B::Deobfuscate 0.18

B::Deobfuscate Perl module contains the deobfuscate source code.

SYNOPSIS

perl -MO=Deobfuscate,-csynthetic.yml,-y synthetic.pl

B::Deobfuscate is a backend module for the Perl compiler that generates perl source code, based on the internal compiled structure that perl itself creates after parsing a program. It adds symbol renaming functions to the B::Deparse module. An obfuscated program is already parsed and interpreted correctly by the B::Deparse program. Unfortunately, if the obfuscation involved variable renaming then the resulting program also has obfuscated symbols.

This module takes the last step and fixes names like $z5223ed336 to be a word from a dictionary. While the name still isnt meaningful it is at least easier to distinguish and read. Here are two examples - one from B::Deparse and one from B::Deobfuscate.

Initial input

if(@z6a703c020a){(my($z5a5fa8125d,$zcc158ad3e0)=File::Temp::tempfile(
UNLINK,1));print($z5a5fa8125d "=over 8nn");(print($z5a5fa8125d
@z6a703c020a)or die(((("Cant print $zcc158ad3e0: $!"))); print($z5a5fa8125d
"=backn");(close(*$z5a5fa8125d)or die(((("Cant close ".*$za5fa8125d.": $!")
));(@z8374cc586e=$zcc158ad3e0);($z9e5935eea4=1);}

After B::Deparse:

if (@z6a703c020a) {
(my($z5a5fa8125d, $zcc158ad3e0) = File::Temp::tempfile(UNLINK, 1));
print($z5a5fa8125d "=over 8nn");
(print($z5a5fa8125d @z6a703c020a)
or die((((q[Cant print ] . $zcc158ad3e0) . : ) . $!)));
print($z5a5fa8125d "=backn");
(close(*$z5a5fa8125d)
or die((((q[Cant close ] . *$za5fa8125d) . : . $!)));
(@z8374cc586e = $zcc158ad3e0);
($z9e5935eea4 = 1);
}

After B::Deobfuscate:

if (@parenthesises) {
(my($scrupulousity, $postprocesser) = File::Temp::tempfile(UNLINK, 1));
print($scrupulousity "=over 8nn");
(print($scrupulousity @parenthesises)
or die((((q[Cant print ] . $postprocesser) . : ) . $!)));
print($scrupulousity "=backn");
(close(*$scrupulousity)
or die((((q[Cant close ] . *$postprocesser) . : ) . $!)));
(@interruptable = $postprocesser);
($propagandaist = 1);
}

Youll note that the only real difference is that instead of variable names like $z9e5935eea4 you get $propagandist.