How to decrypt a pcode?

Hi,

Is there an experienced MATLAB user to provide me with some info on how to decrypt a given pcode?

P.S: It seems that I have to use a pcode version of my original code. Actually, I heard from an old MATLAB user that there are some ways to decrypt a pcode. (to obtain the original code) Of course, by advanced user (hackers :-O ) not newbies!!

Thanks

[Walter Roberson]

I am *not* old -- I am merely chronologically cumulative!

[math98]

:))

Dear Walter, I didn't mean you. Actually, I heard that from another guy.

but, I meant someone like you by "experienced user". and I'm waiting to see your answer. (of course, if possible)

Answer 1

[Jan]

No, there is no decoding method for P-coded functions.

You can use the debugger to step through the code line by line, inspect changes to variables and get a list of called functions. But you cannot get the source code as clear text. And most likely: You are explicitly not wanted to! A decompilation or reverse-engineering of a program usually conflicts with the license conditions and is illegal.

[EDITED] This thread seems to show, that P-coding is less cryptic than I thought: http://www.mathworks.com/matlabcentral/answers/75012-pcode-obfuscation-cracked-alternatives

[EDITED 2] Modern Matlab versions prevent the debugging of P-files.

[math98]

Jan,

you're right, I don't want.

but, why should an old user say this? (of course, hacking everything nowadays, I believed his words)

what do you mean by "the debugger"?

on the other hand, there must be an algorithm that MATLAB uses to decode its own generated p-code, mustn't there?!

[Jan]

"The debugger" means Matlab's debugger, which is controlled by the break points and the commands DBSTOP, DBUP, DBDOWN, etc.

The P-files of Matlab 6 have been encryted less efficiently than the modern version. But even a decryption will not create a clear text source code: Matlab parses and compiles the M-files after reading into the memory. Starting an M-file the first time needs much more time than starting a P-coded file. Therefore I assume, that the P-code contains the pre-parsed contents.

[math98]

Jan,

thank for the reply.

but could you please tell me how it's possible to debug a pfile? MATLAB documents show that the debugger is accessible just for mfiles.

[Jan]

@math98: Matlab has some undocumented features. I'd go into details, if I see a legal demand. Some general remarks about the security of P-files: http://www.mathworks.com/matlabcentral/newsreader/view_thread/284802 , http://www.mathworks.com/matlabcentral/newsreader/view_thread/271697

[wonderkismet]

Click to Send Request for pcode Recovery [link removed]

Answer 2

[ou dk]

in fact ,i can decrypt all type code,include standalone program,p code,other language compiled matlab program.

[Hemangi]

Can you explain how to decrypt p code?

[Walter Roberson]

I would tend to doubt that ou dk can succeed at what they claim. Perhaps a subset of it.

[ou dk]

1)i can decrypt all newer but before version pcode 3.1(7.5)，in fact i am just have no time to study an old version. 2)all people doubt they cannot do.

[ou dk]

btw:someone had googled my article about how to decrpt matlab,they send email to me request to decrpy,too much email so i delete the article.

[Walter Roberson]

I can't do a perpetual motion machine either, and my inability has certainly not prevented a large number of people from claiming that they have created a perpetual motion machine.

[ou dk]

someone can paste p code file's hex string here,i will show your source code.

[Bruno Luong]

Here we go, I create this hexa code like this (MATLAB R2020a)

pcode testpcodehack.m
fid=fopen('testpcodehack.p','rb')
a=fread(fid,Inf,'*uint8')
fclose(fid)
fprintf([repmat('%02X',1,16) '\n'],a)

Print on screen:

7630312E30307630302E30300006C01C
241B5FB1000001FB00000272000003C4
25B190F393EF65B6BD54C6F0E0435987
5A00B963D3E4B8D1A03CBEE13AE1089D
669122A049218D6BDD40FD1C0A947DF8
AEB8EB3BB16726E70BE74BA4B8AD950D
A0D181C6FAA240E3AD7A01389869AF84
0B6ED75477816A332C4B5501CB5636F2
3A64F7B85478368505C53432B2E4991B
62AE9E5378D7F3E91A75992F11A20727
0896935497A8DCA51AA5F89ADA3F2E35
2C432F4968DB2371FE53FD51038A6BBD
EBB11F7F0D90A1043D5DC1EBB7AB7D32
AE97C4C39CB197DDDEFF28D8D1604493
8800A1409C16E2283711E4E2897CE5CC
864DA8E0E5ECBD7BC6D95EB845CD7AC0
5C8A24A3289CE3E43AAB1E6AC6DFD037
F962AE0F0560445393905CA5DF804491
D051897E4F512E07818DE8F19A3ABB16
732E3B450E5342D37FF5C2D232D041DF
113F5FF5BB6DA202CD74A6945EDF7868
754588C9976602F8FF85C96BEE1892D5
683EF6E8C5FCE20922AA420B1180F8FF
17AE829DDEC7FAA3E7159D169E0E5D1C
5491C4168175C1056763B154245C783D
57962925F3ED7A9B68A7B603DE03865D
2E75EE79BF3107B1D1C6571EFBDA3A79
D38EB7E658BE5DF3AD00CC70A5B32A1B
F5075945F13AE01E31C8135B10353A2D
E414163D33A566641DA1E8AFFB8CF286
B8726D3B9EED0C5C63BF9176E5CE8D52
A29B2106BF8FA6D09DB5A50C8CB2A01F
7929F2B11F937A1B568932733ED1652B
CB913F90C506A805933951E8819668E1
553D210489E1E6A04CAA4B8B4F0A1B14
A0F224D144E8270D0E5F990B57E9F95F
8900B6C547D25F0314264398B7522F42
A0A7EE0FD92E8D93D2045FC97C78B1B7
9895ECACF246B4D49A4EBFA21412D9B2
E0CD7C666354E9CD9824F9D1C2220AF7
BCFCCB93AFE4B7FB13C42C303FD63CB3
623A

The same pcode is attached in enclosed zipfile. Are you able to show us the content of the corrsesponding m-code? Thanks.

[ou dk]

function r = testpcodehack(maxC)


assert(nargin == 1 && isscalar(maxC)&& maxC >= 0 && mod(maxC , 1)== 0 , 'error calling');

EL = struct('a' , 148 , 'b' , 225 , 'p' , 5003);


G = [ 1355 , 2421 ] ;


maxk = nextpow2(maxC);
CG = zeros(maxC , 2);
j = 1 ;
CG(j , :)= G ;
G2k = G ;

p = EL.p ;
itab = p_inverse(1 : p - 1 , p);
for k = 1 : maxk
    for i = 1 : j - 1
        j = j + 1 ;
        CG(j , :)= EL_add(G2k , CG(i , :), EL , itab);
        if j == maxC
            break
        end
    end
    if j == maxC
        break
    end
    G2k = EL_add(G2k , G2k , EL , itab);
    j = j + 1 ;
    CG(j , :)= G2k ;
end
r = CG(end , :);
end

function ia = p_inverse(a , p)
[ ~, ia ] = gcd(a , p);
end
function R = EL_add(P , Q , EL , itab)









if ELiszero(P)
    R = Q ;
elseif ELiszero(Q)
    R = P ;
else
    p = EL.p ;
    xp = P(1);
    yp = P(2);
    xq = Q(1);
    yq = Q(2);
    d = xq - xp ;
    if d ~= 0
        n = yq - yp ;
    else
        if yp == yq
            d = 2 * yp ;
            n = 3 * xp * xp + EL.a ;
        else
            R = [ Inf , Inf ] ;
            return
        end
    end
    invd = itab(mod(d , p)) ;
    lambda = mod(n * invd , p);
    xr = lambda * lambda - xp - xq ;
    yr = lambda *(xp - xr)- yp ;
    R = mod([ xr , yr ] , p);
end
end
function b = ELiszero(P)

b = any(~isfinite(P)) ;
end

[Bruno Luong]

Excellent!!!

This shows that pcode is far from being safe. That's what I learn.

[ou dk]

No, I think P code is safe enough in general, because the average application is not going to be a target, of course, security is always relative, keep this in mind.

[ou dk]

I don't think MathWorks is wrong with the choice, for example, m code processing is actually AES encryption and a compression algorithm, P-CODE is basically a compression algorithm, and then interpretation execution, so that efficiency will improve, if too much consideration of security, it will make the already inefficient MATLAB slow as a snail.

I write code, always spend time on security and efficiency, there is always a balance between the two.

[Roger Valdivia Salazar]

Hey ou dk, can you share with me that article you talked about above? Thank you so much

Answer 3

[Meme Young]

Oh man you have really asked a good question, like claiming yourself to be a bank robber in front of a police department

[ou dk]

Sorry, I didn't ask a question, I just answered the question, and I think you might have a spelling mistake, not robber but Robin Hood. Because I don't make money.

[Rik]

@ou dk: Guilty conscience? This answer is also applicable to the question itself. And doing illegal things for free (or for the greater good of a community) doesn't make those things less illegal.

You could argue about the question if the service you claim to provide is indeed for the greater good, but since you aren't even actually providing that service the discussion is moot.

[ou dk]

moot discussion? no, I can do it differently from what I want to do, at least to remind users that these methods are not as safe as claimed.

You can refer to my last answer to Bruno Luong,P file recovery is accurate for line breaks and carriage returns.

Indeed, I will never open up services to the public.

[Rik]

Comment posted as flag by Meme Young:

Ok Robin can you recover some p codes?

[ou dk]

A small number of files are available, but you can't use them for profit.

Answer 4

[Fangjun Jiang]

I thought the Mathworks could do it. But they won't do it. After all, it is put in place to protect many of its source code (part of the reason, I believe). It can be used to protect the user's customer-developed source code too, which is what I like. Hacking is possible, technically. If you find a way, please let me know.

[math98]

thanks, but I really didn't understand your comment!

[Jan]

@Jiang (sorry, is this your first name?): Of course you can hack anything which is in the memory. And I can steal the windshield wipers of all cars, because they are not secured. In both cases the owners will dislike your work and the global level of distrust will be increased. Therefore I respond:

If you find a way, do not do it and especially do not publish it here.

[Fangjun Jiang]

I am not encouraging doing anything illegal. I am merely saying, hey, take the challenge if you want to. Someone hacks for profit. Others hack for fame.

[Sean de Wolski]

http://www.cnn.com/2011/WORLD/europe/06/21/uk.sony.hack.arrest/index.html?hpt=hp_t2

I don't think he'll be lulz so hard when looking at 20+ years in jail...

[Fangjun Jiang]

@Jan: Jan, I think you missed my point. I already said that the encryption was put in place on purpose to protect intellectual property, which is what I like. I meant to say that hacking P-code is possible but probably very difficult. I probably had a smirk on my face when I say "hey, if you find a way, please let me know!". I didn't know hacking P-code is not a real challenge and I still believe it is going to be very hard. Are you afraid that math98 will take my word for it and go cracking the encryption? He said he "heard from an old MATLAB user that there are some ways to decrypt a pcode". Is that "old MATLAB user" referring to you? Walter didn't want to take that credit.

[Jan]

@Jiang: Ok, I haven't seen the smirk on your face.

math98 is interested in protecting his own sources and needs an estimation if P-coding is reliable. I've examined the P-format for the same reason and was not convinced by the protection level of old Matlab 6 P-files. But the modern P-format uses a strong encryption and a surprisingly good compression: the P-files are up to 20% smaller than the LZMA/7zip compressed (comment-free) M-files. Anyhow, I'm not the old user math98 mentioned.

[Fangjun Jiang]

All right! BTW, I misunderstood Walter's comment. He did take credit for being that MATLAB user. He just didn't want to admit that he is old.

[Yair Altman]

@Jan - I have just seen this thread and I must say that I take offense at being labeled a cracker or hacker. For the record, and you can quote me on this, none of what I do or publish is illegal, to the best of my knowledge and intentions. I am very careful about this. My livelihood depends on Matlab to a large extent and I will not cut the branch I'm sitting on.

[Jan]

@Yair: Sorry. I did not meant the term "hacking" in any offending way and I'm definitely convinced from all I've seen and heared in the last years, that your work is legal and helpful for Matlab users and in consequence for TMW. I'm used to distinguish the illegal "cracking" from the legal "hacking", which means digging in the codes for the not barely obvious features. If any of your investigations and publications of the golden beans you've found is not legal -what is not the case!-, I'd strongly recommend that you get payed by TMW to catch up a legalization retrospectively.

Anyhow, Yair, I've deleted the concerning comment, because I know that the term "hacking" might be misunderstood.

Answer 5

[jgd0008]

I know it´s an old subject. This guy had an utility running on the web. I used a couple of times, had some minor flaws. However, it´s been asked to be taken down.

web-service.sippey.org/de_pcode

So, it´s possible