Re: using Safe.pm

[CountZero]

Nothing to do with your question about Safe, but perhaps you can add another window to the "obfu decoder ring" with the output of B::Deparse which can assist in understanding obfuscated code.

[Aldebaran]

An interesting challenge. I've been fiddling with it for 48 hours and decided that altering the windows/widgets was beyond my skill level. Since the output goes to STDOUT, I opted to create an event that would do so. I sincerely hope the readmore tags work this time:

Read more... (11 kB)

When I depress ctrl-d, I get to the sub that prints "before eval" to STDOUT. My current problem is writing the appropriate eval statement, in other words, trying to imitate the command line from within a program. My best guess did not work:

#!/usr/bin/perl
use Modern::Perl qw/2010/;
use Safe;
use File::Slurp;
 
my $compartment = Safe->new();
my $japh = read_file( 'obfu3.pl' ) ;
my $result = $compartment->reval($japh);
say "Result is $result";


eval ('perl -MO=Deparse obfu3.pl');

The top part works; the bottom doesn't. Looking for tips. Thank you.

[CountZero]

You don't have to start an external Perl instance. B::Deparse works equally well from within your script:

use B::Deparse;

my $deparse = B::Deparse->new();

my $body = $deparse->coderef2text(sub {
# your program here
});

print $body;

[Anonymous Monk]

eval ('perl -MO=Deparse obfu3.pl'); The top part works; the bottom doesn't. Looking for tips. Thank you.

What do you mean? Capture::Tiny? Look inside O and B::Deparse , and maybe Safe::Hole (or Safe::World), https://metacpan.org/source/RGARCIA/Safe-2.35/t/safeuniversal.t, ) then copy/paste stuff so you can reval somehow safely? There is no Safe::Deparse on cpan :)

perltidy then manual inspection is about the only safe way to figure stuff out step by step without BEGIN{} or `qx//ing` or s///eevaling stuff running, just decoding the strings

[Aldebaran]

Thanks for your response, I chased down those cpan modules and gave them a read. It's been suggested that I might not have my 'puter at eye level, and the answers might be right there on the screen, but I'm missing them usually for lack of comprehension. This is new territory for me, and the learning curve is steep. I do best with the modules that have examples and have worked up a few examples to show what is working and what isn't. I wrote the simplest of toy programs: toy1.pl, that only substitutes a phrase. It's safe and short. Let me list the latest of many incarnations of this script:

#!/usr/bin/perl
use warnings;
use strict;
use feature 'say';
use File::Slurp;
use B::Deparse;

# first trial without safe
my $japh = read_file( 'toy1.pl' ) ;
say "japh is $japh";
eval($japh);
# second trial with safe and copy/paste
my $deparse = B::Deparse->new();
my $body = $deparse->coderef2text(sub {
my $name = 'Donald Trump';
$name =~ s/ / "in the sub" /;
say "name is $name";
});
say "second trial is $body";
# third trial combines two methods
my $deparse2 = B::Deparse->new();
my $body2 = $deparse2->coderef2text(sub {
my $japh2 = read_file( 'toy1.pl' ) ;
say "japh2 is $japh2";
eval($japh2);
});
say "third trial is $body2";
# 4th trial uses backticks
my $file = 'toy1.pl';
my $command = "perl -MO=Deparse $file";
say "command is $command";
my $output = `$command`;
say "4th trial is $output";
# 5th trial looks at original obfu
$file = 'obfu3.pl';
$command = "perl -MO=Deparse $file";
$output = `$command`;
say "5th trial is $output";

The problem seems to be how to get deparse to work when the file to be deparsed is being selected after the program begins to run. Hence copying and pasting into a sub is not possible. I thought I was going to go with system() and Capture::Tiny until I ended up going with backticks in the 4th trial with good results. On the fifth trial I directed the backend of perl toward the obfu in the thread of the obfu decoder ring from the original post. It appears to be a bunch of junk under closer inspection:

japh is #!/usr/bin/perl
use Modern::Perl qw/2010/;

my $name = 'Donald Trump';
$name =~ s/ / "Perl is great" /;
say "name is $name";
name is Donald "Perl is great" Trump
second trial ia {
    use warnings;
    use strict;
    use feature 'say';
    my $name = 'Donald Trump';
    $name =~ s/ / "in the sub" /;
    say "name is $name";
}
third trial is {
    use warnings;
    use strict;
    use feature 'say';
    my $japh2 = read_file('toy1.pl');
    say "japh2 is $japh2";
    eval $japh2;
}
command is perl -MO=Deparse toy1.pl
toy1.pl syntax OK
4th trial is use Modern::Perl ('2010');
use warnings;
use strict;
use feature 'say', 'state', 'switch';
my $name = 'Donald Trump';
$name =~ s/ / "Perl is great" /;
say "name is $name";

obfu3.pl syntax OK
5th trial is $= = $';
$. | $| unless $;
$_ = '*$(^@(%_+&~~;#~~/.~~;_);;.);;#);~~~~;_,.~~,.*+,./|~~;_);@-,.;.);
+~~,./@@-__
);;.);;#,.;.~~@-);;#);;;);~~,.*+,.;#);;;;#-(@-__);;.);;#,.;.~~@-););,.
+/.);~~,./|
,.*+,./|,.););;#;#-(@-__);;.);;#,.;.~~@-;;,.,.*+,./@,.;.;#__;#__;;,.,.
+*+,./|,.;;
;#-(@-__@-__,.;_);@-,.;.,./|~~();.;#;.;;;;;;;;;.;.~~;.~~~~/@~~@-~~~~;#
+/|;#/|~~~~
~~/@~~@-~~~~~~;_,.;;,.;.);,.~~;_,./|);;.,./@,./@~~~~~~*+;#-(@-__,.,.,.
+*+,./|,.;;
~~()~~@-);;#);;.,.~~~~@-);-(@-__@-*+);~~,..%,.;;,.*+);~~~~@-,.*+,.,.~~
+@-~~.%,.;;
~~@-,./.,./|,.;;~~@-~~.%););;#-(@-__@-*+);;.,./|,./@,.*+,./|,.-(~~@-,.
+*+,.,.~~@-
~~.%,.,.~~@-,./.,./|,.;;~~@-~~.%););;#-(@-__);.%~~/@~~@-~~~~~~;_,.(),.
+;_,..%,.;.
~~;_~~;;;#/|~~~~~~*+;#-(@-__);@-);~~,.*+,./|);;;~~@-~~~~;;__;;/.;.@-;;
+();./@,./|
~~~~;#-(@-__&$#%^';
$__ = ' ';
use arybase ();
$___ = '````' | "$[`$[" | '`%",';
$~ = ("$___$__-$[``$__" | "$___" | "$___$__-$[.%") . (q['`] | "'$[" | 
+q['#]) . '
/.*?&([^&]*)&.*/$' . ++$= . ('/``' | "/$[`" | q[/#']) . (";`/[\\`\\`$_
+_]//`;" |
";$[/[\\$[\\`$__]//`;" | ";#/[\\\$\\.$__]//'") . '@:=("@-","/.","~~","
+;#",";;","
;.",",.",");","()","*+","__","-(","/@",".%","/|",";_");@:{@:}=$%..$#:;
+' . ('`' |
 "$[" | '#') . '/(..)(..)/' . ('```' | "``$[" | '#("') . '(($:{$' . $=
+ . '}<<' .
 (++$= + $=) . ')|($:{$' . $= . '}))/' . ('```;' | "``$[;" | q[%'#;]) 
+. ("````'$
__" | "%$[``" | '%&!,') . ${$[;};
`$~$__>&$=`;

Since there isn't any output, my guess is that perl is clever enough to look at this program and say, "why define a bunch of screwy-looking variables, assign a bunch of junk, and do nothing, if there is no output? Let's not play at all." But if there were output, would perl assign values to all the odd-looking $ variables like $= , $. , $~ , $___ ?

What symbols would I look for if there were something pernicious happening?