Partial reversal of jbremer's python obfuscation.

deobfuscate.py

import ast, _ast
import codegen

class Defuscate(ast.NodeTransformer):
  def do_eval(self, node, typ):
      return typ(eval(compile(ast.Expression(node), 'soep', 'eval')), lineno=0, col_offset=0)

  def visit_BinOp(self, node):
    node = self.generic_visit(node)

    if isinstance(node.left, _ast.Num) and isinstance(node.right, _ast.Num):
      return self.do_eval(node, ast.Num)

    if isinstance(node.left, _ast.Str) and isinstance(node.right, _ast.Str):
      return self.do_eval(node, ast.Str)
    
    return node

  def visit_Subscript(self, node):
    node = self.generic_visit(node)

    if isinstance(node.value, _ast.Str) and isinstance(node.slice, _ast.Slice):
      return self.do_eval(node, ast.Str)

    return node

  def visit_Call(self, node):
    node = self.generic_visit(node)

    if isinstance(node.func, _ast.Name) and node.func.id == 'reversed':
      if len(node.args) == 1 and isinstance(node.args[0], _ast.Str) and \
          not node.keywords and not node.starargs and not node.kwargs:
        return ast.Str(node.args[0].s[::-1], lineno=0, col_offset=0)
    elif isinstance(node.func, _ast.Attribute) and \
        isinstance(node.func.value, _ast.Str) and node.func.value.s == '' and \
        node.func.attr == 'join' and \
        not node.keywords and not node.starargs and not node.kwargs and \
        len(node.args) == 1 and isinstance(node.args[0], _ast.GeneratorExp) and \
        len(node.args[0].generators) == 1 and not node.args[0].generators[0].ifs and \
        isinstance(node.args[0].generators[0].iter, _ast.Str):
      return node.args[0].generators[0].iter
    elif isinstance(node.func, _ast.Name) and node.func.id == 'chr' and \
        isinstance(node.args[0], _ast.Num):
      return ast.Str(chr(node.args[0].n), lineno=0, col_offset=0)
    elif isinstance(node.func, _ast.Name) and node.func.id == 'getattr' and \
        len(node.args) == 2 and isinstance(node.args[0], _ast.Name) and isinstance(node.args[1], _ast.Str):
      return ast.Attribute(node.args[0], node.args[1].s, ast.Load(), lineno=0, col_offset=0)

    return node
    
f = open('hitbctfchal.py').read()
m = ast.parse(f)
v = Defuscate()
m = v.visit(m)
print codegen.to_source(m)