WANT TO HIRE PYTHON CRACKER

[5]

I'm looking to hire a cracker to crack a complex python script, I am paying very well, message me to see if you're applicable. Paying very well!

I contacted a regular python developer about it and he was able to extract the exe but was not able to de-compile the pyc files.

If you want to test to see if you can do it:

WINDOWS
VT: https://www.virustotal.com/gui/file/d4dd.../detection
Download: https://anonfiles.com/XcObY6R0oc/Win-Patcher_zip

MAC
VT: https://www.virustotal.com/gui/file/8588.../detection
Download: https://anonfiles.com/reQaY6Reo1/Mac-Patcher_zip

TASKS:

• Remove the text from the top of the terminal
  
• Change it up a bit like you're copying someones project but you still get a similar grade in school
  
• Keep it auto updating, the place I grabbed this from updates it over month or so and the user has no way of stopping the update, I don't know how the system works but even after an update all the changes you made should stay.
  
• Mac & Windows
  

Again I will pay very well if you are able to do this. Message me to hire!

[15]

First of all I'd advise you to post a VT Link of the actual Exe file and not the compressed Zip archive 
I highly advise anyone to only open this on a vm for debugging - well that should be obvious.
Idk if this is a scam, but apparently it is related to aioworld.net ? 

pyarmor protected scripts usually dont get much detection rate, 

pyarmor encrypts the code objects on disk and they are only decrypted at runtime just before they are executed. The entire logic is implemented in _pytransform.dll. There are anti-debugging/timing checks to prevent us from using a debugger to dump code objects from memory. But there's no need to use a debugger at all when CPython itself is open source. 
You could compile Python from source. Modify the _PyEval_EvalFrameDefault function such that it dumps the code object to disk. By doing so we do not need to bother about all the anti-debugging and encrypted stuff. This is because pyarmor decrypts the code object in memory before it hands it to the Python VM for execution. Run strings on the dumped code object. We get many base64 strings.
Base64 decode

the file runs tcp traffic to 46.101.100.57:443
and udp to 46.101.100.57:137
A DigitalOcean hosted domain auth.autodidactbots.xyz 

Related Domains to the IP Adress: 
2020-05-22
aioworld.net
2020-05-21
www.aioworld.net
2019-10-27
www.autodidactbots.xyz
2019-10-27
auth.autodidactbots.xyz
2019-10-27
autodidactbots.xyz
2019-02-04
apikeygen.ml
2018-08-30
resetbotkey.ml
2018-08-19
auth.aintfortnitedood.ml
2018-08-19
aintfortnitedood.ml
2016-08-06
consulting.co.ua

The Ip is also known for CryptoMining - so there you go. 
Hope this helps anyone in some way. 

Best regards, 
akanoraa

[511]

First of all I'd advise you to post a VT Link of the actual Exe file and not the compressed Zip archive 
I highly advise anyone to only open this on a vm for debugging - well that should be obvious.
Idk if this is a scam, but apparently it is related to aioworld.net ? 

pyarmor protected scripts usually dont get much detection rate, 

pyarmor encrypts the code objects on disk and they are only decrypted at runtime just before they are executed. The entire logic is implemented in _pytransform.dll. There are anti-debugging/timing checks to prevent us from using a debugger to dump code objects from memory. But there's no need to use a debugger at all when CPython itself is open source. 
You could compile Python from source. Modify the _PyEval_EvalFrameDefault function such that it dumps the code object to disk. By doing so we do not need to bother about all the anti-debugging and encrypted stuff. This is because pyarmor decrypts the code object in memory before it hands it to the Python VM for execution. Run strings on the dumped code object. We get many base64 strings.
Base64 decode

the file runs tcp traffic to 46.101.100.57:443
and udp to 46.101.100.57:137
A DigitalOcean hosted domain auth.autodidactbots.xyz 

Related Domains to the IP Adress: 
2020-05-22
aioworld.net
2020-05-21
www.aioworld.net
2019-10-27
www.autodidactbots.xyz
2019-10-27
auth.autodidactbots.xyz
2019-10-27
autodidactbots.xyz
2019-02-04
apikeygen.ml
2018-08-30
resetbotkey.ml
2018-08-19
auth.aintfortnitedood.ml
2018-08-19
aintfortnitedood.ml
2016-08-06
consulting.co.ua

The Ip is also known for CryptoMining - so there you go. 
Hope this helps anyone in some way. 

Best regards, 
akanoraa

1. Pyarmor gets more detections then normal pyinstaller files due to misuse
2. You can get past there anti-debugger tricks, dumping via the pytransform method is better like you mentioned.

[5]

 

 

First of all I'd advise you to post a VT Link of the actual Exe file and not the compressed Zip archive 
I highly advise anyone to only open this on a vm for debugging - well that should be obvious.
Idk if this is a scam, but apparently it is related to aioworld.net ? 

pyarmor protected scripts usually dont get much detection rate, 

pyarmor encrypts the code objects on disk and they are only decrypted at runtime just before they are executed. The entire logic is implemented in _pytransform.dll. There are anti-debugging/timing checks to prevent us from using a debugger to dump code objects from memory. But there's no need to use a debugger at all when CPython itself is open source. 
You could compile Python from source. Modify the _PyEval_EvalFrameDefault function such that it dumps the code object to disk. By doing so we do not need to bother about all the anti-debugging and encrypted stuff. This is because pyarmor decrypts the code object in memory before it hands it to the Python VM for execution. Run strings on the dumped code object. We get many base64 strings.
Base64 decode

the file runs tcp traffic to 46.101.100.57:443
and udp to 46.101.100.57:137
A DigitalOcean hosted domain auth.autodidactbots.xyz 

Related Domains to the IP Adress: 
2020-05-22
aioworld.net
2020-05-21
www.aioworld.net
2019-10-27
www.autodidactbots.xyz
2019-10-27
auth.autodidactbots.xyz
2019-10-27
autodidactbots.xyz
2019-02-04
apikeygen.ml
2018-08-30
resetbotkey.ml
2018-08-19
auth.aintfortnitedood.ml
2018-08-19
aintfortnitedood.ml
2016-08-06
consulting.co.ua

The Ip is also known for CryptoMining - so there you go. 
Hope this helps anyone in some way. 

Best regards, 
akanoraa

Sorry that was my first time using VT, new links are below. AIO-world is a limited edition software cracking service and I wanted to crack their cracking software, I have no intent of scamming someone of their work if they are hired by me.

The info you found was very interesting so thanks for sharing and doing some digging, I had no clue this was in some way related to CryptoMining.

I don't think I mentioned this before but I am CUSTOMER of Aio-world and I would like to reproduce their software for myself unbranded. 

I have no clue what you are talking about in the pyarmor section, but are you able to crack this? 
WINDOWS:
VT: https://www.virustotal.com/gui/file/9819.../detection

MAC:
VT: https://www.virustotal.com/gui/file/a9dc.../detection

[15]

I propably did it! Discord: akanoraa#0001