Author Topic: Sybase db 'simple encryption' deciphering?  (Read 4238 times)

0 Members and 1 Guest are viewing this topic.

Offline vector_

  • NULL
  • Posts: 2
  • Cookies: 0
    • View Profile
Sybase db 'simple encryption' deciphering?
« on: December 16, 2012, 02:20:43 pm »
Hello,
need to decipher Sybase db obfuscated with 'simple encryption', downloaded script and other files are accesible but obfuscated, database is not operational (no access).
know that:
2. obfuscation key is inside db, generated once upon db creation.
3.obfusc. is activated with func set hidden, which in official dox says is 'irreversible'

Any ideas or suggestions how to proceed?
Is there a possibility to find where key or algoritm to obfuscation is inside
sybase files?

Cheers,
vector_

Offline Kulverstukas

  • Administrator
  • Zeus
  • *
  • Posts: 6627
  • Cookies: 542
  • Fascist dictator
    • View Profile
    • My blog
Re: Sybase db 'simple encryption' deciphering?
« Reply #1 on: December 16, 2012, 03:32:45 pm »
Care to elaborate more about the encryption? "Simple encryption" tells us absolutely nothing.
Also if we could see the scripts and the database that would help a lot.
Plus if you have a script, and say that the DB is generated then why not look at the script code and see what it does?

Offline vector_

  • NULL
  • Posts: 2
  • Cookies: 0
    • View Profile
Re: Sybase db 'simple encryption' deciphering?
« Reply #2 on: December 19, 2012, 08:03:48 am »
the problem is, only source of expalnation what 'simple encryption' is is sybase official dox, and they say almost nothing, just that simple encryption = obfuscation, so it is not encryption, just some internal sybase/sql script or procedure that runs under command 'set hidden'.
Now were this script/procedure is located and under what algorithm it works is the question, no luck with google on this one.
All code / scripts / data I see in db is obfuscated, here is sample of procedure:

hidden '(((((**($)()((($())(((())$()(()(b5!x$!@@5=b!$!5!@S%b5=b(0=0xm%$x($)((()(($)(*)(&*)$(($()()))(*()$!@xbb#=5$W%(@@=!S@b!x@%($!#!5m%((($)(&&*)$(($$%%$)((($()((**)$((@@=0xm!!@bWx5W0$%m%(@@=!.!%@bWx(()()$))(*((((**)$)())()!!$$%%$)5W0$%%S*5!b!m$W@=0xm%$@xbb@0x5bW((((**)$()((((($$!!(((((!!$$%$)(x5W!%%S*5!#%(S*@@$!bmx5!@@=0xm%$*((((**)$)()$$!!%$%$)((()()$))(*@xbb@0x5bWx5W!%.S*@@b!$@@=0xm%$@$)(((()$)))()($(($$!!%$&***$%))(xbbS#$5!!#.S*@@%0@!W%b$bWb!m!b$@)$(((*()()))()*)(($)()((($(()($%x@05=S@S%b5=b(!S@=@xbb#=5$=$!0@#($)(*)(&*)$%$)()*)(($$$$$$!!()((W!5!S*@@@@@@!S@=b!x@S@@=!S@b!x@x)(&&*)$())*)(($****&&&$$$$$$!!((($S*@@@@@@$!b5%@$W!S@=@#$m@=!.!%((**)$)()$$$$!!((()$$()((**)$%$$%@S@@=0xm!!%@$W!(S*@@@@b!$@@=0xm(()$$!!%(($((($$!!$&*&&&$%))(*((%$@xbbS#0xmb!#S*@@!($@%0.S*@@b!m(((!!))(*((((**)$)((!b$@@=0xm%$@xbbS*!($'


Offline Kulverstukas

  • Administrator
  • Zeus
  • *
  • Posts: 6627
  • Cookies: 542
  • Fascist dictator
    • View Profile
    • My blog
Re: Sybase db 'simple encryption' deciphering?
« Reply #3 on: December 19, 2012, 08:22:44 am »
well no script (except brainfuck) could run in that format, so there has to be some decryption function at some point.
All that obfuscation is nothing I seen before.