B::Deobfuscate is a backend module for the Perl compiler that generates perl source code, based on the internal compiled structure that perl itself creates after parsing a program. It adds symbol renaming functions to the B::Deparse module. An obfuscated program is already parsed and interpreted correctly by the B::Deparse program. Unfortunately, if the obfuscation involved variable renaming then the resulting program also has obfuscated symbols.

B::Deobfuscate takes the last step and fixes names like $z5223ed336 to be a word from a dictionary. While the name still isn’t meaningful it is at least easier to distinguish and read. Here are two examples − one from B::Deparse and one from B::Deobfuscate.

Initial input

After B::Deparse:

if (@z6a703c020a) {
    (my($z5a5fa8125d, $zcc158ad3e0) = File::Temp::tempfile(’UNLINK’, 1
+));
    print($z5a5fa8125d "=over 8\n\n");
    (print($z5a5fa8125d @z6a703c020a)
        or die((((q[Can’t print ] . $zcc158ad3e0) . ’: ’) . $!)));
    print($z5a5fa8125d "=back\n");
    (close(*$z5a5fa8125d)
        or die((((q[Can’t close ] . *$za5fa8125d) . ’: ’ . $!)));
    (@z8374cc586e = $zcc158ad3e0);
    ($z9e5935eea4 = 1);
}
[download]

After B::Deobfuscate:

if (@parenthesises) {
    (my($scrupulousity, $postprocesser) = File::Temp::tempfile(’UNLINK
+’, 1));
    print($scrupulousity "=over 8\n\n");
    (print($scrupulousity @parenthesises)
        or die((((q[Can’t print ] . $postprocesser) . ’: ’) . $!)));
    print($scrupulousity "=back\n");
    (close(*$scrupulousity)
        or die((((q[Can’t close ] . *$postprocesser) . ’: ’) . $!)));
    (@interruptable = $postprocesser);
    ($propagandaist = 1);
}
[download]

You’ll note that the only real difference is that instead of variable names like $z9e5935eea4 you get $propagandist.

Future versions of this will also add in some guessed types of variables so you'll get some Hungarian notation out too for filehandles, strings, numbers, etc.