Ioncube decoder v12/v13

Gisselle Nader

New member
Joined
Apr 9, 2024
Messages
16
Points
1
Sorry for my bad english after all.

Before ioncube 12 i can get the opcode with this extension https://github.com/phppan/opcodedump. But when ioncube 12 release i only can dump the meta information about executed function like function arg, total properties and so on not include with opcodes.

Then i try to look the ioncube loader i see method zend_attach_symbol when this function get executed the opcodes will return and not 0 anymore (it execute 2 times, first time when zend_execute the opcodes return NULL / 0, and the second one the struct field op_array not null anymore).

but the problem is when i wanna to see the function table it only return the meta from this function (like function name, function arg, and so on) the op_array is NULL. I try to get this function table / class table from global macros CG(function_table) / CG(class_table) or EG(function_table) / CG(class_table).

When i try debugging it with IDA i see the function table opcode value from the function, but i dont know how to get it because it only show generated name like debug:09, i dont know where this opcode placed in the original php source code struct

my question is, how to dump the op_array / opcodes from the function_table, i have no idea to do this, i'm stucking now. Can i access this function table or class table from the zend_execute_data struct from function zend_attach_symbol.
 

Zula Rath

New member
Joined
Apr 9, 2024
Messages
15
Points
1
Not working anymore, the way i do just like above, ioncube now do override function and class caller so any opcode from class or function store at internal memory of ioncube not from global PHP variable
 
Top