SRL Archive - News and General

Ok, some noob names zasz cracked my script (the auth) *that bitch :D* so now i need a new one, probly using PHP/MySQL. I got a freehostia ready, if someone is good with these things Post please!!

Ill reward you with a Rep+, and a picture on an australia 5 dollar note.

Thanks, BennEh.

Zasz does exist at SRL too, are there any punishments for cracking a script?

Maybe make his status like "Registered User / Low Life / Village Clown", including the village clown avatar ofcourse? :p

From: n3ss3s
Zasz does exist at SRL too, are there any punishments for cracking a script?

Maybe make his status like "Registered User / Low Life / Village Clown", including the village clown avatar ofcourse? :p

Lucky i wrote this before i did something.

*All people who crack this script will die*

Yay.

Let me guess, he used mastaraymonds deobfuscater to make your script into its normal code and then figured it out from there?

You shouldn't have it say "This script is encrypted using mastaraymonds obfuscater.

From: Esteban
Let me guess, he used mastaraymonds deobfuscater to make your script into its normal code and then figured it out from there?

You shouldn't have it say "This script is encrypted using mastaraymonds obfuscater.

If you really did, it's normal that someone would do it:p

The best one, is the one from Freddy1990, it's not for free I thought..but he did theobfuscating for the VYC aswell;)

-Tsn.

sumilion ones said that freddy ony obfuscat stuff for Dev+

It's human nature to want to crack it and feel smart :|

Auths with PHP & MySQL are easy enough to make. Do you know much of either one?

Add my msn: [email]markusjanse@hotmail.com[/email]

From: rikjess
sumilion ones said that freddy ony obfuscat stuff for Dev+

AFAIK, yes. Maybe that changes since I last used it.

From: Jason2gs
It's human nature to want to crack it and feel smart :|

Auths with PHP & MySQL are easy enough to make. Do you know much of either one?

Just because it's "Human Nature" doesn't mean that he should get away with it. Doing that isn't right.

Why? These scripts are open source for a reason. If anything, obfuscating is wrong. You certainly can't put a script out and complain that someone tries to screw with it. If you don't want people to see the source, write a dang exe.

Dude its a pay script -.-

And that's a whole 'nother rant ^_^

I'm with Mike on this one, if you are that obsessed with money you have a problem. If it's good enough of a script to be a pay script then it should be open source and not obfuscated so other people can learn from it.

So it was just obfuscated, not encrypted? That kinda scripts are too easy to crack… Took me like under 10 mins to crack sumilions guild miner ages ago.

:p @ Gof

I'm with Mike on this one, if you are that obsessed with money you have a problem. If it's good enough of a script to be a pay script then it should be open source and not obfuscated so other people can learn from it.

No offense at BH or anything, but it propably wasn't kinda like VYC :p

wow thats really harsh considering that you gave them a free trial my 5 hearts go out to you man… :(

Even Freddy's 'auth' is crackable..

From: mastaraymond
Even Freddy's 'auth' is crackable..

It's a lot harder, but yes.

From: Sumilion
It's a lot harder, but yes.

Depends wehter you know howto crack it :D

ok, when you obfuscreate sumthing, how's scar know that language…?

From: mastaraymond
Depends wehter you know howto crack it :D

I'm kinda hoping you don't :D

From: Timer
ok, when you obfuscreate sumthing, how's scar know that language…?

The language doesn't change, it's just shown very complicated, with difficult signs, strings are replaced by Chr() + Chr() etc. All vars are named OBF~~$@#@1, OBF~~$@#@2, etc. But as said above, almost every SRL member should be able to crack a regular obfuscation..

From: Sumilion
I'm kinda hoping you don't :D

I got it from someone else.. Dont give me the credits.

From: mastaraymond
I got it from someone else.. Dont give me the credits.

Hehe, by the way do you mean his script authentication or his encryption ?

From: Sumilion
Hehe, by the way do you mean his script authentication or his encryption ?

Encryption.. I guess the one where it does that weird 00010011101 stuff.

From: mastaraymond
Encryption.. I guess the one where it does that weird 00010011101 stuff.

Yes I know how the approach goes but I don't know how to do it.

From: Sumilion
Yes I know how the approach goes but I don't know how to do it.

Your a little hacker :p

From: mastaraymond
Encryption.. I guess the one where it does that weird 00010011101 stuff.

So that's how Freddy's encryption looks? :O

From: mastaraymond
I got it from someone else.. Dont give me the credits.

From: mastaraymond
Your a little hacker :p

Hmm, I think you know more about the matter than I do, big hacker :garfield:

From: Jason2gs
So that's how Freddy's encryption looks? :O

Here is a bigger example, taken from an encrypted VYC :sasmokin:

$CRC=XXXXXXX
$CERTIFIED
$ENCRYPTED
54F6C09147BFF01ABA0CD6510FCA135C0E1A8A07EB49B50C2C1288BA5B89BE58FB3D425BABC9B5A22
59B8EAF651EBFE0C80765CAAF5557D3D729644A0A6C2C5048B9F0115F8BEEBA66E8ED2D5C5C5C7214
2CD2CBFFEBB353D5CDFF233313D0FFD3D4B333125252D6D5AB13D1DEEF335356D79883668122A2893
A89F6ED010E5B352B763297727C4642C647671BF1BA76392AE5077ED9F193D1DE53D2D4DFF7E3D708
A68F00F9D269D71D07F03F05457DD2D8C22333F352D27DD7DB278AD324A2F67FB4C9557C44D6072BD
0FFD3D4537369853BC3D16CD7D0DFA3F3BDD373B9B277D0F353D63372BABAB9DAD5C5F1E3335356D6

Hm, cool :)

And the encryption is the thing you have to pay for per script?

From: mastaraymond
I got it from someone else.. Dont give me the credits.

From: Jason2gs
Hm, cool :)

And the encryption is the thing you have to pay for per script?

I don't know how freddy does it nowadays … you'd have to ask him.

From: Sumilion
I don't know how freddy does it nowadays … you'd have to ask him.

Only for a (taken out) job..

J/k..

Pssh, stop acting like a smart-ass Raymond ^^.

@BH: The VYC's source is now released for members, right? Just make an auth based off that, and use Chaos option in Masta's script, and remove all spaces.

make the entire script in a plugin^^

No, too easy to decompile, and no point in making it a plugin, just make it an exe then.

And cracking encrypted scripts isn't that hard, took me 15 minutes to figure out how…

Uhh so anyone willing to make an Auth from that MysQl shit and php or wat ever you need?

I know how he cracked it, my bad in my coding, but i still want my own auth system because the one im using is a free one, and yea….

How come everyone went to talking about obfuscator, but raymond could you make the obfuscator to obfuscate web addresses, like it just makes it backwards.. And also Getpage isnt obfuscated, so someone can just search for it and mess around with the stuff around.

Ask benland.

I'm sure he could make you a pretty nice encryption
He was working with some last night.

Or if you track down Star he's obfuscate it for you

I was considering making my pest control script a payscript but I don't know any php to make a good database. I'll take a look at the VYC's code and maybe get some ideas.

From: Hobbit
Ask benland.

I'm sure he could make you a pretty nice encryption
He was working with some last night.

Or if you track down Star he's obfuscate it for you

Sounds good,ill ask :) but i dounbt he will give me one.

From: mickaliscious
I was considering making my pest control script a payscript but I don't know any php to make a good database. I'll take a look at the VYC's code and maybe get some ideas.

What you can see in the authing from the VYC is this :

s := GetPage('authpage');
if(s = 'ACCEPTED')then
  Authenticated := True;

thats it ;) surrounded by some crap, but that is what it comes down to.

Ill include the authentication page that I got for the VYC …

[php]<?php
$host="X";
$username="X";
$password="X";
$db_name="X";

mysql_connect($host, $username, $password);
mysql_select_db($db_name);

$users = mysql_query("SELECT username, password, script, location, main_ip, status FROM users");

$username = $_GET['un'];
$password = $_GET['pw'];
$script = $_GET['sc'];
$currentip = $_SERVER['REMOTE_ADDR'];
$date = date("j-n-Y");

while ($row = mysql_fetch_array($users, MYSQL_ASSOC))
{
$authenticated = ($username == $row['username'] AND $password == $row['password'] AND (!(strpos($row['script'], $script) === FALSE)) AND (!(strpos($row['status'], 'ok') === FALSE)) );
if ($authenticated)
break;
}
if ($authenticated)
{
if ($row['main_ip'] == '')
{
mysql_query("UPDATE users SET main_ip = '" . $currentip . "' WHERE username = '" . $username . "'");
}
}
else
{
echo "DENIED";
}
?>[/php]

Excuse me if there is something not done as it should, this was kinda my second php project ever :)

Check the VYC's authentication on how to use it in a script, as for the mysql structure, a tabel called users and in that id, username, password, script, status and main_ip.

I'll quite happily allow you use of my mysql server. Anything to help out another srl member.

I also feel a bit guilty, I cracked your script back in 1.0 stages, just to see if I could. Never used it or gave it to anyone though.

From: Sp0rky
I'll quite happily allow you use of my mysql server. Anything to help out another srl member.

I also feel a bit guilty, I cracked your script back in 1.0 stages, just to see if I could. Never used it or gave it to anyone though.

I got a MySQL server but i dont know how to use lol.

Ye someone told me you cracked it, alwell :) Learn from my badass auth coding :D

So, if I opened a Freddy-Crypted script in an hex editor, would it show me the characters…?

Or is it XOR'ed with the "SRC" number? (or OR'ed or AND'ed.. Or NAND'ed).


Anywho, you could just open a memory stream and shift/or/xor/and a key with a section of data. Or just change the binary information some way. And then use a SCAR script to call a .dll plugin.

Something like that.


EDIT: And which cracked script? the VYC?

From: R0b0t1
So, if I opened a Freddy-Crypted script in an hex editor, would it show me the characters…?

Or is it XOR'ed with the "SRC" number? (or OR'ed or AND'ed.. Or NAND'ed).


Anywho, you could just open a memory stream and shift/or/xor/and a key with a section of data. Or just change the binary information some way. And then use a SCAR script to call a .dll plugin.

Something like that.


EDIT: And which cracked script? the VYC?

I have no idea, im not into hex stuff hacking cracking hexing much.

Afaik VYC was never cracked.

I was asking individuals like BenLand those first few questions :rolleyes:


I've never tried making an auth script, its useless without real monies now, and money seems to… complicate things. MmmKay?

What Ben is doing is trying to decrypt the SCAR-encrypted scripts (the big blocks of hex) so that he can encrypt it himself. He figured out how to get the source without actually decrypting it, which doesn't help. (I figured out how to do it from the pic he showed SKy, put it takes awhile to make it compilable)

So no one can make me or atleast show me how to make me an proper auth from PHP/MySQL?

Please :(

From: BobboHobbo
So no one can make me or atleast show me how to make me an proper auth from PHP/MySQL?

Please :(

Well, once you get one sorted, give the script to me, see if it passes the Sp0rky cracking test :P

From: Sp0rky
Well, once you get one sorted, give the script to me, see if it passes the Sp0rky cracking test :P

Okie, can you tell me how you cracked it last time?

Did you just change the Getpage thing to a random name?

Err, The auth site I discovered you used, was a free scar php auth site, So I made my own little extension, and created a user and a pass, then just changed the extension on your auth page, from Bobohoho, to mine.

:-\

Mmm i see

First page…Markus is willing to help you.

He not onliner.

Because I'm sleeping. :duh:
But once I wake up, I'll make you one.

From: Markus
Because I'm sleeping. :duh:
But once I wake up, I'll make you one.

Woot awesome!

From: Sp0rky
Err, The auth site I discovered you used, was a free scar php auth site, So I made my own little extension, and created a user and a pass, then just changed the extension on your auth page, from Bobohoho, to mine.

:-\

@bobbo. to stop people doing this in the future, try using:

AddPostVariable
InitializeHTTPClient
ClearPostData
PostHTTPPageEx
FreeHTTPClient

found it here: http://www.villavu.com/forum/showthread.php?t=7239

From: Daniel.Blaze
@bobbo. to stop people doing this in the future, try using:

AddPostVariable
InitializeHTTPClient
ClearPostData
PostHTTPPageEx
FreeHTTPClient

found it here: http://www.villavu.com/forum/showthread.php?t=7239

Mmm better off just getting a new auth.

From: BobboHobbo
Mmm better off just getting a new auth.

By the way, That wouldn't help whatsoever…

I could still use the exact same method >_>

I'm 100% sure smartz will come up with an excellent auth system for you. He is truely, "The Man".

But will it stand to be uncrackable/very hard to crack? We'll see.

From: Sp0rky
By the way, That wouldn't help whatsoever…

I could still use the exact same method >_>

I'm 100% sure smartz will come up with an excellent auth system for you. He is truely, "The Man".

But will it stand to be uncrackable/very hard to crack? We'll see.

well it would stop less people cracking the script easily. every little bit in making a script hard to crack counts towards something. thats why in obfuskattors we have encrypting strings, encrypting integers, removing spaces, renaming vars, procedure, functions, consts etc. If only one of the things were done, it wouldn't be as effective.

Right now.. There isn't a single way to encrypt a script (SCRIPT not plugin ^^) in such a way it can't be read.. Although you can make it HARD to read. Obfuscating is a good way to prevent it from being read..But once you got the source you can remove the auth easily.. Even with plugin functions.. (Remove the plugin functions from the script).. So unless you make 50% off your script in the plugin it can be decrypted..

masta, your obfuscerator dones't work… i even tryed your example with the

// end here

and it did not work

@Benneh Try using sp0rkys encoder, and masas obfuscerater.. in all kinds of patterns… that would be un-crack able unless they tried every combination - 1 to infinty… lol

From: Timer
masta, your obfuscerator dones't work… i even tryed your example with the

// end here

and it did not work

@Benneh Try using sp0rkys encoder, and masas obfuscerater.. in all kinds of patterns… that would be un-crack able unless they tried every combination - 1 to infinty… lol

You got the source.. (Its at my 1k post) Go ahead and change it.. If it doesn't work.. Its not my problem.. (Works for me.. :rolleyes:)

I'm talking about a SCAR script calling a function to decrypt a script file and run it through the command line, but obfuscated. While its being run, delete the file, and when SCAR is stopped the script will update. Also, you could add a TerminateScript routine to close SCAR so it can not be read.

I think I got most of the holes…

I'll happily make you a plugin if you like :P

From: R0b0t1
I'm talking about a SCAR script calling a function to decrypt a script file and run it through the command line, but obfuscated. While its being run, delete the file, and when SCAR is stopped the script will update. Also, you could add a TerminateScript routine to close SCAR so it can not be read.

I think I got most of the holes…

This is exactly the reason why freddy implanted ScriptTerminate.. I've managed to do this too.
And the reason why that message"Your source file has been changed, reload?" has been deleted, when it occurs under runtime ..

But even with this, its 100% possible to get the source…
So..

Yes but anything is possible, but you can make it very hard to do something.

The person who said anything is possible has obviously not tried to slam a revolving door ^.^

From: R0b0t1
The person who said anything is possible has obviously not tried to slam a revolving door ^.^

Well if you pushed really hard you just might break it and slam part of it into a wall :p. Hehe, anything is possible! Especially if you're insane! Hmm, maybe the first person to think anything was possible was insane…does this mean I'm insane too? :duh: Damnit I knew it :rolleyes:.

I feel for ya man.