Re: un obfuscate logfiles with xor

[Laurent_R]

Hmm, I don't quite understand you problem. If you file is encoded with a xor 255 (or a xor anything, for that matter), and if I understood your problem correctly, you should just need to apply the same xor to retrieve the original value.

Or did I understand you wrongly?

[golgiapparatus]

Here is an example ÃÎÌËÁßÍÏÎÌÐÏÊÐÎÌßÏËÒÏÇÒÊÆßÓ�œž“ÏÑ–‘™�Áß‘ŠÆÌÇÌÑ‘ŠŒ�–�šÑœ�’ß�™ Thank you

[Eily]

use strict;
use warnings;

my $s = q<ÃÎÌËÁßÍÏÎÌÐÏÊÐÎÌßÏËÒÏÇÒÊÆßÓ�œž“ÏÑ–‘™�Áß‘ŠÆÌÇÌÑ‘ŠŒ�–�šÑœ�’ß�
+™>;
print pack "C*", map { $_ ^ 255 } unpack "C*", $s;

<134> 2013/05/13 04-08-59 <local0.info> nu9383.nuspire.com pf

This only works if I run the code in an ASCII encoded file, there doesn't seem to be utf-8 involded here.

unpack "C*", $s; returns a list consisting of the value of each byte in $s. pack with "C*" takes a list of bytes and turns it into a string. Read perlpacktut for more information on that.

[Loops]

Is that an example of raw input, or the output from the current iteration of your script? It would be helpful to know we have a clean fragment of raw logfile data