How to decrypt a pcode?

Hi,

Is there an experienced MATLAB user to provide me with some info on how to decrypt a given pcode?

P.S: It seems that I have to use a pcode version of my original code. Actually, I heard from an old MATLAB user that there are some ways to decrypt a pcode. (to obtain the original code) Of course, by advanced user (hackers :-O ) not newbies!!

Thanks

[Walter Roberson]

I am *not* old -- I am merely chronologically cumulative!

[math98]

:))

Dear Walter, I didn't mean you. Actually, I heard that from another guy.

but, I meant someone like you by "experienced user". and I'm waiting to see your answer. (of course, if possible)

[Rik]

@David regarding your flag ("This post discusses decryption which goes against the community terms of use"):

Where exactly does it prohibit this? 2.a.v.b prohibits posting anything that violates any law and 2.a.vi specifically mentions export control laws. The prohibition on discussions about cryptography is generally understood to only apply to actual code/algorithms, not to pure informational content.

The way I read this thread, the original question was if there are ways to decrypt p-code. The answer is 'yes, but not in a legal way'. No actual discussions of how p-code encryption works has taken place. In fact, Mathworks provides more details in the documentation than can be found on this page.

It is your own website and you can enforce any rule you like, but I don't see how this violates the terms of use.

[Fangjun Jiang]

I second to that. Users are going to ask this question anyway. This Q&A provides good and useful info.

[Yousif]

Sorry, i am not asking for dycripting a pcode, i am asking of how to make and run a pcoded script ? it was a language problem.

[Walter Roberson]

@Yousif

pcode FILENAME

removes any .m suffix from FILENAME and produces FILENAME.p output.

After that, the source code FILENAME.m can be removed (perhaps put in a different directory) and the MATLAB code will continue to work using FILENAME.p .

If there is both a FILENAME.p and FILENAME.m then the .p version will be used, but FILENAME. will be consulted for the purposes of the help command -- so you can create FILENAME.m with just the help documentation and FILENAME.p with the encoded executable and the .p will be executed but the .m will be used for help purposes.

Answer 1

[Jan]

No, there is no decoding method for P-coded functions.

You can use the debugger to step through the code line by line, inspect changes to variables and get a list of called functions. But you cannot get the source code as clear text. And most likely: You are explicitly not wanted to! A decompilation or reverse-engineering of a program usually conflicts with the license conditions and is illegal.

[EDITED] This thread seems to show, that P-coding is less cryptic than I thought: http://www.mathworks.com/matlabcentral/answers/75012-pcode-obfuscation-cracked-alternatives

[EDITED 2] Modern Matlab versions prevent the debugging of P-files.

[math98]

Jan,

you're right, I don't want.

but, why should an old user say this? (of course, hacking everything nowadays, I believed his words)

what do you mean by "the debugger"?

on the other hand, there must be an algorithm that MATLAB uses to decode its own generated p-code, mustn't there?!

[Jan]

"The debugger" means Matlab's debugger, which is controlled by the break points and the commands DBSTOP, DBUP, DBDOWN, etc.

The P-files of Matlab 6 have been encryted less efficiently than the modern version. But even a decryption will not create a clear text source code: Matlab parses and compiles the M-files after reading into the memory. Starting an M-file the first time needs much more time than starting a P-coded file. Therefore I assume, that the P-code contains the pre-parsed contents.

[math98]

Jan,

thank for the reply.

but could you please tell me how it's possible to debug a pfile? MATLAB documents show that the debugger is accessible just for mfiles.

[Jan]

@math98: Matlab has some undocumented features. I'd go into details, if I see a legal demand. Some general remarks about the security of P-files: http://www.mathworks.com/matlabcentral/newsreader/view_thread/284802 , http://www.mathworks.com/matlabcentral/newsreader/view_thread/271697

[wonderkismet]

Click to Send Request for pcode Recovery [link removed]

Answer 2

[ou dk]

in fact ,i can decrypt all type code,include standalone program,p code,other language compiled matlab program.

[Hemangi]

Can you explain how to decrypt p code?

[Walter Roberson]

I would tend to doubt that ou dk can succeed at what they claim. Perhaps a subset of it.

[ou dk]

1)i can decrypt all newer but before version pcode 3.1(7.5)，in fact i am just have no time to study an old version. 2)all people doubt they cannot do.

[ou dk]

btw:someone had googled my article about how to decrpt matlab,they send email to me request to decrpy,too much email so i delete the article.

[Walter Roberson]

I can't do a perpetual motion machine either, and my inability has certainly not prevented a large number of people from claiming that they have created a perpetual motion machine.

[ou dk]

someone can paste p code file's hex string here,i will show your source code.

[Bruno Luong]

Here we go, I create this hexa code like this (MATLAB R2020a)

pcode testpcodehack.m
fid=fopen('testpcodehack.p','rb')
a=fread(fid,Inf,'*uint8')
fclose(fid)
fprintf([repmat('%02X',1,16) '\n'],a)

Print on screen:

7630312E30307630302E30300006C01C
241B5FB1000001FB00000272000003C4
25B190F393EF65B6BD54C6F0E0435987
5A00B963D3E4B8D1A03CBEE13AE1089D
669122A049218D6BDD40FD1C0A947DF8
AEB8EB3BB16726E70BE74BA4B8AD950D
A0D181C6FAA240E3AD7A01389869AF84
0B6ED75477816A332C4B5501CB5636F2
3A64F7B85478368505C53432B2E4991B
62AE9E5378D7F3E91A75992F11A20727
0896935497A8DCA51AA5F89ADA3F2E35
2C432F4968DB2371FE53FD51038A6BBD
EBB11F7F0D90A1043D5DC1EBB7AB7D32
AE97C4C39CB197DDDEFF28D8D1604493
8800A1409C16E2283711E4E2897CE5CC
864DA8E0E5ECBD7BC6D95EB845CD7AC0
5C8A24A3289CE3E43AAB1E6AC6DFD037
F962AE0F0560445393905CA5DF804491
D051897E4F512E07818DE8F19A3ABB16
732E3B450E5342D37FF5C2D232D041DF
113F5FF5BB6DA202CD74A6945EDF7868
754588C9976602F8FF85C96BEE1892D5
683EF6E8C5FCE20922AA420B1180F8FF
17AE829DDEC7FAA3E7159D169E0E5D1C
5491C4168175C1056763B154245C783D
57962925F3ED7A9B68A7B603DE03865D
2E75EE79BF3107B1D1C6571EFBDA3A79
D38EB7E658BE5DF3AD00CC70A5B32A1B
F5075945F13AE01E31C8135B10353A2D
E414163D33A566641DA1E8AFFB8CF286
B8726D3B9EED0C5C63BF9176E5CE8D52
A29B2106BF8FA6D09DB5A50C8CB2A01F
7929F2B11F937A1B568932733ED1652B
CB913F90C506A805933951E8819668E1
553D210489E1E6A04CAA4B8B4F0A1B14
A0F224D144E8270D0E5F990B57E9F95F
8900B6C547D25F0314264398B7522F42
A0A7EE0FD92E8D93D2045FC97C78B1B7
9895ECACF246B4D49A4EBFA21412D9B2
E0CD7C666354E9CD9824F9D1C2220AF7
BCFCCB93AFE4B7FB13C42C303FD63CB3
623A

The same pcode is attached in enclosed zipfile. Are you able to show us the content of the corrsesponding m-code? Thanks.

[ou dk]

function r = testpcodehack(maxC)


assert(nargin == 1 && isscalar(maxC)&& maxC >= 0 && mod(maxC , 1)== 0 , 'error calling');

EL = struct('a' , 148 , 'b' , 225 , 'p' , 5003);


G = [ 1355 , 2421 ] ;


maxk = nextpow2(maxC);
CG = zeros(maxC , 2);
j = 1 ;
CG(j , :)= G ;
G2k = G ;

p = EL.p ;
itab = p_inverse(1 : p - 1 , p);
for k = 1 : maxk
    for i = 1 : j - 1
        j = j + 1 ;
        CG(j , :)= EL_add(G2k , CG(i , :), EL , itab);
        if j == maxC
            break
        end
    end
    if j == maxC
        break
    end
    G2k = EL_add(G2k , G2k , EL , itab);
    j = j + 1 ;
    CG(j , :)= G2k ;
end
r = CG(end , :);
end

function ia = p_inverse(a , p)
[ ~, ia ] = gcd(a , p);
end
function R = EL_add(P , Q , EL , itab)









if ELiszero(P)
    R = Q ;
elseif ELiszero(Q)
    R = P ;
else
    p = EL.p ;
    xp = P(1);
    yp = P(2);
    xq = Q(1);
    yq = Q(2);
    d = xq - xp ;
    if d ~= 0
        n = yq - yp ;
    else
        if yp == yq
            d = 2 * yp ;
            n = 3 * xp * xp + EL.a ;
        else
            R = [ Inf , Inf ] ;
            return
        end
    end
    invd = itab(mod(d , p)) ;
    lambda = mod(n * invd , p);
    xr = lambda * lambda - xp - xq ;
    yr = lambda *(xp - xr)- yp ;
    R = mod([ xr , yr ] , p);
end
end
function b = ELiszero(P)

b = any(~isfinite(P)) ;
end

[Bruno Luong]

Excellent!!!

This shows that pcode is far from being safe. That's what I learn.

[ou dk]

No, I think P code is safe enough in general, because the average application is not going to be a target, of course, security is always relative, keep this in mind.

[ou dk]

I don't think MathWorks is wrong with the choice, for example, m code processing is actually AES encryption and a compression algorithm, P-CODE is basically a compression algorithm, and then interpretation execution, so that efficiency will improve, if too much consideration of security, it will make the already inefficient MATLAB slow as a snail.

I write code, always spend time on security and efficiency, there is always a balance between the two.

[Roger Valdivia Salazar]

Hey ou dk, can you share with me that article you talked about above? Thank you so much

[赵俊涛 赵]

Are you able to show me the content of the corrsesponding m-code? Thanks ,my research needs this.Thank you very much.

[Walter Roberson]

赵俊涛 赵 :

is your research into whether .p files can be decoded? If so then the answer is Yes, they can be, and the method of doing so would be for you to research.

If your research is into the code that was in the file you attached, then you should get the original code from the author. If the author did not provide the original code, then the author did not want you to have the original code.

[ou dk]

right

[Hoseyn Amiri]

@ou dk please share the code to me thanks man..

[]@gmail.com

[Walter Roberson]

ou dk has proven that they can decode pcode. No further demonstration is necessary.

People who have pcode that they need decoded: remember that if you do not have permission from the person who created the pcode, then you cannot decode it because the person did not want it decoded.

Depending on the country you are in, it may be literally illegal to circument a security protection unless you are a considered a security researcher. There was a famous court case in which ROT13 was considered to be enough security protection to invoke the relevant law: that is, as far as the laws of that jurisdiction were concerned, the question was not how difficult it was to break the security, but rather whether the person creating the code made any attempt to secure the code.

[ou dk]

so，sorry for need share code's people (^_^)

[Johannes Korsawe]

ou dk, you have proven excellency here. Could you comment on the usage of protected models (slxp)?

• plain usage
• use with password
• use with password and custom obfuscator

thanks in advance.

[Walter Roberson]

@zhao Stone

NO. If you have the source code, then look at the source code. If you do not have the source code, get the source code from the author. If the author chooses not to make the source code available, then you are not intended to have the source code.

[Walter Roberson]

@ÁLVARO SÁNCHEZ HERNÁNDEZ

@ou dk already proved sufficiently well that they are able to decode older-style .p files (the encoding algorithm changed recently.) There is no need for further challenges to prove they can do it.

If you have a .p file that you did not create, then contact the author / publisher of the code. The fact that someone created a .p file is proof that they do not want the file to be decoded.

In the USA, decoding encrypted files is outright illegal under many circumstances (there are narrow exceptions.)

[Julian Hapke]

I need proof that @ou dk and @Bruno Luong are neither the same person nor have contact outside this platform. Otherwise trolling is an option.

[Rik]

Given Bruno's posting history, I doubt trolling is likely. While it is improbable for someone to crack the p-code encryption, it is not impossible. Escpecially the caveat that only specific version(s) are cracked lends some credibility to the claim.

[Walter Roberson]

@Julian Hapke

I know of at least five people who have made credible claims that they know how decode older .p files.

I do not know whether anyone has decoded the newer .p files as of a small number of releases ago.

Answer 3

[Meme Young]

Oh man you have really asked a good question, like claiming yourself to be a bank robber in front of a police department

[ou dk]

Sorry, I didn't ask a question, I just answered the question, and I think you might have a spelling mistake, not robber but Robin Hood. Because I don't make money.

[Rik]

@ou dk: Guilty conscience? This answer is also applicable to the question itself. And doing illegal things for free (or for the greater good of a community) doesn't make those things less illegal.

You could argue about the question if the service you claim to provide is indeed for the greater good, but since you aren't even actually providing that service the discussion is moot.

[ou dk]

moot discussion? no, I can do it differently from what I want to do, at least to remind users that these methods are not as safe as claimed.

You can refer to my last answer to Bruno Luong,P file recovery is accurate for line breaks and carriage returns.

Indeed, I will never open up services to the public.

[Rik]

Comment posted as flag by Meme Young:

Ok Robin can you recover some p codes?

[ou dk]

A small number of files are available, but you can't use them for profit.

[Yousif]

sorry again, i did not understand the word dycript, i meant the opposite how to pcode.

Answer 4

[Fangjun Jiang]

I thought the Mathworks could do it. But they won't do it. After all, it is put in place to protect many of its source code (part of the reason, I believe). It can be used to protect the user's customer-developed source code too, which is what I like. Hacking is possible, technically. If you find a way, please let me know.

[math98]

thanks, but I really didn't understand your comment!

[Jan]

@Jiang (sorry, is this your first name?): Of course you can hack anything which is in the memory. And I can steal the windshield wipers of all cars, because they are not secured. In both cases the owners will dislike your work and the global level of distrust will be increased. Therefore I respond:

If you find a way, do not do it and especially do not publish it here.

[Fangjun Jiang]

I am not encouraging doing anything illegal. I am merely saying, hey, take the challenge if you want to. Someone hacks for profit. Others hack for fame.

[Sean de Wolski]

http://www.cnn.com/2011/WORLD/europe/06/21/uk.sony.hack.arrest/index.html?hpt=hp_t2

I don't think he'll be lulz so hard when looking at 20+ years in jail...

[Fangjun Jiang]

@Jan: Jan, I think you missed my point. I already said that the encryption was put in place on purpose to protect intellectual property, which is what I like. I meant to say that hacking P-code is possible but probably very difficult. I probably had a smirk on my face when I say "hey, if you find a way, please let me know!". I didn't know hacking P-code is not a real challenge and I still believe it is going to be very hard. Are you afraid that math98 will take my word for it and go cracking the encryption? He said he "heard from an old MATLAB user that there are some ways to decrypt a pcode". Is that "old MATLAB user" referring to you? Walter didn't want to take that credit.

[Jan]

@Jiang: Ok, I haven't seen the smirk on your face.

math98 is interested in protecting his own sources and needs an estimation if P-coding is reliable. I've examined the P-format for the same reason and was not convinced by the protection level of old Matlab 6 P-files. But the modern P-format uses a strong encryption and a surprisingly good compression: the P-files are up to 20% smaller than the LZMA/7zip compressed (comment-free) M-files. Anyhow, I'm not the old user math98 mentioned.

[Fangjun Jiang]

All right! BTW, I misunderstood Walter's comment. He did take credit for being that MATLAB user. He just didn't want to admit that he is old.

[Yair Altman]

@Jan - I have just seen this thread and I must say that I take offense at being labeled a cracker or hacker. For the record, and you can quote me on this, none of what I do or publish is illegal, to the best of my knowledge and intentions. I am very careful about this. My livelihood depends on Matlab to a large extent and I will not cut the branch I'm sitting on.

[Jan]

@Yair: Sorry. I did not meant the term "hacking" in any offending way and I'm definitely convinced from all I've seen and heared in the last years, that your work is legal and helpful for Matlab users and in consequence for TMW. I'm used to distinguish the illegal "cracking" from the legal "hacking", which means digging in the codes for the not barely obvious features. If any of your investigations and publications of the golden beans you've found is not legal -what is not the case!-, I'd strongly recommend that you get payed by TMW to catch up a legalization retrospectively.

Anyhow, Yair, I've deleted the concerning comment, because I know that the term "hacking" might be misunderstood.

Answer 5

[jgd0008]

I know it´s an old subject. This guy had an utility running on the web. I used a couple of times, had some minor flaws. However, it´s been asked to be taken down.

web-service.sippey.org/de_pcode

So, it´s possible

[MOUSSAOUI FAOUZI]

Hello, all my Matlab files have been encrypted by ransomware online. Is there a way to recover and decrypt Matlab files? Thank you. [e-mail]

[Walter Roberson]

Files that have been encrypted by ransomware are probably not recoverable by any method known to Mathworks.