3N3RGY has asked for the wisdom of the Perl Monks concerning the following question:

Hello, I know you got a lot of questions and requests and maybe you would banned me after asking but I have a question and need really some help. The Story I long so I don't will talking bullshit here but I promise ... this request is for my private use only! I need this file decoded and want understand how you decode it and the strings or request or settings someone use to decode it please.
#!/usr/bin/perl my @ FSESTART; use POSIX; sub ZJLtmqxBDpFSPS { my ($EYjBSc, $njrufo, $wsabve) = @_; $ | = 1; pipe (OIGBOr, OIGBOw); pipe (XABGEr, XABGEw); my $pid; if (!($pid = fork ())) { untie (*STDOUT); untie (*STDERR); open (STDOUT, ">&OIGBOw"); open (STDERR, ">&XABGEw"); $ | = 1; close (OIGBOr); close (XABGEr); exec ("/bin/sh", "-c", "($EYjBSc)"); print "faalsoft-exec-failed: $!\n"; exit (1); } close (OIGBOw); close (XABGEw); $$njrufo = undef; while (my $oi = <OIGBOr >) { $$njrufo. = $oi; } close (OIGBOr); $$wsabve = undef; while (my $oe = <XABGEr >) { $$wsabve. = $oe; } close (XABGEr); $$wsabve. = "Exec failed : $1" if (!$$wsabve && $$njrufo = ~/^faalsoft + - exec - failed:\s * (.*)$ /); waitpid ($pid, 0); return $ ?; } my $UnxmOTO = ""; my $aFWmlTR = ""; &ZJLtmqxBDpFSPS ('/usr/bin/faalsoft-oscamlast Q0IpKxohIQU9aC8MJg==', \$UnxmOTO, \$aFWmlTR); die ($aFWmlTR) if ($aFWmlTR); eval "$UnxmOTO"; die ($ @) if ($ @); 1; __END__ = oVyZrZchlbfquSfzfLm1vlBG / 51j svnt / xXY8fJ7FBoLwxFg98OYqZb +P7 + vg3rRNVaPcD9EPCwISQ6uEHX9BDbBTWOoG3q0S5qiT1ClT4hlnOMzahHeegmvSS4 +wq223WO + FGzzd3GbXeZNSyI3MLMJyzek0JdLZpQS8ejKHTiZzOqTQIxp4naOM8N / o +8JEHR9DBeScyyNDa3Vv6Ve9fmyUEvoqtMav6C66bOjFO3LfdwGGCQ0r2OpfLHlQeaXyZQ +qpYhQb + HElq0UAw8UlAZ9JVhaICw5 / CPPt5ufex8zGxutRlrP3wZzffZX5ivtP9rK +FGaRMl1n / KxdBZ13CR5rBN7eYIhXtP80jmwqNnT04so07PPy / OUqGdcDu0ovqKp80 +ijBsqI / 6 cQyzOhGrAln8x5mzxXIHx833p4BjIpp7eiGS6u137PvYqFuNw3Ky8ONCkk +2lt9CBq5mhagCMUkV6k61qe6tQ4Aue9sNDPpnBiUPfErFoiffGIMv9mwexPXFATfTiwI6 +z2y9V4rXFvVu5O0lelKLfzqUjvdxmbKZgpixQEz05aKVJBviC / NMDu1bIGq1cQqcW93 +FWUwlI3i / ahwDH5Mxfyzoex9sXV6un64RtfNSsb9QobfBTU7whuAxNWIKzU3HEIyZtw +j7H5EuN4UejMglNspf2ydB //pAGhZu7dhVqFmJbREK5cd1oceGZRBA3slicNuYeAb +6j0vqA4+QN+Ve5PpE/hnMnjU4UtK6MXQi7H9RERpR+W9ZtN6vpHKKR20UM+NIpIVyNkYm +xQKUb6KqM6wHR+NEutLJx3acuF0LS8arLOraq/73UByI2kS4ljQuanato0OETppZWoiM8 +Kjc8iKNcP2QxE5ppKqnQH99OKQZujx/EF4fobvbh9rYlt0iF/oMw2UUmfWOi6bXG4zcGK +IE7BldMesl6F40+yxZdF4eu9ygkA81fuuKE9e4VK0DPLd3tu8vqQUBvg5TbSWRfyVezMq +3MHcF503+ml/+JK2u9eeADxoV0MnRL9UaUucLy66Cj0USH/IGOaZFDs0Hdzoa7TOnEOd0 +ILabwaX4dT97odTswRCmczuA2SlcjMFc2+DMZtgJpfddksrKD+tTCc6T/7Rzcb3uZEpxG +j/G/t+upVaKP8J4FbsHnZrFUKg5DpOxXd0kTpKcVA1IqHWm4kT+52l/ZMKgwhi4R5TSVS +XB87359lbBVxu4nYeKrFfQ1necowj7IB8gJool0AGFJ/T7VOKN/u9x3Iq2clKQYQsMl9G +fhhTVnpIJjOh6Q0eV+rVIjZEVNDoL+rFn6nVCmzsx/wmq1+/ShA0ztWoY+/Yqzqmdd5TX +a70cYW/114wTnY7ftBALx8fP9tFriN7Lq+knVqlkInLyibE2oAwKoBSEJ+0wkuEspN1j5 +XSyEa3K9YwbFcVgRwHip5vmuAUvGOoVe1ElyJ7uOeE+GVu/YHwnceV/fLUitijSKa1rZH +z7uVXS3h2SlWSgd5N48wUsILXtvlJ+N+WGerx3E8J2oAPHbQuZAl6A+vaeNBhI8rgGMQ8 +2TdmRBnwWzmCRGZNm3N364W6tgZpjkO9TOeGkwQCp4NOa4YJ9P8tgcU0vUljk6967GzEo +j/uEJVLjN4F6OTx7YpUfnfD214d2quwUyoUbyAIITPyKjRLh1B1viamVcLJCTkLg6wZtf +bo0JBsc8GuR2chvCsfTaURgXtxGiTY1VMNCsHDI63UXU6K3rVMiQtPio2RGveoLlbEnto +AdfpB6eCGOuWrb8u/Tl54aSohiM5L1X07EbN/0EtnMv4A7uSVX6IWevxcgcrzCZL5fU1u +YcNQhBYye8NU2PHiXP2VkgCoeVEbIRjP0KoVxvabfjXVhdQbcoEzfbIFm7Eh1/RtOqu4u +KuElH5jXYo5YNYcB8kk7sac33Qflv6hfDMG52tuMW9JTG5UDv9NV+dC8ecjabS6+l5JHE +PhYyHirjNUv08WBAq3hAeZ6UO+CPJi60MUBA7rJ2sfrcCGEiA+oUVWuyN4opyy8XP/8qU +7/mZZ1+ro/Yk9HFiv381LJoX6ao0cdFBphRxMWnjkyQLKO3MZeIVWzNvFJnVx5LGgORuL +kjfCrQg+XSkhksz1Qkfjc03CsIJ2/K8oPQNjZqgRKebFkrmtixd5ALd/zNHbZYhi3RrS6 +/N49qRr3DFw7r+MvyWYsPQlTqKpuCP5hHPe/SmWGuagiaakKDUCbnGmbGYWBnxVrNjAf2 +oVMBF9ZGikcQqB7rlV3SQ1pujI5AeFnsLifRtIUO1s11erf7044qbDdnDMSxuYoGZXFxd +zlsDNoU6EXMsRpSCT49ziRCLpTDw4K8Q5cT9jSKbnOWluK3MqASgqOxEa6YqFeiU/2yuM +emnLL2ps2rwPbXmy/vnzvSmcOytS6KqsHGrfk3Np6Lnu/jWyjnLAfATrJkUjRVfBCtjHo +3/GmUOTz7Vm3lJRfmnBbyiGgivBe5uU+PL1UiM/vCGahpfKGaAQLsmBtywEiuYQis96RU +oGqNJ6pngzyZozZYf6S3czbgYlO6KHMuvTAbH/QTkdVJKkY0kRKsqmMRvVmXbZgiw9qbc +wmle85QThxzjAc0b+UhkVc1UUuQLowp9u4D7oDbunR47RF5aSW6lrqhsZx0osGCHp6j6v +JQ960pZOXkvqhmevjjxFV4muoJNn0hBZDeyzu800/3Rs9F+Dn+Zj/XYQC1iwIEkySMAzI +iA1GvQYHCL0DPZfnzYwjelKSy0s/1/XWxGY7LA+x43c2V35UDveEOuLiMjm4LRUZPlK8o +9cj8T+CdOR0koYT/sGBrCU8f/LPkF19YxtBiejO5JBVoaSZgaSiX2oKMeITfNPXr8JItx +KFh4Qi9d5nRU6PmoIFjeqBuYEArU0zz7PIfli3Y7JQDfh5RX6CN09bqRIonjNUPf9FPoR +sSTYpwf6KkkkFdwRtTZ/zD+UQZQIm8t0zeWYLsOzoHwot0nu5fRkpXINXM7mzg6ryDKWT +/V0GE7pCT31wGSXoiL+fbvE+GzCbGeqRFsUVCzOZ9U7dx0W3p7FS36d0+zJdJ81cJ3QRB +5KDLd5i6GCbiLVvy3jnSZvu4HsSmkZ9ZR6g68rz/ui35R+v0XYN63MQF86rRY2oUtKnRI +Gz+5th6ZcTLTIuF4tcc4/YHy+NLY0V158EfdGoTAIbY66MhkDziQBoqfKLwSNfYIlF4d7 +GofoY+MXEvVelAQBwDkYHEjimVuItXH29QS2fAcuvTMp7UOW8RCGMg5c/8YWp+vec5iFf +KN/8rEG1l0h6FdDI3FcvoTiWM8omARCYJiXHiMhdpl/CLv0m4ZEmRx3hNRoVBLtYk4TyX +/20EAQ7MyYlN34wOgPcUEaJHDGjYuCt2QRpeyX0mQJN4BYolplTxm3+S3Jdac8rUic4h8 +Y90NV8mzLCFGYxkYcCBSNgYDnHyXxDEKHpbmovMJQdTyRUX5PO39rvkULbGHA5l0CDgZl +36ugEzYnFk2wLe/9cHPkS7HWzaqcayqwDT8bQTtH+iXV1VXc/iQmnGZdQdSW2nkldbYOv +FB6u9erdz/67gXaS933jm0625DcJuWYpsJR6tl2IEffAItIDN1vRbQ7xaAEvW9dv4ZHe0 +2kfDetjbZYsQDQRbUrLZUVWVkUVKSrIMEdffCaReGW+07BnBIj4LmdUFU8uCeIqaCJyVv +HJcOmSckDxEQ4hDJOfXQ4hgC2a70siFm/QJHBm3TWxOGl5PdZAJmZflznEc2Wp4o+1lB0 +e1FPZHB4sagywimAvRBu3T8LQi0HH0RAqZGh3LBYt9biGEl86k/xtaHEuVcGC8FRPCaG4 +xnPq5VLnhjLtE3cBGUJo610AHAD5Kqg7+RGaa8U+R8r/IPm5O4BPe45BZCCMREKTXUElR +YljuFzZim7eoUjD1huB9CFjLak4kURD6tiQXJhQCgqiJqSORenGTXtN5O4Xwm/gOkHT9p +AQ1ZsAZVR8WhhcHkjvpj2Ip3LJpRBRid5La60kgxawm7hS5KSEW88Vh5Fd6Ys1mENj7Nt +VMwpcfo86570lsB3aSLgdrlz4guKimgkPo+ROxliU7eiIqm2BYgGd1ch4xL5KUG+ErzMy +AdWEPbAMCdTM3d31e+klTmizXxg1p3NJjwXP6slZGQfJsl4Ln7u/GHTLvkRSYsfxemrWv +XlJuhlnvvRme3W/LD82fKLZG/D2D+u+6II6SrLZmZNjav6htkzGr4UKwczhyVOsWuQqs7 +sm0aUGqKD6JrWkMR6Hkx5vAzOgCv8VBHKa8F+eGj9LL9Nefkq0ov/6G+TN7QXDKioL8We +m+eLrAPTQMalLeC/auxVcqbcP1Ell0HpdkJcDZ7IYBmhOMZTweiHrmEVAub1SFN6CDKtN +BTGXoBOSr5ha+qwAU4F3AMyJqOWxjBjgaK1L85p4pYD8LYgrNuGivfITaldIbQTJtTa2q +/FIS8GaIuOyH9xc4wMLXADTohcf1ogqC9vAXng+WKENXvEz4gic5CLHn11y/HusOgE+WW +vEzFAf9x7CcYxoCr2Dcnd6MOVKG+fV4fJOXPK0jqq7ZHLgliVnLHVnCwJWal7LDpDA+6s +ynybbWzEteDF+ZLX3EYaGHEBgubtPR0sKep3PgSLYf7FybmC1TRNPg6DpHE0mWLOFWILS +ClMqSJL4jnxwuaWAecVJHAcyhMO5G+G+aVjCXfE8xL0sQiS62pl34eTOX6N4JZVg32qrS +oZEkl3PfUyeTDlCO+gkNY0Mzode8T5/+Nd/Cie+K7eNtokq9akohBdNBSSVi5vadKp63a +GdEpeSYQMxc6rA+V5BxSaGAyOWXMQAf8rSMDlBQa/IxycFlff64i3DAnLT4gIDfQBSZ7H +E8iO4YneNShYdoyZBBAjeN/uRINAGvbypTbkmNnVi/fYLHq3QKFmBH92MYPPiKrD8kM14 +DxD9JooGX/VjN5+xt/ar7Wi/AA6APZmWODWK2prtv2dW/ihmM9YrOhcc6OBjnQ+G9Ssg4 +0NNJC8Kx5i1E4Bur1to66NqEZUuEWpiJE2sYdtLCjbf5Xuvt8aC11Jux8JHCvk44sZHE+ +LdyCezE5HyMwpvWke7afd3yRfyaZLV4CugGTevZQqHdBRbh7ug7zOwfeV6q4ezzddpOop +IQBdkcoony/QR2oOCdJL8GrKy41f91Z5pY7QJ+NaKQ7tduW5hgFENskq1IcHI8hI+MrAw +WqDcEf3/MgTou311IDABKhQ20JYUHLKmR7g2PiirgOIJ9dmHzN451Bogll0FL1w1rlos9 +sedyyxrXLbliD2ZrzHiVUHoM2ov6Jjx1mt/DmTsIBLDppYTGbxpLuAK1NiqnsSwSuqNVx +Zl3cLkRSvzwxaqME/7rdV7wpGiIjeYU1a42U710TS291cqPEW1WowpSHZY2KkPGBQR7vP +v2TnvGqUvAahqOcd7X0lS1t9ynme+mQmJYq3r1qxrM9+XhOsaMrBLJMXEEa+fHevtqexL +msXbffC+Qz4v+PlQxXEXnrr8ZlaeV5NcRKqvDKR8bkRKXzOvJl7/Ojmr2EBTnKmzAER4L +kbRRHyKb7NPhk2LR0HnwEqgr7/vYT0KABhuEgXm0ZdYLWC4mph9gQEusjN3OGkvnGrI1w +OJjzNobrecwC4tCjNXsxW5i0oU/mUJK7osx519WBzG4gy2TBZB4SvypCSsFrK9v5QK3Gq +vLn0I95ysY/ohlJaR0KbHWjr9gsFa35j/WDRVC3OwVBLnYe83KO7jXRRWtcj7kYF22cit +qdLbr4KKQe9at9Qb/UNqJSDDSEu7oFKRJfqkqVOsL811klafwzW64HxtQUWQllHomK23F +cRkZqQXo1jqmN+SawSVUUyHN4gPu3a/Y6MfCcH81LIMsk79y0omRB2U1VEj15vYQs5bUq +Z4Gcof6bnAI/hubJK5/3Ki1Y1iIPzQ7gv4LmnsH+/hm02Fjw2OW8lqSEcZITGLgPdIFyV +5RvxaQ6eQQt14S8WEJabiLL0WqjIu1c6nx3W9AqknQHMBAdPWyVwjNAM+evDsvQhFG5vz +OGSJO+NvI41UJuNVrpiMSpgWQ5AXFP4hQZhgRVULjHWlDw+yESYYroOsuLgdK5gsH37vN +n/axvoLEh7TX5CYgMvE7wPL+zkDDi4JkUrMHU6FVobJtPcw4/AoyVQ72cI1A6f5S4xev3 +XyudJr7hrQ45Rycunso65CC1VO8xs7WvmUUqhOLiyrFj2o8pknB8CM72ExQSdpB5xEJuv +G/4rmDuaDfLDtO+z8eM8QjEwuDtNiEm9naWKvCNPi+w/I9/02CeYBb7W173caTdqQnhUi +GnGYTs35EuXyMsvnCTqX6HDPPBAAzaSRgvs/tL5VyDCemS2UwW/8NoxLxYrjLEEF6GMmE +KWjPtAbynE93941yFCddfOFfHbApip+re/suBHCjwHMRJZ60aY7mooFxPnkzHG6lzZHuk +dDWJnIrPsbeNPXN+pQxl6279qrlaJe2LEkie4X0FYGtJBMX4HVEcFgNXgF123svwFCRWg +k8c7YzOUbTer1q0pGXc3mLWagCGeZBjQGbofXfIJsuXvjs0BE1hzDrnSmlT8SNsvbmrX1 +JzMDwCWg5FEsdKOsfS5BPDwF6lT6lhnMh08en9ssTe1wgnDqVEKrzm5Svd9tO0qfnp/JD +AECD6mxhR9qK7HtrKkMGckg16JK0bkegVW+NXci78kxhF5ydnAeVxP51XwR+3x7XiTzTN +mEb3yCxgyh6TvjA9Xu/xLvaEk7Owsvc21hT+KSBaIvvJwbP2gtFPhpiGAFSfdC1g0Imx2 +MnpJOJrOVZhmIm0KrNZwMS+5u+0BjY6YJs75IAMAC338zQ1SJMMS/X1wvrl2QO0i8CEWZ +v3F+RyUg8pqAfliaiYzU45i0Drc3RC5008JeI8zHTOuNN+JZGsc2wwKeIqLeWjC8PvcaH +Bns4+doz/4H6J90vZh2HlVaPtRrCEqw2oY5cjM/C9KOt/MZy39RQbsgzM3ObKubCisYTG +hlMGboYNnMgXl6QsjBj8eOwFguMVG4D0v/2LX/qL72dZiGW4j3TKdFxzmmWibwyJv2MaP +KSXkNoSHwzUJzI8P/xFBoopoNguHT3Uv/JZjzG+Y5pM489RXQ7qg6D/K/B/LMNFzIQhh3 +3j7sx2WW7cWJtJa6dwz9iK7+7IbAxeaJ0r0BVal0BnD2eqMzT7dyCwe7DziGsGsZsNjGm +M4t82B8Sw9Ul7WpPQ0beEX4tSVYwEPP28/f6ewlhxMjxpowCZW/SFn3T799jLt74Q7REj +SZaYDGuXxNn9Ycz4aqXTVZ7VpmhuhNBypk6j/nqDh8YqM1DdB7PDEnGrC6QM5SdXQZZa5 +ulxLTRWjQStDjLjtqQgCvbCNytF+atSo7KR1OykjTYh54Mi06+PT0bpfYxl2z/QWn6aOW +RiBi7Nb1gyWKwdVzDI1VaYUUY3r1yPiNj3iN0R6rPsW0Sr7L7PD1L7Nv62OaKmXrLUmaP +4n6yqpBB/ygebax5Zn60mq7V4v9GVK5wOfFWK7yClCsYWXYMXHDcVrJIVMoKky0h7p/5S +BQXBOJ4Msn58IdsmneftukMKJIDVRo/wp4xico2xbmdxaggLfrRog3i56GbqifG6usON

Replies are listed 'Best First'.
Re: decode a file
by Fletch (Bishop) on May 22, 2022 at 05:09 UTC

    No one's probably going to be able to help because this perl itself does nothing but run an external command /usr/bin/faalsoft-oscamlast (presumably some sort of license or "copy protection" helper, given the obfuscation) with the argument "Q0IpKxohIQU9aC8MJg==" (possibly base64 encoded from the look but decoding doesn't provide anything elucidating). There are two pairs of pipes set up before the call is done and it reads back perl code from the first pipe presuming no output was produced on the second. Unless you had the code returned (stored in $UnxmOTO after the subroutine call) there's nothing here to "decode". As to the block of data after the __END__ it doesn't look to be accessed in this code at all (unless I've overlooked something; it's getting past bedtime . . .).

    Edit: Really other than the terrible formatting and garbage names used, there's nothing particularly "obfuscated" about this code in and of itself and it's pretty trivial. Any "magic" or real work done is by whatever payload the executable returns (which could of course be further obfuscated, or jump through another layer (e.g. calling the command with a different argument/key to produce another different chunk of code that does something else), or . . . . Maybe that returned code is doing something with the DATA filehandle and the rest of the trailing blob. /shrug

    The cake is a lie.
    The cake is a lie.
    The cake is a lie.

Re: decode a file
by LanX (Saint) on May 22, 2022 at 08:56 UTC
Re: decode a file
by eyepopslikeamosquito (Archbishop) on May 23, 2022 at 01:28 UTC
Re: decode a file
by Anonymous Monk on May 22, 2022 at 05:11 UTC
    the trick to decoding obfuscated Perl is always the same... replace "eval" with "print"

      In addition, see also B::Deobfuscate. I think there also is a module which does replace string-eval with print, but I don't find it at the moment.

      Update: There it is - overload::eval. You can use it from the command line as:

      perl -Moverload::eval=-p obfuscated.pl