String replace in Perl

Question

I am trying to deobfuscate code. This code uses a lot of long variable names which are substituted with meaningful names at the time of running the code.

How do I preserve the state while searching and replacing?

For instance, with an obfuscated line like this:

${${"GLOBALS"}["ttxdbvdj"]}=_hash(${$urqboemtmd}.substr(${${"GLOBALS"}["wkcjeuhsnr"]},${${"GLOBALS"}["gjbhisruvsjg"]}-${$rrwbtbxgijs},${${"GLOBALS"}["ibmtmqedn"]}));

There are multiple mappings in mappings.txt which match above obfuscated line like:

$rrwbtbxgijs = hash_length;
$urqboemtmd = out;

At the first run, it will replace $rrwbtbxgijs with hash_length in the obfuscated line above. Now, when it comes across the second mapping during the next iteration of the outer while loop, it will replace $urqboemtmd with out in the obfuscated line.

The problem is:

When it comes across first mapping, it does the substitution. However, when it comes across next mapping in the same line for a different matching string, the previous search/replace result is not there.

It should preserve the previous substitution. How do I do that?

I wrote a Perl script, which would pick one mapping from mapping.txt and search the entire obfuscated code for all the occurrences of this mapping and replace it with the meaningful text.

Here is the code I wrote:

#! /usr/bin/perl

use warnings;

($mapping, $input) = @ARGV;

open MAPPING, '<', $mapping
    or die "couldn't read from the file, $mapping with error: $!\n";

while (<MAPPING>) {

    chomp;
    $line = $_;
    ($key, $value) = split("=", $line);
    open INPUT, '<', $input;

    while (<INPUT>) {

        chomp;
        if (/$key/) {

            $_=~s/\Q$key/$value/g;
            print $_,"\n";
        }
    }
    close INPUT;
}
close MAPPING;

TLP · Accepted Answer · 2012-09-30 11:05:48Z

3

To match the literal meta characters inside your string, you can use quotemeta or:

s/\Q$key\E/$replace/

answered Sep 30, 2012 at 11:05

TLP

68.2k10 gold badges97 silver badges156 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Neon Flash Over a year ago

Thanks. This works, I have updated my question. Could you please check it? I need to preserve the substitution stage. For instance, it makes one substitution in the line at a time. When, it finds another occurrence of a different mapping in the line, it should preserve the previous state. Which means, it should keep updating the same line as and when it finds a match.

TLP Over a year ago

@NeonFlash I understand every word you say, but have no idea what you mean. What does "preserve the substitution stage" mean? I assume you mean that you cannot check one key at the time. You might store the input file in an array instead of opening the file for each iteration. And save the print for last.

choroba · Accepted Answer · 2012-09-30 11:00:49Z

1

Just tell Perl not to interpret the characters in $key:

s/\Q$key/$value/g

answered Sep 30, 2012 at 11:00

choroba

245k27 gold badges221 silver badges304 bronze badges

1 Comment

Neon Flash Over a year ago

Thanks, it works :) I have updated the question. Could you please check it and suggest a good workaround for it?

ysth · Accepted Answer · 2012-09-30 18:46:17Z

1

Consider using B::Deobfuscate and gradually enter variable names into its configuration file as you figure out what they do.

I'm a little confused about your request to save state. What exactly are you doing/do you intend to do with the output? Here's an (untested) example of doing all the substitutions in one pass, if that helps?

my %map;
while ( my $line = <MAPPING> ) {
    chomp $line;
    my ($key, $value) = split("=", $line);
    $map{$key} = $value;
}
close MAPPING;

my $search = qr/(@{[ join '|', map quotemeta, sort { length $b <=> length $a } keys %map ]})/;
while ( my $line = <INPUT> ) {
    $line =~ s/$search/$map{$1}/g;
    print OUTPUT $line;
}

edited Sep 30, 2012 at 18:46

answered Sep 30, 2012 at 12:33

ysth

99.1k6 gold badges126 silver badges219 bronze badges

2 Comments

Neon Flash Over a year ago

Hi, that does seem useful however its very complicated. I would love to devote time to learn how to use it efficiently, however for the time being, is there a way to make my current script work? It is able to substitute the values properly, I just want it to preserve the state. Once a successful search/replace is done, it should be saved. The next, search/replace operation should work on the result of previous.

ysth Over a year ago

@Neon Flash: see added example/question in answer

Collectives™ on Stack Overflow

String replace in Perl

The problem is:

3 Answers 3

2 Comments

1 Comment

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

The problem is:

3 Answers 3

2 Comments

1 Comment

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related