Re: [B::Deparse] Trying to find sub's code

[bulk88]

Here is my favorite typical way of decompiling perl.

use Data::Dumper;
use B::Deparse;
use Devel::Size qw(size total_size);
use B::Concise;
use Devel::Peek;
my $deparse = B::Deparse->new();
print $deparse->coderef2text(*Win32::LoadLibrary{CODE});
print "\n\n".size(\&Win32::LoadLibrary )."\n\n";
my $walker = B::Concise::compile('-src','-exec',*Win32::LoadLibrary);
$walker->();
Dump(*Win32::LoadLibrary{CODE});

Output:

;

247

*Win32::LoadLibrary:
*Win32::LoadLibrary is XS code
SV = IV(0xcbaf78) at 0xcbaf7c
  REFCNT = 1
  FLAGS = (TEMP,ROK)
  RV = 0xc45b3c
  SV = PVCV(0xc12a3c) at 0xc45b3c
    REFCNT = 2
    FLAGS = ()
    COMP_STASH = 0x0
    XSUB = 0x3a2528
    XSUBANY = 3
    GVGV::GV = 0xc45b2c "Win32" :: "LoadLibrary"
    FILE = "Win32.xs"
    DEPTH = 0
    FLAGS = 0x800
    OUTSIDE_SEQ = 0
    PADLIST = 0x0
    OUTSIDE = 0x0 (null)

Deparse can't decompile C for you. Only pure perl functions. Try Ollydbg (shareware) or pay for Ida Pro if you need to decompile machine code.

update: WSD::Filter is a proprietary not-FOSS XS module with a EULA for an Apache webserver. To OP, either buy the license, or buy Ida Pro, or both (if you want to make sure your binary blob isn't a rootkit).

update: since you use linux, I strongly suggest not investing in a copy of Ida Pro since Ida Pro only understands MS symbol files, not GCC symbol data.