0

How can I Deobfuscate this python code

Link to code

I tried to replace eval places by print. but it won't work and output is also obfuscated

Head of the code looks like this Head of the code looks like this

can anyone please help me

2

You're on the right track with replacing exec with print, you just didn't go deep enough.

The file you posted is, effectively, 7 python commands each wrapped up in a bunch of obfuscation (not including the initial import statement). If you deobfuscate each command by printing the result, the first one results in an import statement and a set of 4 more obfuscated python instructions (the rest of the lines result in junk or pass statements, as far as I can tell).

Now, if you do the same thing for the resulting 4 obfuscated python instructions from above, you get one more valid python instruction and 3 junk instructions. In this case, the third instruction was the one that gives valid code.

If you take this code and run it, you end up with another import statement and 3 obfuscated instructions. Repeat the process and the second instruction will spit out the (mostly) deobfuscated code.

It looks like it's meant to spam SMS messages or phone calls to Sri Lankan telephone numbers as a prank. I believe it came from https://github.com/Sl-Sanda-Ru/Sl-Bomber based on comments in the deobfuscated code. The commit history and some revisions to the README for the project seem to indicate that the author obfuscated the code because people were making trivial modifications and abusing it (go figure). If you want to see what it's doing, the commit history has deobfuscated versions of the older code; it doesn't look all that different from the deobfuscated code you posted.

1
  • Thank you very much for help, I'll try it. this is a challenge of my friend given to me. Your answer is really helpful. – Jaindu Charindith May 8 at 2:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.