Beefy Boxes and Bandwidth Generously Provided by pair Networks
good chemistry is complicated,
and a little bit messy -LW
 
PerlMonks  

Understanding Obfuscation

by overrider (Acolyte)
on Oct 18, 2006 at 03:11 UTC ( #578948=perlquestion: print w/replies, xml ) Need Help??
overrider has asked for the wisdom of the Perl Monks concerning the following question:

Hello, i am trying to understand how obfuscation works, so for example this code founde on http://en.wikipedia.org/wiki/Just_another_Perl_hacker is just written with punctuation or another one with keywords but still prints out the old JAPH. How? Why? I have read somethings about bitwise XOR`s and so on, and someone told me when i understand why '$' ^ '_' equals { then i will understand it, but until now i really dont get it. Can someone shed some light on this please? Thanks a lot,

Replies are listed 'Best First'.
Re: Understanding Obfuscation
by chargrill (Parson) on Oct 18, 2006 at 03:55 UTC

    Understanding other people's obfuscations in $^F**2-1 simple steps:

    I can only assume the OP is asking about this one (note, this is not my work, but it is not properly attributed on wikipedia. Chances are high it originally appeared here!):

    `$=`;$_=\%!;($_)=/(.)/;$==++$|;($.,$/,$,,$\,$",$;,$^,$#,$~,$*,$:,@%)=( $!=~/(.)(.).(.)(.)(.)(.)..(.)(.)(.)..(.)......(.)/,$"),$=++;$.++;$.++; $_++;$_++;($_,$\,$,)=($~.$"."$;$/$%[$?]$_$\$,$:$%[$?]",$"&$~,$#,);$,++ ;$,++;$^|=$";`$_$\$,$/$:$;$~$*$%[$?]$.$~$*${#}$%[$?]$;$\$"$^$~$*.>&$=` +

    Step 1: reformat the obfuscation (if possible).

    `$=`; $_=\%!; ($_)=/(.)/; $==++$|; ($.,$/,$,,$\,$",$;,$^,$#,$~,$*,$:,@%)=( $!=~/(.)(.).(.)(.)(.)(.)..(.)(.)(.)..(.)......(.)/,$"),$=++; $.++; $.++; $_++; $_++; ($_,$\,$,)=($~.$"."$;$/$%[$?]$_$\$,$:$%[$?]",$"&$~,$#,); $,++; $,++; $^|=$"; `$_$\$,$/$:$;$~$*$%[$?]$.$~$*${#}$%[$?]$;$\$"$^$~$*.>&$=`

    Or (or perhaps additionally), run the code through B::Deparse (  perl -MO=Deparse obfu.pl ):

    `$=`; use Errno (); $_ = \%!; ($_) = /(.)/; $= = ++$|; ($., $/, $,, $\, $", $;, $^, $#, $~, $*, $:, @%) = ($! =~ /(.)(.).(.)( +.)(.)(.)..(.)(.)(.)..(.)......(.)/, $"), ++$=; ++$.; ++$.; ++$_; ++$_; ($_, $\, $,) = ($~ . $" . "$;$/$%[$?]$_$\$,$:$%[$?]", $" & $~, $#); ++$,; ++$,; $^ |= $"; `$_$\$,$/$:$;$~$*$%[$?]$.$~$*$#$%[$?]$;$\$"$^$~$*.>&$=`;

    Step2: figure out what you can the old fashioned way. Be sure to have a copy of perldoc perlvar handy.

    `60`; $_=\%!; print "\$_ is currently: $_\n"; ($_)=/(.)/; print "\$_ is currently: $_\n"; $= = ++$|; print "\$= is currently: $=\n"; print "\$! is currently: $!\n"; ( $., $/, $,, $\, $", $;, $^, $#, $~, $*, $:, @% ) = ( $!=~/(.)(.).(.)(.)(.)(.)..(.)(.)(.)..(.)......(.)/,$"),$=++; print "\$. is currently: $.\n"; print "\$/ is currently: $/\n"; print "\$, is currently: $.\n"; print "\$\\ is currently: $\\n"; print "\$\" is currently: $\"\n"; print "\$; is currently: $;\n"; print "\$^ is currently: $^\n"; print "\$# is currently: $#\n"; print "\$~ is currently: $~\n"; print "\$* is currently: $*\n"; print "\$: is currently: $:\n"; print "\@% is currently: ", join( ' ', @% ), "\n"; $.++; $.++; print "\$. is currently: $.\n"; $_++; $_++; print "\$_ is currently: $_\n"; ( $_, $\, $, ) = ( $~ . $" . "$;$/$%[$?]$_$\$,$:$%[$?]", $" & $~, $#, +); print "\$_ is currently: $_\n"; print "\$\\ is currently: $\\n"; print "\$, is currently: $.\n"; $,++; $,++; print "\$, is currently: $.\n"; $^|=$"; print "\$^ is currently: $^\n"; print "\$\" is currently: $\"\n"; print "$_$\$,$/$:$;$~$*$%[$?]$.$~$*${#}$%[$?]$;" . $\ . $" . "$^$~$*.> +&$="; `$_$\$,$/$:$;$~$*$%[$?]$.$~$*${#}$%[$?]$;$\$"$^$~$*.>&$=`

    Outputs:

    $_ is currently: HASH(0x18092a8) $_ is currently: H $= is currently: 1 $! is currently: No such file or directory $. is currently: N u$/ is currently: o u$, is currently: N u$\ is currently: u u$" is currently: c u$; is currently: h u$^ is currently: nu$# is currently: l u$~ is currently: e u$* is currently: r u$: is currently: t u@% is currently: s s u$. is currently: P u$_ is currently: J u$_ is currently: echo Just a$\ is currently: a a$, is currently: P a$, is currently: P a$^ is currently: na$" is currently: c aecho Just another Perl hacker.>&2aJust another Perl hacker.

    Nevermind the start of the lines on or around where $\ is set. According to perlvar, that's the output record separator (after I printed the trailing "\n" in the "currently" lines, perl appends the output records separator, hence the funny line beginnings).

    Step 3: Apply intuition. It should be fairly obvious in the above example that the original code is simply building a command to run via qx//; "echo Just another Perl hacker.>&2". If at this point there are still things you don't understand, maybe that's when you start asking around in the chatterbox :)

    Oh, there are a few things here and there that perhaps aren't sufficiently self-explanatory, but learning is half the fun. Especially rewarding is the why when you stumble across that.



    --chargrill
    s**lil*; $*=join'',sort split q**; s;.*;grr; &&s+(.(.)).+$2$1+; $; = qq-$_-;s,.*,ahc,;$,.=chop for split q,,,reverse;print for($,,$;,$*,$/)
Re: Understanding Obfuscation
by japhy (Canon) on Oct 18, 2006 at 03:25 UTC
    Character-based XOR works on the binary representation of the characters.
    'd' = 100 (base 10) = 01100100 'A' = 65 (base 10) = 01000001 'd' ^ 'A' = 00100101 = 37 (base 10) = '%'

    Jeff japhy Pinyan, P.L., P.M., P.O.D, X.S.: Perl, regex, and perl hacker
    How can we ever be the sold short or the cheated, we who for every service have long ago been overpaid? ~~ Meister Eckhart
Re: Understanding Obfuscation
by blokhead (Monsignor) on Oct 18, 2006 at 04:09 UTC
    The keywords-only JAPH on wikipedia is one I originally posted here in Fun With Reserved Keywords. There is a very good de-obfuscation given by Chady in that thread, which will help you understand how it works.

    blokhead

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: perlquestion [id://578948]
Approved by diotalevi
Front-paged by Old_Gray_Bear
help
Chatterbox?
and all is quiet...

How do I use this? | Other CB clients
Other Users?
Others meditating upon the Monastery: (5)
As of 2017-11-19 00:31 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?
    In order to be able to say "I know Perl", you must have:













    Results (278 votes). Check out past polls.

    Notices?