*edit*
Final script working with all the versions of netc.dll (1.5.4 and 1.5.7, both win7 and xp versions):
http://aluigi.org/bms/luac_mtasa.bms*edit*
You can use this script for quickbms to decrypt any script built with both the "some" and "more" obfuscation provided on
http://luac.mtasa.comNo reverse engineering, just simple calling of the same DeobfuscateScript function used by the software to do the same job:
Code:
quickbmsver "0.8.0"
set MEMORY_FILE10 string "
void memcpy(unsigned char *out, unsigned char *in, int size) {
for(int i = 0; i < size; i++) out[i] = in[i];
}"
#calldll "netc.dll" "InitNetInterface" "__stdcall" CNET # useless and quickbms can't do "[CNET]+0xa0"
get NAME filename
get SIZE asize
log MEMORY_FILE 0 SIZE
math RET_BUFF = 0
math RET_SIZE = 0
# static functions offsets for mtasa 1.5.4: 0x1a6a0 and 0x1ac20 (xp)
# netc.dll 1.5.4 and pthread.dll must reside in the same folder of quickbms.exe
calldll "netc.dll" 0x1a6a0 "__stdcall" RET MEMORY_FILE SIZE &RET_BUFF &RET_SIZE NAME
math RET & 0xff
if RET == 0
print "Error: DeobfuscateScript failed"
cleanexit
endif
log MEMORY_FILE 0 0
putvarchr MEMORY_FILE RET_SIZE 0
calldll MEMORY_FILE10 "memcpy" "tcc" "" MEMORY_FILE RET_BUFF RET_SIZE
get NAME basename
get EXT extension
string NAME + "_decrypt."
string NAME + EXT
log NAME 0 RET_SIZE MEMORY_FILE
Notes: netc.dll 1.5.4 and pthread.dll must reside in the same folder of quickbms.exe
Register
Login
FAQ
Search
