Free perl obfuscation service

[L***@gmail.com]

Perl readability keeping you up at night? Worried someone else might
one day understand your spaghetti code? Say no more! Your job security
woes are over!

I needed to obfuscate a bunch of Perl scripts a while ago. Now Perl is
famous for being naturally obfuscated, but I had something more extreme
in mind. As the thought of further obfuscating my Perl scripts by hand
horrified me, I looked around for a free automated solution.

Long story short, I didn't find anything decent, so I wrote my own.
It's pretty neat, and handles (almost) all Perl constructs. I kept
working out the bugs until it was powerful enough to obfuscate itself
recursively an arbitrary amount of passes.

Anyway, the pricing for the commercial obfuscation stuff is absolutely
outrageous:

"The Stunnix Perl-Obfus Single Developer License costs $879, and can be
purchased online in our store. May be used by the same user on any
number of machines. Full text of the license is here."

So I turned my obfuscator program into a web service anybody can use
for free:

http://liraz.org/obfus.html

Enjoy!

[Apokrif]

Post by L***@gmail.com
So I turned my obfuscator program into a web service anybody can use
http://liraz.org/obfus.html

Why doesn't it rename variable names ?

[John Bokma]

Post by Apokrif

Post by L***@gmail.com
So I turned my obfuscator program into a web service anybody can use
http://liraz.org/obfus.html

Why doesn't it rename variable names ?

Because most programmers already use obfuscated variable names.

[L***@gmail.com]

Dear troll,

Yes it does. Had you actually tried submitting a program
to the service, this would be obvious.
Obfuscated Perl by:
1. Removing comments
2. Removing whitespace (including newlines!)
3. Encoding strings into hex
4. Substituting all meaningful symbols (scalars, arrays, functions,
etc.) into random garbage.

PS: I know you're not supposed to feed the trolls.

Post by Apokrif

Post by L***@gmail.com
So I turned my obfuscator program into a web service anybody can use
http://liraz.org/obfus.html

Why doesn't it rename variable names ?
--
`cat ~/.signature`

[Apokrif]

Post by Apokrif

Post by L***@gmail.com
http://liraz.org/obfus.html

Why doesn't it rename variable names ?

Yes it does. Had you actually tried submitting a program to the
service, this would be obvious.
[...]
4. Substituting all meaningful symbols (scalars, arrays, functions,
etc.) into random garbage.

Not always:

my $foo="hello";
print $foo;

(submit)

my $OO="\x68\x65\x6c\x6c\x6f";print $OO;

==============

my $foo="hello";

(submit)

my $foo="\x68\x65\x6c\x6c\x6f";

[Wes Groleau]

Post by L***@gmail.com
So I turned my obfuscator program into a web service anybody can use
http://liraz.org/obfus.html

Cool. I always thought being able to understand my own code
meant I was doing something wrong.

Or is this a way to steal my ideas? :-)

Here's another perl obfuscation technique:
Translate it into awk, then use a2p.

[Ala Qumsieh]

Post by L***@gmail.com
So I turned my obfuscator program into a web service anybody can use
http://liraz.org/obfus.html

I hate to be annoying (although sometimes I can't help it!) but it
doesn't seem to do much.

Input (rather contrived):
#!perl -w
use strict;
my $x = 0;
while ($x < 5) {
print <<EOBF;
I don't think this is obfuscated enough!
Checkout Acme::Bleach or Acme::EyeDrops for really clean programs ..
EOBF
sleep int rand 4;
}

And the output, surprisingly enough, is:
#!perl -w
use strict;my $OO0=0;while($OO0<5){print<<EOBF;I don't think this is
obfuscated enough! Checkout Acme::Bleach or Acme::EyeDrops for really
clean programs .. EOBF sleep int rand 4;}

(that's all in one line)
The only thing it did was remove linebreaks, and change var names, which
hardly qualifies as obfuscation. Moreover, the output is not valid Perl.

--Ala

[Rene Schickbauer]

Post by L***@gmail.com
Perl readability keeping you up at night? Worried someone else might
one day understand your spaghetti code? Say no more! Your job security
woes are over!

Nice try, but all i get is
---
#!/usr/bin/perl
while(<>){tr/A-Za-z/n-za-mN-ZA-M/;print;}
---

from
---
#!/usr/bin/perl

while (<>)
{
tr/A-Za-z/n-za-mN-ZA-M/;
print;
}
---

Ok, maybe it'll do better on longer programs, so let's try to obfuscate a
more complicated one:

---
#!/usr/bin/perl

use strict;
use warnings;

{
# Generate MD5 sums

print "Generating MD5-Sums\n";

my @flist = `ls *.php4 *.dx1 *.tmpl`;

open(my $ofile, ">", "md5.crc") or die("Can't open md5.crc for
writing");

foreach my $fname (@flist) {
chomp $fname;
next if($fname =~ /md5.crc/);
my $sum = `md5sum $fname`;
chomp $sum;
my @parts = split(" ", $sum);
$sum = $parts[0];
print "$fname|$sum\n";
print $ofile "$fname|$sum\n" or die("Can't write to md5.crc");
}

close $ofile or die("Can't close md5.crc after write");
}
---

and i get

---
#!/usr/bin/perl
use strict;use warnings;{print
"\x47\x65\x6e\x65\x72\x61\x74\x69\x6e\x67\x20\x4d\x44\x35\x2d\x53\x75\x6d\x73\x0a";my
@OO=`ls *.php4 *.dx1 *.tmpl`;open(my
$OO000,"\x3e","\x6d\x64\x35\x2e\x63\x72\x63")or
die("\x43\x61\x6e\x27\x74\x20\x6f\x70\x65\x6e\x20\x6d\x64\x35\x2e\x63\x72\x63\x20\x66\x6f\x72\x20\x77\x72\x69\x74\x69\x6e\x67");foreach
my $OO0(@OO){chomp $OO0;next if($OO0=~ /md5.crc/);my $OO0O0=`md5sum
$OO0`;chomp $OO0O0;my @OO00O=split("\x20",$OO0O0);$OO0O0=$OO00O[0];print
"$OO0\x7c$OO0O0\x0a";print $OO000 "$OO0\x7c$OO0O0\x0a" or
die("\x43\x61\x6e\x27\x74\x20\x77\x72\x69\x74\x65\x20\x74\x6f\x20\x6d\x64\x35\x2e\x63\x72\x63");}close
$OO000 or
die("\x43\x61\x6e\x27\x74\x20\x63\x6c\x6f\x73\x65\x20\x6d\x64\x35\x2e\x63\x72\x63\x20\x61\x66\x74\x65\x72\x20\x77\x72\x69\x74\x65");}
---
(Above example may be broken by my newsclient)

And it's still running (although i haven't checked the resulting file).

Of course, the "damage" the obfuscater made seems to be reversible without
too much effort - lacking of course comments after reversing the
obfuscation...

You might also work a bit on interchanging hex-code with octal and unchanged
ascii.

Of course, obfuscation is nice. But the *real* art of writing code no-one
can re-use is documented here:
<http://mindprod.com/unmain.html> "How to write unmaintainable code"

LLAP & LG
Rene