B::Deobfuscate is a backend module for the Perl compiler that generates perl source code, based on the internal compiled structure that perl itself creates after parsing a program. It adds symbol renaming functions to the B::Deparse module. An obfuscated program is already parsed and interpreted correctly by the B::Deparse program. Unfortunately, if the obfuscation involved variable renaming then the resulting program also has obfuscated symbols.

B::Deobfuscate takes the last step and fixes names like $z5223ed336 to be a word from a dictionary. While the name still isn’t meaningful it is at least easier to distinguish and read. Here are two examples − one from B::Deparse and one from B::Deobfuscate.

Initial input

if(@z6a703c020a){(my($z5a5fa8125d,$zcc158ad3e0)=File::Temp::tempfile('UNLINK’,1));print($z5a5fa8125d "=over 8\n\n");(print($z5a5fa8125d @z6a703c020a)or die(((("Can’t print $zcc158ad3e0: $!"))); print($z5a5fa8125d "=back\n");(close(*$z5a5fa8125d)or die(((("Can’t close ".*$za5fa8125d.": $!") ));(@z8374cc586e=$zcc158ad3e0);($z9e5935eea4=1);}

After B::Deparse:

if (@z6a703c020a) {
    (my($z5a5fa8125d, $zcc158ad3e0) = File::Temp::tempfile(’UNLINK’, 1
+));
    print($z5a5fa8125d "=over 8\n\n");
    (print($z5a5fa8125d @z6a703c020a)
        or die((((q[Can’t print ] . $zcc158ad3e0) . ’: ’) . $!)));
    print($z5a5fa8125d "=back\n");
    (close(*$z5a5fa8125d)
        or die((((q[Can’t close ] . *$za5fa8125d) . ’: ’ . $!)));
    (@z8374cc586e = $zcc158ad3e0);
    ($z9e5935eea4 = 1);
}

[download]

After B::Deobfuscate:

if (@parenthesises) {
    (my($scrupulousity, $postprocesser) = File::Temp::tempfile(’UNLINK
+’, 1));
    print($scrupulousity "=over 8\n\n");
    (print($scrupulousity @parenthesises)
        or die((((q[Can’t print ] . $postprocesser) . ’: ’) . $!)));
    print($scrupulousity "=back\n");
    (close(*$scrupulousity)
        or die((((q[Can’t close ] . *$postprocesser) . ’: ’) . $!)));
    (@interruptable = $postprocesser);
    ($propagandaist = 1);
}

[download]

You’ll note that the only real difference is that instead of variable names like $z9e5935eea4 you get $propagandist.

Future versions of this will also add in some guessed types of variables so you'll get some Hungarian notation out too for filehandles, strings, numbers, etc.

In reply to Re^2: Is there a script somewhere to de-obfuscate code? by diotalevi
in thread Is there a script somewhere to de-obfuscate code? by nashr

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.