No one's probably going to be able to help because this perl itself does nothing but run an external command /usr/bin/faalsoft-oscamlast (presumably some sort of license or "copy protection" helper, given the obfuscation) with the argument "Q0IpKxohIQU9aC8MJg==" (possibly base64 encoded from the look but decoding doesn't provide anything elucidating). There are two pairs of pipes set up before the call is done and it reads back perl code from the first pipe presuming no output was produced on the second. Unless you had the code returned (stored in $UnxmOTO after the subroutine call) there's nothing here to "decode". As to the block of data after the __END__ it doesn't look to be accessed in this code at all (unless I've overlooked something; it's getting past bedtime . . .).
Edit: Really other than the terrible formatting and garbage names used, there's nothing particularly "obfuscated" about this code in and of itself and it's pretty trivial. Any "magic" or real work done is by whatever payload the executable returns (which could of course be further obfuscated, or jump through another layer (e.g. calling the command with a different argument/key to produce another different chunk of code that does something else), or . . . . Maybe that returned code is doing something with the DATA filehandle and the rest of the trailing blob. /shrug
The cake is a lie.
The cake is a lie.
The cake is a lie.
In reply to Re: decode a file
by Fletch
in thread decode a file
by 3N3RGY
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |