000qPp0\}0UtUR00000000qPp0DTFP0UUR00000000qPp0x,D,u0UI&prDUR000000h0PDqPT+02fqpuTFg0ropx&01F,xoqP0Uwbp\]0F,auovnwU0I&prD-0||0U\$Uh02R00000000qPp0DTFP0UI2DTFPhfDuoFgP0fgPpq0Iq,xM-0t0\$-0URR00000000T+02fTFxu0\}-0n|0U\\Uh02R0000000000gPpq0Iq,xM0&prDR0000000000gPpq0Iq,xM0&prDR0000000000a&TDP02fgPpq0Iq,xM0&prD-0n|0UtU0\n\n0fqpuTFg0ropx&01F,xoqP0Uwnd,uPxoqpbwU0I&prD-0||0UtUh02R000000000000T+02fqpuTFg0ropx&01F,xoqP0UwbkunwU0I&prD-0||0U\$U0yy0fqpuTFg0ropx&01F,xoqP0Uwb8p\]nwU0I&prD-0||0U\$Uh02R00000000000000uPgP\}v02\ &prDUnA\ mVb8onh0I&prD0ropx&0&prDR00000000000000uPgP\}v02A\ mVbkunh0I&prD0ropx&0&prDR00000000000000uPgP\}v02A\ mV0b8p\]nh0I&prD0ropx&0&prDR00000000000000qPp0DTFP0UI2DTFPh0I2&prDh\ UR000000000000hR0000000000hR0000000000FP\}propx&GDTFP0IFTxM0Ix,D,u0IDTFPR00000000hRR000000hR0000hRR0000>1110d,,pPuR0000v(pz(TxM0UY\{#3.Xs0IFTxM0GNtl\;Nttlttet\"\[(uuPFp0/opPG0fqpu+pTrP0U6oe06\]06k06C06<G6.G6XU-NttlNtl\;URR0000xD,qP0Iq,xMR00h0PDqP02R0000v(pz(TxM0U9HL#\[O0IFTxM0GLTrP,(p0a&TDP0z(Pu=TFg0XPucPu\ UR00hRh" |
Now, having these parts separated, we can easily get the output doing something like this:
| Code: | | set data [string map $key $crypt] |
_________________ NML_375, idling at #eggdrop@IrcNET |
|
| Back to top |
|
 |
iamdeath Master

Joined: 11 Feb 2005 Posts: 323 Location: *HeLL*
|
Posted: Mon Oct 15, 2007 11:56 am Post subject: |
|
|
Thanks but kinda hard to understand ;/ _________________ |AmDeAtH @ Undernet
Death is only the *Beginning*... |
|
| Back to top |
|
 |
nml375 Revered One
Joined: 04 Aug 2006 Posts: 2857
|
Posted: Mon Oct 15, 2007 12:54 pm Post subject: |
|
|
Well, "\151" is just another way of writing "i". That is an "escaped character". Just like "\u66" is another way of writing "f". Hence "\151\u66" is just another way of writing "if"...
You should be fairly familiar with the string map command by now... _________________ NML_375, idling at #eggdrop@IrcNET |
|
| Back to top |
|
 |
metroid Owner
Joined: 16 Jun 2004 Posts: 771
|
Posted: Mon Oct 15, 2007 4:10 pm Post subject: |
|
|
Alchera is right, it's why I stopped releasing scripts and frankly I don't really care much for eggdrop scripts anymore anyway.
I don't think that people here should be deobfuscating scripts that don't belong to them, another good reason why people stop making these things if others will just deobfuscate them when asked. |
|
| Back to top |
|
 |
iamdeath Master

Joined: 11 Feb 2005 Posts: 323 Location: *HeLL*
|
Posted: Mon Oct 15, 2007 5:04 pm Post subject: |
|
|
if my post is soo annoying I close it and expecting no more replies. but I meant was to fix bugs anyway I will try to recreate that tcl which is going to be hard for me.
Thanks
iamdeath _________________ |AmDeAtH @ Undernet
Death is only the *Beginning*... |
|
| Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
|
|