Decode Encrypted Scripts... ( Vbscript ) |
Post Reply |
Author | |
Poster
Guest Joined: 23 January 2008 Status: Offline Points: 378 |
Post Options
Thanks(0)
Posted: 19 September 2008 at 10:00 |
Description:
This script helps you to decode an encoded script. When you use screnc.exe to encode a file (.vbs, .js, .asp, .htm, .hta...) it generates an encoded file (.je, .vbe...) Now you have a tool to decode it back to be able to see the source code again. Usefull if you have lost your original file. Script:
option explicit Dim oArgs, NomFichier 'D�code les fichiers ASP, HTM, HTML, VBE, JE... 'En sortie sur stdout le fichier d�cod� 'En param�tre le nom du fichier � convertir (sortie dump�e sur stdout) 'Sinon s�lection manuelle NomFichier="" Set oArgs = WScript.Arguments Select Case oArgs.Count Case 0 'Pas d'argument, saisie interactive du nom de fichier NomFichier=BrowseForFolder("Choisissez un fichier � d�coder", &H4031,&H0011) Case 1 If Instr(oArgs(0),"?")=0 Then '-? ou /? => aide NomFichier=oArgs(0) End If Case Else 'Trop d'arguments WScript.Echo "Nb d'arguments non valide" End Select Set oArgs = Nothing If NomFichier<>"" Then Dim fso Set fso=WScript.CreateObject("Scripting.FileSystemObject") If fso.FileExists(NomFichier) Then Dim fic,contenu Set fic = fso.OpenTextFile(NomFichier, 1) Contenu=fic.readAll fic.close Set fic=Nothing Const TagInit="#@~^" '#@~^awQAAA== Const TagFin="==^#~@" '& chr(0) Dim DebutCode, FinCode Do FinCode=0 DebutCode=Instr(Contenu,TagInit) If DebutCode>0 Then If (Instr(DebutCode,Contenu,"==")-DebutCode)=10 Then 'Si "==" suit le marqueur FinCode=Instr(DebutCode,Contenu,TagFin) If FinCode>0 Then Contenu=Left(Contenu,DebutCode-1) & Decode(Mid(Contenu,DebutCode+12,FinCode-DebutCode-12-6)) & Mid(Contenu,FinCode+6) End If End If End If Loop Until FinCode=0 WScript.Echo Contenu Else WScript.Echo Nomfichier & " introuvable" End If Set fso=Nothing Else WScript.Echo "Aucun fichier sp�cifi�" WScript.Echo "Usage : " & wscript.fullname & " " & WScript.ScriptFullName & " <Nom fichier>" End If Function Decode(Chaine) Dim se,i,c,j,index,ChaineTemp Dim tDecode(127) Const Combinaison="1231232332321323132311233213233211323231311231321323112331123132" Set se=WSCript.CreateObject("Scripting.Encoder") For i=9 to 127 tDecode(i)="JLA" Next For i=9 to 127 ChaineTemp=Mid(se.EncodeScriptFile(".vbs",string(3,i),0,""),13,3) For j=1 to 3 c=Asc(Mid(ChaineTemp,j,1)) tDecode(c)=Left(tDecode(c),j-1) & chr(i) & Mid(tDecode(c),j+1) Next Next Set se=Nothing Chaine=Replace(Replace(Chaine,"@&",chr(10)),"@#",chr(13)) Chaine=Replace(Replace(Chaine,"@*",">"),"@!","<") Chaine=Replace(Chaine,"@$","@") index=-1 For i=1 to Len(Chaine) c=asc(Mid(Chaine,i,1)) If c<128 Then index=index+1 If (c=9) or ((c>31) and (c<128)) Then If (c<>60) and (c<>62) and (c<>64) Then Chaine=Left(Chaine,i-1) & Mid(tDecode(c),Mid(Combinaison,(index mod64)+1,1),1) & Mid(Chaine,i+1) End If End If Next Decode=Chaine End Function Function BrowseForFolder(ByVal pstrPrompt, ByVal pintBrowseType, ByVal pintLocation) Dim ShellObject, pstrTempFolder, clngColonPosition Set ShellObject = WScript.CreateObject("Shell.Application") 'ex: '.MinimizeAll, .UndoMinimizeAll, .Open "\\PDC\netlogon" Set pstrTempFolder = ShellObject.BrowseForFolder(&H0, pstrPrompt, pintBrowseType, pintLocation) On Error Resume Next BrowseForFolder = pstrTempFolder.ParentFolder.ParseName(pstrTempFolder.Title).Path If Err.Number <> 0 Then BrowseForFolder = "" If Err.Number <> 424 Then 'Cancel=424 clngColonPosition = InStr(1, pstrTempFolder.Title, ":", vbTextCompare) If clngColonPosition > 0 Then BrowseForFolder = Mid(pstrTempFolder.Title, (clngColonPosition - 1),2) & "\" End If End If End If Set pstrTempFolder = Nothing Set ShellObject = Nothing End Function Keywords: Encoder, Encode, Decode, Script, Vbs, Vbe, Wsh |
|
Sponsored Links | |
Post Reply | |
Tweet
|
Forum Jump | Forum Permissions You cannot post new topics in this forum You cannot reply to topics in this forum You cannot delete your posts in this forum You cannot edit your posts in this forum You cannot create polls in this forum You can vote in polls in this forum |