deobfuscation challenge

Jahman808

Posts: 20

Threads: 8

Joined: Nov, 2020

Reputation: 0

Posted

try and deobfuscate my obfuscator: https://mega.nz/file/qQkxlQhT#ZoT2K0_KSNX87jPbhs05Z2F3tUrxtp0uifYIN1No1Fk

vitustotal: https://www.virustotal.com/gui/url-analysis/u-57e85e55b364b981781493066160c20eb615b0de018eeee26dc6b2ace70b3a23-1648410621

if u can constant dump it or deobfuscate it then ad dme on discord: Jahman#8617 and tell me how u did it.

0

JoeIsGod

Joe

Posts: 102

Threads: 0

Joined: Feb, 2022

Reputation: 31

Replied

Nice this is pasted from ib2

0

https://i.imgur.com/idqFNwN.png

Jahman808

Posts: 20

Threads: 8

Joined: Nov, 2020

Reputation: 0

Replied

@75079Its not fully done and ive pagched some of the constant dumping methods And theres sone more stuff comjng to it

0

Kiko

Fake it 'till you make it

Posts: 23

Threads: 5

Joined: Mar, 2022

Reputation: 3

Replied

Just woke up and saw this thread, lets give it a try!

Simple constant dump made me notice it uses constant encryption:

TeleCrypter_PromptJoin
ï¿½<ï¿½dN8ï¿½'ï¿½]ï¿½cï¿½Brï¿½Kï¿½ï¿½3ï¿½
ï¿½-ï¿½
print
ï¿½
ï¿½
string
sub
char
ï¿½Hï¿½Ka\ï¿½Tï¿½2ï¿½ï¿½%]tï¿½rï¿½OÆDï¿½Ll

local dump = {
    [1] = "\84\101\108\101\67\114\121\112\116\101\114\95\80\114\111\109\112\116\74\111\105\110",
    [2] = "\225\60\241\247\254\205\100\78\56\151\39\182\93\249\99\163\174\66\114\26\182\75\181\28\191\229\51\168\214",
    [3] = "\226\45\252",
    [4] = print,
    [5] = "\204\25",
    [6] = "\199\13\212",
    [7] = "",
    [8] = string,
    [9] = "\115\117\98",
    [10] = "\99\104\97\114",
    [11] = 0,
    [12] = 255,
    [13] = 1,
    [14] = "\137\72\133\135\141\247\75\97\92\254\84\213\50\139\7\141\201\37\93\116\216\114\211\79\198\144\68\195\224\76\108",
    [15] = 31,
    [16] = 2
}

Sadly due to the script not working I can't deobfuscate it. Literally doesn't run since it errors somewhere in code. I could use XORKey in a custom IB2 virtual machine to deobfuscate it, but I don't have that time.

If you want me to deobfuscate it, post a script that actually runs in Roblox or a Lua env.

Bye!

0

https://yesitskiko.github.io/about-me/

I've got a PHD in Scratch.

Jahman808

Posts: 20

Threads: 8

Joined: Nov, 2020

Reputation: 0

Replied

@76484Whats your discord? Ill send u a new script, i wanna see what u can do

0

Kiko

Fake it 'till you make it

Posts: 23

Threads: 5

Joined: Mar, 2022

Reputation: 3

Replied

@Jahman808

My discord is Kiko#5332. The obfuscator you sent is easy to deobfuscate. But something like Luraph or Boronide, I can't.

0

https://yesitskiko.github.io/about-me/

I've got a PHD in Scratch.

Jahman808

Posts: 20

Threads: 8

Joined: Nov, 2020

Reputation: 0

Replied

@76484My discord is Jahman, ill send u an updated script

0

Users viewing this thread: