Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations Mike Lewis on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

perl encryption

Status
Not open for further replies.

iamsamurai

Technical User
Jul 3, 2006
1
US
I have a perl script which I am trying to find out how to unencrypt. It is a simple backup script someone gave. The code is below. I understand and do not wish for others to decrypt this I just need someone to explain what is going on and kick me in the right direction for unencrypting this on my own.

my $xwKjKQ = '485a57584e4e96929f5c96...c9692e690eb6d';

\par
\par

$xwKjKQ =~ tr/19ef5\par
d206c83b47a/f23d6a890451b7ce/;

$xwKjKQ = eval pack ('H*',$xwKjKQ);

print STDER\par
 
The original code was fed into a variable as one long string and then was "unpacked" to make it into a string of hex numbers.

Example
Code:
my $command = "print hi";
my $string = unpack('H*',$command);
print $string;

To try and obscure the code a little more, a simple tr// operation was performed on the string.

Of course, perl can't execute this natively, so whatever steps where taken to hide the code have to be explicitly undone in the program in order to turn the code back into something readable by the perl interpreter. You can clearly see the steps needed to reverse the program here:

Code:
$xwKjKQ =~ tr/19ef5\pard206c83b47a/f23d6a890451b7ce/; # reverse the tr//
$xwKjKQ = eval pack ('H*',$xwKjKQ); # pack the unpacked code and use eval to force interpreter to run it

I tried this code at home but no result. I took the "\par" out of the tr//, tried it again, and got a result that appears to be the program. There are still some UTF characters that show up, so there is something funny going on that I am not sure of (I don't know what role \par plays), but it should get you pretty close.

 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top