# luac.mtasa.com decrypter (needs netc.dll and correct offset) # netc.dll 1.5.4 and pthread.dll must reside in the same folder of quickbms.exe # Information: https://zenhax.com/viewtopic.php?p=25631#p25631 quickbmsver "0.10" open FDSE "netc.dll" 1 EXISTS if EXISTS == 0 open "." "netc.dll" 1 EXISTS endif if EXISTS == 0 print "Error: netc.dll and pthread.dll must reside in the same folder of quickbms.exe" cleanexit endif findloc DeobfuscateScript binary "\x55\x8B\xEC\xFF\x75\x18\xFF\x75\x14\xFF\x75\x10\xFF\x75\x0C\xFF\x75\x08\xE8" 1 math DeobfuscateScript + 0xc00 print "DeobfuscateScript %DeobfuscateScript|x%" get SIZE asize log MEMORY_FILE 0 SIZE get NAME filename math RET_BUFF = 0 math RET_SIZE = 0 calldll "pthread.dll" 0 "imagebase" # let's avoid the DLL warning about the missing pthread.dll (older quickbms do not handle it) calldll "netc.dll" DeobfuscateScript "__stdcall" RET MEMORY_FILE SIZE &RET_BUFF &RET_SIZE NAME math RET & 0xff if RET == 0 print "Error: DeobfuscateScript failed" cleanexit endif set MEMORY_FILE10 string " void memcpy(unsigned char *out, unsigned char *in, int size) { for(int i = 0; i < size; i++) out[i] = in[i]; }" log MEMORY_FILE 0 0 putvarchr MEMORY_FILE RET_SIZE 0 calldll MEMORY_FILE10 "memcpy" "tcc" "" MEMORY_FILE RET_BUFF RET_SIZE get NAME basename get EXT extension string NAME + "_decrypt." string NAME + EXT log NAME 0 RET_SIZE MEMORY_FILE