sh4dowb

# I absolutely hated crypto-js for this. non-standard configurations, weird algorithms, ...
# well obviously you can encrypt it with a better configuration which people will not
# go crazy figuring out its implementation, but in this case I wasn't encrypting the data.

import base64
from Crypto.Hash import MD5
from Crypto.Util.Padding import unpad
from Crypto.Cipher import AES

# generated using: CryptoJS.AES.encrypt('test 123456 plaintext', 'some password').toString()

sh4dowb

import json
import base64
import hashlib
import zipfile
import sys

BRANCH_FACTOR = 128
BLOCK_SIZE = 4096
DIGEST_SIZE = 32

sh4dowb

import http.server
import requests
import json

class Proxy(http.server.BaseHTTPRequestHandler):
    def do_POST(self):
        data = self.rfile.read(int(self.headers['Content-Length'])).decode('utf-8')
        decodedData = json.loads(data)
        newheaders = {}
        for k, v in self.headers.items():

sh4dowb

from websockets.sync.client import connect
import json

addresses = [] # base58 address/account/pubkey list
with connect('wss://solana-rpc.publicnode.com') as ws:
    i = 0
    for address in addresses:
        i += 1
        msg = json.dumps({"jsonrpc": "2.0", "id": i, "method": "logsSubscribe", "params": [{"mentions": [address]}, {"commitment": "finalized"}]})
        # subscribes to solana transactions. token transfers will mention the associated token addresses instead of owner address, so it's not picked up by this filter

sh4dowb

import hmac
import hashlib

def getLimboOutcome(server, client, nonce):
        server = server.encode()
        client = client.encode()
        nonce = str(nonce).encode()
        round = 0
        hash = hmac.new(server, client+b':'+nonce+b':'+str(round).encode('utf-8'), hashlib.sha256).digest()
        first4 = hash[:4]

sh4dowb

import time
from tronapi import Tron

full_node = 'https://api.trongrid.io'
solidity_node = 'https://api.trongrid.io'
event_server = 'https://api.trongrid.io'

pkey = "private_key_hex"

payments = [

sh4dowb

<?php
// V1.0.7 DEOBFUSCATOR: https://gist.github.com/sh4dowb/68c9e090a3006b1d19ce49a22529c0a5

// put encrypted code in encrypted.php, or use it like:
// $ php phpkoru-deobfuscate-2.php encryptedfilename.php

// for decrypting advanced version contact me on telegram

function decrypt($fn, $try=0){
    $onfr64_qrpbqr = 'base64_decode';

sh4dowb

[
  {
    "city": "Adana",
    "plate_code": 1,
    "counties": [
      "Aladağ",
      "Ceyhan",
      "Çukurova",
      "Feke",
      "İmamoğlu",

sh4dowb

<?php
// put encrypted code in encrypted.php, or use it like:
// $ php phpkoru-deobfuscate-3.php encryptedfilename.php
// UPDATED v1.0.7 , if you are getting error "IV passed is only 15 bytes long", try this

// for decrypting advanced (.dll/.so) version contact me on telegram

function trydecrypt($fn, $b64='fge_ebg13‎‎‎‎', $rot13='bcraffy_qrpelcg‎'){
    eval('$'.$b64.'="base64_decode";');
    eval('$'.$rot13.'="str_rot13";');

sh4dowb

#   Selenium does not use the given profile, but copies it, and uses a temporary profile.
#   As a result, new cookies and sessions etc. are not saved.
#   To fix it, we get the actual profile firefox is using, kill firefox manually so geckodriver
#   doesn't delete profile data. Copying the profile when it's being used is generally not a good idea.
#   After killing firefox profile and databases are unlocked, we copy the "temporary" profile
#   to our old profile.
#
#   driver.profile doesn't provide the actual temporary profile, but another copy of it. And firefox
#   does not use that one. that's why I got it from process list.
#