Skip to content

Instantly share code, notes, and snippets.

@iksteen iksteen/deobfuscate.py Secret
Last active Dec 21, 2015

Embed
What would you like to do?
Partial reversal of jbremer's python obfuscation.
import ast, _ast
import codegen
class Defuscate(ast.NodeTransformer):
def do_eval(self, node, typ):
return typ(eval(compile(ast.Expression(node), 'soep', 'eval')), lineno=0, col_offset=0)
def visit_BinOp(self, node):
node = self.generic_visit(node)
if isinstance(node.left, _ast.Num) and isinstance(node.right, _ast.Num):
return self.do_eval(node, ast.Num)
if isinstance(node.left, _ast.Str) and isinstance(node.right, _ast.Str):
return self.do_eval(node, ast.Str)
return node
def visit_Subscript(self, node):
node = self.generic_visit(node)
if isinstance(node.value, _ast.Str) and isinstance(node.slice, _ast.Slice):
return self.do_eval(node, ast.Str)
return node
def visit_Call(self, node):
node = self.generic_visit(node)
if isinstance(node.func, _ast.Name) and node.func.id == 'reversed':
if len(node.args) == 1 and isinstance(node.args[0], _ast.Str) and \
not node.keywords and not node.starargs and not node.kwargs:
return ast.Str(node.args[0].s[::-1], lineno=0, col_offset=0)
elif isinstance(node.func, _ast.Attribute) and \
isinstance(node.func.value, _ast.Str) and node.func.value.s == '' and \
node.func.attr == 'join' and \
not node.keywords and not node.starargs and not node.kwargs and \
len(node.args) == 1 and isinstance(node.args[0], _ast.GeneratorExp) and \
len(node.args[0].generators) == 1 and not node.args[0].generators[0].ifs and \
isinstance(node.args[0].generators[0].iter, _ast.Str):
return node.args[0].generators[0].iter
elif isinstance(node.func, _ast.Name) and node.func.id == 'chr' and \
isinstance(node.args[0], _ast.Num):
return ast.Str(chr(node.args[0].n), lineno=0, col_offset=0)
elif isinstance(node.func, _ast.Name) and node.func.id == 'getattr' and \
len(node.args) == 2 and isinstance(node.args[0], _ast.Name) and isinstance(node.args[1], _ast.Str):
return ast.Attribute(node.args[0], node.args[1].s, ast.Load(), lineno=0, col_offset=0)
return node
f = open('hitbctfchal.py').read()
m = ast.parse(f)
v = Defuscate()
m = v.visit(m)
print codegen.to_source(m)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.