egghelp/eggheads community

decode

2007-11-29T02:40:57-04:00

I actually know a website that offers downloads of the tcl scripts from the tcl archive. Dunno if the code is modifyed to say that it isn't the authors work or not but the website has him down as the creator shocking the lengths people will go to sometimes. So i can't really blame people for wanting to do everything possible to prevent there code from being ripped.

I also agree totally with metroid's comment, but i ask this, how do you track down an author of a tcl script that no longer frequents any boards or irc networks? their emails are also defunct.

Its common etiquette to do that, and alot of people here do say that to people when they ask for help/support with modifying or editing other peoples code on this forum.

Statistics: Posted by TCL_no_TK — Thu Nov 29, 2007 2:40 am

decode

2007-11-23T04:02:04-04:00

I also agree totally with metroid's comment, but i ask this, how do you track down an author of a tcl script that no longer frequents any boards or irc networks? their emails are also defunct.

Statistics: Posted by DragonRyder — Fri Nov 23, 2007 4:02 am

decode

2007-10-15T19:17:08-04:00

iamdeath: metroid's comment was directed at the apparent "lesson" on how to deobfuscate.

I agree totally with metroid's comment.

Statistics: Posted by Alchera — Mon Oct 15, 2007 7:17 pm

decode

2007-10-15T17:04:24-04:00

if my post is soo annoying I close it and expecting no more replies. but I meant was to fix bugs anyway I will try to recreate that tcl which is going to be hard for me.

Thanks
iamdeath

Statistics: Posted by iamdeath — Mon Oct 15, 2007 5:04 pm

decode

2007-10-15T16:10:16-04:00

Alchera is right, it's why I stopped releasing scripts and frankly I don't really care much for eggdrop scripts anymore anyway.

I don't think that people here should be deobfuscating scripts that don't belong to them, another good reason why people stop making these things if others will just deobfuscate them when asked.

Statistics: Posted by metroid — Mon Oct 15, 2007 4:10 pm

decode

2007-10-15T12:54:55-04:00

Well, "\151" is just another way of writing "i". That is an "escaped character". Just like "\u66" is another way of writing "f". Hence "\151\u66" is just another way of writing "if"...

You should be fairly familiar with the string map command by now...

Statistics: Posted by nml375 — Mon Oct 15, 2007 12:54 pm

decode

2007-10-15T11:56:37-04:00

Thanks but kinda hard to understand ;/

Statistics: Posted by iamdeath — Mon Oct 15, 2007 11:56 am

decode

2007-10-15T09:31:12-04:00

As stated in an earlier post, these kind of obfuscations are very easy to break.
In this case, the first part is simply escaped characters in a poor attempt to hide this string: "if 7607512 [string map ......]"

Now we know the rest of the block is simply two arguments for "string map", so we extract them;

Code:

set key {n > | = h \} b < y | 2 \{ S {;} G : : z * 9 = y E 8 \} x a w {;} 7 c v {"} 6 ( u 5 5 p t q s l 3 u r \\ 2 {$} 1 z q t 0 v p 8 / , o { } . F n 1 - r m D l e , M k m + w * T i V ) & h A ( g g + f {} & P e 6 % I {$} \] d > # x c U {"} k b o a 0 { } - \] N \\ f {[} C Y 7 X 3 V ) U L T X S \{ R Y P H O 9 N . M i L R {} # I < H s G d F O E / D {[} C % A}

Finally, we know that the rest of the data must be the last parameter:

Code:

set crypt "vu,x0FP\}propx&02FTxM0(&,qp0&oF\]DP0x&oFFPD0pP\}ph02RR00>1110/,aFD,o\]0#F+,R00T+02fxopx&02qPp0q,xM0Ufq,xMPp0x,FpPFp1(qo\ xuTxTF+,\ x,r0Et-Uh0Puu,u-0||0UtUh02R0000v(pq0Iq,xM0UsOL08xT8x,FpPFp8ropx&8+T\}p(uPq8DTcP\ &prD011101110dTDpPuTFg0#F+,R0000a&TDP02fgPpq0Iq,xM0&prD-0n|0UtUh02R000000T+02fqpuTFg0ropx&01F,xoqP0Uwbpu0coDTgF|p,vwnwU0I&prD-0||0U\$Uh02R00000000qPp0\}0UtUR00000000qPp0DTFP0UUR00000000qPp0x,D,u0UI&prDUR000000h0PDqPT+02fqpuTFg0ropx&01F,xoqP0Uwbp\]0F,auovnwU0I&prD-0||0U\$Uh02R00000000qPp0DTFP0UI2DTFPhfDuoFgP0fgPpq0Iq,xM-0t0\$-0URR00000000T+02fTFxu0\}-0n|0U\\Uh02R0000000000gPpq0Iq,xM0&prDR0000000000gPpq0Iq,xM0&prDR0000000000a&TDP02fgPpq0Iq,xM0&prD-0n|0UtU0\n\n0fqpuTFg0ropx&01F,xoqP0Uwnd,uPxoqpbwU0I&prD-0||0UtUh02R000000000000T+02fqpuTFg0ropx&01F,xoqP0UwbkunwU0I&prD-0||0U\$U0yy0fqpuTFg0ropx&01F,xoqP0Uwb8p\]nwU0I&prD-0||0U\$Uh02R00000000000000uPgP\}v02\ &prDUnA\ mVb8onh0I&prD0ropx&0&prDR00000000000000uPgP\}v02A\ mVbkunh0I&prD0ropx&0&prDR00000000000000uPgP\}v02A\ mV0b8p\]nh0I&prD0ropx&0&prDR00000000000000qPp0DTFP0UI2DTFPh0I2&prDh\ UR000000000000hR0000000000hR0000000000FP\}propx&GDTFP0IFTxM0Ix,D,u0IDTFPR00000000hRR000000hR0000hRR0000>1110d,,pPuR0000v(pz(TxM0UY\{#3.Xs0IFTxM0GNtl\;Nttlttet\"\[(uuPFp0/opPG0fqpu+pTrP0U6oe06\]06k06C06

Now, having these parts separated, we can easily get the output doing something like this:Code: 
set data [string map $key $crypt]
Statistics: Posted by nml375 — Mon Oct 15, 2007 9:31 am



decode
2007-10-15T07:25:48-04:00

well it was coded by one of my friend who has quit IRC the problem is that we encoded those scripts so that no one on the shell will ever steal the code and the backup I had in my harddisk was gone due to harddisk failure. So now I have some problems coming up using that tcl. If I had that decoded I mean the whole script I have just shown half of it.. I will be able to use it further.Statistics: Posted by iamdeath — Mon Oct 15, 2007 7:25 am




decode
2007-10-14T20:51:01-04:00

Actually, obfuscating is'nt quite in line with GPL or similar licenses, as the main objective with most of these licenses are re-usable code.

Actually, when speaking in terms of the General Public License, there is no requirement whatsoever in contacting anyone in the chain of authors, as long as the resulting code complies with the GPL license. You'd usually only have to contact those if you would like to use your code outside the context of the GPL, requesting concent from any and all contributing authors of the work you based your on work upon.
Also, whenever releasing any work under GPL, you are required to provide a sourcecode copy to whomever have recived a license for the work in question. Not releasing an un-obfuscated version of the (GPL'd) work might in itself be a violation of GPL.

Now, wether this speciffic script was released under GPL or some other licensing (open source or otherwize) was never specified in the original post.Statistics: Posted by nml375 — Sun Oct 14, 2007 8:51 pm




decode
2007-10-14T20:29:05-04:00

Authors find it necessary to obfuscate (obscure) their code because there are users that simply ignore the GNU General Public Licence and (apparently) have no concept of the  The Open Source Definition.

Many excellent coders have simply "packed their bags" and left because of this continuous code ripping and credit being taken for another's hard effort.

Every effort should be made to contact author's regarding any modification to their code a particular user would like (or a feature added).

It is interesting that the original poster simply stated "because the author of that tcl is missing" without actually revealing the author or posting the script.
I do agree with you Alchera but I with no intension want this code to be decode so that I could change authors credit. All I wanted is to decode the script so that I could fix some bugs and use it for my channel. Credits are changed by kids who know nothing about what they're doing, I think I know a little about tcl scripting what I have learnt from this forum. If this decode thing is easily to understand it will be easier for me to tackle or solve my problem but if it is not possible then I am dont mind I can find any other way or try making that script again which will be kind of hard for me. 

Thanks
iamdeathStatistics: Posted by iamdeath — Sun Oct 14, 2007 8:29 pm




decode
2007-10-14T20:09:20-04:00

Authors find it necessary to obfuscate (obscure) their code because there are users that simply ignore the GNU General Public Licence and (apparently) have no concept of the  The Open Source Definition.

Many excellent coders have simply "packed their bags" and left because of this continuous code ripping and credit being taken for another's hard effort.

Every effort should be made to contact author's regarding any modification to their code a particular user would like (or a feature added).

It is interesting that the original poster simply stated "because the author of that tcl is missing" without actually revealing the author or posting the script.Statistics: Posted by Alchera — Sun Oct 14, 2007 8:09 pm




decode
2007-10-14T15:15:45-04:00

De-obfuscating this is pretty easy...  just try something like this:Code: 
set myvar "\151\u66 \u37......."
Can you please be more specific 
Thanks
iamdeathStatistics: Posted by iamdeath — Sun Oct 14, 2007 3:15 pm




decode
2007-10-14T15:07:35-04:00

Code: 
proc nextmatch {nick uhost handle channel text} {    #--- Download Info   if {[catch {set sock "[socket content-usa.cricinfo.com 80]"} error] == "0"} {     puts $sock "GET /ci/content/match/fixtures/live.html HTTP/1.0"     puts $sock "Accept: text/html"     puts $sock "Host: content-usa.cricinfo.com"     puts $sock "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.9)"     puts $sock "Connection: close"     puts $sock ""     flush $sock      #--- Header     putquick "PRIVMSG $nick :\037\00300,06Forthcoming Live Coverage\003\037"     putquick "PRIVMSG $nick :\037Date          Time             Match\037"      #--- Filtering Info     while {[gets $sock html] >= "0"} {       if {[string match -nocase "**" $html] == "1"} {         set x "0"         set line ""         set color "$html"       } elseif {[string match -nocase "**" $html] == "1"} {         set line "${line}[lrange [gets $sock] 0 1] "          if {[incr x] >= "2"} {           gets $sock html           gets $sock html           while {[gets $sock html] >= "0"  [string match -nocase "*>Forecast<*" $html] == "0"} {             if {[string match -nocase "*
*" $html] == "1" || [string match -nocase "**" $html] == "1"} {               regexp {.html">(.+)} $html match html               regexp {(.+)
} $html match html               regexp {(.+) } $html match html               set line "${line} ${html}."             }           }           nextmatch:line $nick $color $line         }        }     }      #--- Footer     putquick "PRIVMSG $nick :\037\00300,06Current Date: [strftime "%a, %d %b %Y %H:%M:%S"]\003\037"      close $sock   } else {     putquick "NOTICE $nick :Timeout while querying Server."   } }
That's it 

Thanks alot man, but how did you do that? could you please teach me.

Thanks
iamdeathStatistics: Posted by iamdeath — Sun Oct 14, 2007 3:07 pm




decode
2007-10-14T09:45:55-04:00

Code: 
proc nextmatch {nick uhost handle channel text} {    #--- Download Info   if {[catch {set sock "[socket content-usa.cricinfo.com 80]"} error] == "0"} {     puts $sock "GET /ci/content/match/fixtures/live.html HTTP/1.0"     puts $sock "Accept: text/html"     puts $sock "Host: content-usa.cricinfo.com"     puts $sock "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.9)"     puts $sock "Connection: close"     puts $sock ""     flush $sock      #--- Header     putquick "PRIVMSG $nick :\037\00300,06Forthcoming Live Coverage\003\037"     putquick "PRIVMSG $nick :\037Date          Time             Match\037"      #--- Filtering Info     while {[gets $sock html] >= "0"} {       if {[string match -nocase "**" $html] == "1"} {         set x "0"         set line ""         set color "$html"       } elseif {[string match -nocase "**" $html] == "1"} {         set line "${line}[lrange [gets $sock] 0 1] "          if {[incr x] >= "2"} {           gets $sock html           gets $sock html           while {[gets $sock html] >= "0"  [string match -nocase "*>Forecast<*" $html] == "0"} {             if {[string match -nocase "*
*" $html] == "1" || [string match -nocase "**" $html] == "1"} {               regexp {.html">(.+)} $html match html               regexp {(.+)
} $html match html               regexp {(.+) } $html match html               set line "${line} ${html}."             }           }           nextmatch:line $nick $color $line         }        }     }      #--- Footer     putquick "PRIVMSG $nick :\037\00300,06Current Date: [strftime "%a, %d %b %Y %H:%M:%S"]\003\037"      close $sock   } else {     putquick "NOTICE $nick :Timeout while querying Server."   } }
That's it ;-)Statistics: Posted by KrzychuG — Sun Oct 14, 2007 9:45 am