Encrypted source code, lost plain text versions.

[Thomas_32]

I have a lot of simple VBScript files that were encrypted. I have lost the originals. The code still works within the intended platform, but now I need to do some maintenance. I used a free, vendor-supplied utility that compiled the VBS into a plug-in, but I don't know what encryption system they used.

I'd like to have someone take a look and at least tell me what type of encryption was used, so I can find the utility and/or decrypt the files.

Note, nothing illegal is going on here. I worked extensively with a software package years ago, never thought I'd use it again, and now find myself working with it again, needing to refresh/revise some of my old code without wanting to reinvent the wheel.

[Reverend Jim]

I'd like to have someone take a look and at least tell me what type of encryption was used

I don't know if it will do any good but perhaps you could post one of the scripts for us to see.

I used a free, vendor-supplied utility

Can you tell us more about this? Perhaps a link to the vendor site?

[rproffitt]

There's not much on this subject so I'll share a link and watch what happens next.

https://gallery.technet.microsoft.com/Encode-and-Decode-a-VB-a480d74c

[Thomas_32]

The source code is VBScript. The encrypted text will likely not display properly online. The software is a proprietary document automation system... the vendor supplied me with a utility that they wrote in-house. It takes a GUI written in HTML, and VBScript code, and compiles it into a their own plugin format. It can leave the source code open, which allows the users to see and edit it on an "Advanced Tab" within the software, or encrypt it.

All of that is to say, I doubt 1) knowing the platform would help and 2) that the vendor used anything overly secure, in fact, I'd be surprised if it wasn't an open source encryption utility.

I'll try a screen shot of the encrypted VBS. The plain text is just that, plain VBScript...

[Thomas_32]

That link posted above didn't work. Sorry, to be clear, the LINK worked, but it wasn't able to decript the file. But thank you, that was my hope, that someone could take a look at the encryped text and say "oh, that looks like XXX, try using such-and-such utility...".

Thanks.

[rproffitt]

@Thomas. Wait? I had the feeling all these were your codes. Now that you mention a vendor, time to get back to them.

Once in a while someone wants me to help break code like this. But it's not theirs to break. I supplied a link to the most common method I know of so try that and then back to the vendor.

[Reverend Jim]

Microsoft used to supply a utility program, screnc for encoding scripts. All it did was use the builtin scripting encoding object. The encoding object can be scripted directly as

set fso = CreateObject("Scripting.FileSystemObject")
set enc = CreateObject("Scripting.Encoder")

For each file in Wscript.Arguments

    if fso.FileExists(file) then

        srce = fso.OpenTextFile(file).ReadAll
        dest = enc.EncodeScriptFile(".vbs",srce,0,"VBScript")

        out  = fso.GetBaseName(file) & ".vbe"

        fso.OpenTextFile(out,2,True).Write(dest)

    end if

Next

You use it like

encode myscript.vbs

and it creates myscript.vbe. Because encoded scripts have to be in a form that can be understood by the script engine, the vendor utility would likely just have used the encoding object. Scripts, once encoded, can be decoded but the process is messy. I dug around in my archives and found the following. I don't know where it came from originally but I did a test encode using the above script and it decoded perfectly. Copy the following code into decode.vbs and try running it against your encoded scripts.

Option Explicit

Const BIF_NEWDIALOGSTYLE = &H40
Const BIF_NONEWFOLDERBUTTON = &H200
Const BIF_RETURNONLYFSDIRS = &H1

Const FOR_READING = 1
Const FOR_WRITING = 2

Const TAG_BEGIN1 = "#@~^"
Const TAG_BEGIN2 = "=="
Const TAG_BEGIN2_OFFSET = 10
Const TAG_BEGIN_LEN = 12
Const TAG_END = "==^#~@"
Const TAG_END_LEN = 6

Dim argv
Dim wsoShellApp
Dim oFolder
Dim sFolder
Dim sFileSource
Dim sFileDest
Dim fso
Dim fld
Dim fc
Dim bEncoded
Dim fSource
Dim tsSource
Dim tsDest
Dim iNumExamined
Dim iNumProcessed
Dim iNumSkipped

Function Decode(Chaine)

    Dim se,i,c,j,index,ChaineTemp
    Dim tDecode(127)
    Const Combinaison="1231232332321323132311233213233211323231311231321323112331123132"

    Set se=WSCript.CreateObject("Scripting.Encoder")
    For i=9 to 127
        tDecode(i)="JLA"
    Next
    For i=9 to 127
        ChaineTemp=Mid(se.EncodeScriptFile(".vbs",string(3,i),0,""),13,3)
        For j=1 to 3
            c=Asc(Mid(ChaineTemp,j,1))
            tDecode(c)=Left(tDecode(c),j-1) & chr(i) & Mid(tDecode(c),j+1)
        Next
    Next

    tDecode(42)=Left(tDecode(42),1) & ")" & Right(tDecode(42),1)
    Set se=Nothing

    Chaine=Replace(Replace(Chaine,"@&",chr(10)),"@#",chr(13))
    Chaine=Replace(Replace(Chaine,"@*",">"),"@!","<")
    Chaine=Replace(Chaine,"@$","@")
    index=-1
    For i=1 to Len(Chaine)
        c=asc(Mid(Chaine,i,1))
        If c<128 Then index=index+1
        If (c=9) or ((c>31) and (c<128)) Then
            If (c<>60) and (c<>62) and (c<>64) Then
                Chaine=Left(Chaine,i-1) & Mid(tDecode(c),Mid(Combinaison,(index mod 64)+1,1),1) & Mid(Chaine,i+1)
            End If
        End If
    Next
    Decode=Chaine
End Function

Sub Process (s)
    Dim bProcess
    Dim iTagBeginPos
    Dim iTagEndPos

    iNumExamined = iNumExamined + 1

    iTagBeginPos = Instr(s, TAG_BEGIN1)

    Select Case iTagBeginPos
    Case 0
        MsgBox sFileSource & " does not appear to be encoded.  Missing Beginning Tag.  Skipping file."
        iNumSkipped = iNumSkipped + 1

    Case 1
        If (Instr(iTagBeginPos, s, TAG_BEGIN2) - iTagBeginPos) = TAG_BEGIN2_OFFSET Then
            iTagEndPos = Instr(iTagBeginPos, s, TAG_END)

            If iTagEndPos > 0 Then
                Select Case Mid(s, iTagEndPos + TAG_END_LEN)
                Case "", Chr(0)
                    bProcess = True

                    If fso.FileExists(sFileDest) Then
                        If MsgBox("File """ & sFileDest & """ exists.  Overwrite?", vbYesNo + vbDefaultButton2) <> vbYes Then
                            bProcess = False
                            iNumSkipped = iNumSkipped + 1
                        End If
                    End If

                    If bProcess Then
                        s = Decode(Mid(s, iTagBeginPos + TAG_BEGIN_LEN, iTagEndPos - iTagBeginPos - TAG_BEGIN_LEN - TAG_END_LEN))

                        Set tsDest = fso.CreateTextFile(sFileDest, TRUE, FALSE)
                        tsDest.Write s
                        tsDest.Close
                        Set tsDest = Nothing

                        iNumProcessed = iNumProcessed + 1
                    End If

                Case Else
                    MsgBox sFileSource & " does not appear to be encoded.  Found " & Len(Mid(s, iTagEndPos + TAG_END_LEN)) & " characters AFTER Ending Tag.  Skipping file."
                    iNumSkipped = iNumSkipped + 1
                End Select

            Else
                MsgBox sFileSource & " does not appear to be encoded.  Missing ending Tag.  Skipping file."
                iNumSkipped = iNumSkipped + 1
            End If

        Else
            MsgBox sFileSource & " does not appear to be encoded.  Incomplete Beginning Tag.  Skipping file."
            iNumSkipped = iNumSkipped + 1
        End If

    Case Else
        MsgBox sFileSource & " does not appear to be encoded.  Found " & (iTagBeginPos - 1) & "characters BEFORE Beginning Tag.  Skipping file."
        iNumSkipped = iNumSkipped + 1
    End Select
End Sub

Set argv = WScript.Arguments

sFileSource = ""
sFolder = ""
iNumExamined = 0
iNumProcessed = 0
iNumSkipped = 0

Select Case argv.Count
Case 0
    Set wsoShellApp = WScript.CreateObject("Shell.Application")

    On Error Resume Next
    set oFolder = wsoShellApp.BrowseForFolder (0, "Select a folder containing files to decode", BIF_NEWDIALOGSTYLE + BIF_NONEWFOLDERBUTTON + BIF_RETURNONLYFSDIRS)
    If Err.Number = 0 Then
        If TypeName(oFolder) = "Folder3" Then Set oFolder = oFolder.Items.Item
        sFolder = oFolder.Path
    End If
    On Error GoTo 0

    Set oFolder = Nothing
    Set wsoShellApp = Nothing

    If sFolder = "" Then
        MsgBox "Please pass a full file spec or select a folder containing encoded files"
        WScript.Quit
    End If

Case 1
    sFileSource = argv(0)

    If InStr(sFileSource, "?") > 0 Then
        MsgBox "Pass a full file spec or no arguments (browse for a folder)"
        WScript.Quit
    End If

Case Else
    MsgBox "Pass a full file spec, -?, /?, ?, or no arguments (browse for a folder)"
    WScript.Quit
End Select

Set fso = WScript.CreateObject("Scripting.FileSystemObject")

If sFolder <> "" Then
    On Error Resume Next
    Set fld = fso.GetFolder(sFolder)
    If Err.Number <> 0 Then
        Set fld = Nothing
        Set fso = Nothing
        MsgBox "Folder """ & sFolder & """ is not valid in this context"
        WScript.Quit
    End If
    On Error GoTo 0

    Set fc = fld.Files

    For Each fSource In fc
        sFileSource = fSource.Path

        Select Case LCase(Right(sFileSource, 4))
        Case ".vbe"
            sFileDest = Left(sFileSource, Len(sFileSource) - 1) & "s"
            bEncoded = True

        Case Else
            bEncoded = False
        End Select

        If bEncoded Then
            Set tsSource = fSource.OpenAsTextStream(FOR_READING)
            Process tsSource.ReadAll
            tsSource.Close
            Set tsSource = Nothing
        End If
    Next

    Set fc = Nothing
    Set fld = Nothing

Else
    If Not fso.FileExists(sFileSource) Then
        MsgBox "File """ & sFileSource & """ not found"
    Else
        bEncoded = False

        Select Case LCase(Right(sFileSource, 4))
        Case ".vbe"
            sFileDest = Left(sFileSource, Len(sFileSource) - 1) & "s"
            bEncoded = True
                Case Else
            MsgBox "File """ & sFileSource & """ needs to be of type VBE or JSE"
            bEncoded = False
        End Select

        If bEncoded Then
            Set tsSource = fso.OpenTextFile(sFileSource, FOR_READING)
            Process tsSource.ReadAll
            tsSource.Close
            Set tsSource = Nothing
        End If
    End If
End If

Set fso = Nothing

MsgBox iNumExamined & " Files Examined; " & iNumProcessed & " Files Processed; " & iNumSkipped & " Files Skipped"

[Thomas_32]

The source code files are mine. I'm an independent contractor. The VBS and HTML, written by me, were compiled into a proprierty "plugin packager" supplied by this vendor, which had the side effect of also encrypting the VBS and HTML source. I own the code, but I lost the originals. The plugin dll's are also owned by me.

But in any case, I'm not asking anyone to crack any codes, I'm simply asking Hey, does anyone know what encryption this is? It doesn't look like MD5...

[rproffitt]

@Thomas. Keep in mind that HTML and VBS even encrypted can only be done one way as the browsers must be able to use the codes. For the VBS, you have the common decrypt at the link and from RJ above.

HTML however, encrypted? Try https://sourceforge.net/projects/htmlencrypter/ as it's the only one I've see out there.

But then DLLs? That's a whole 'nuther ballgame. I have yet to find a DLL decryptor since that's compiled code, not encrypted at all and the source will never be reversed from that. I'm not going down that road with you. Not that I don't want to but I don't like tar pits.

[Reverend Jim]

The scripting encoder object can also be used to encode/decode html although I don't know the correct parameters. You could probably find them with a little googling.