How to debug an obfuscated self hashing program?

Question

I need to understand what the following obfuscated application does:

interpreter.py:
    string = "lambda x : obfuscated_code_to_interpret_variable_x"
    interpreter = eval(string)

    instructions = read_instructions(argv[1])
    interpreter(instructions)

instructions.txt:
    04GFUHSDSLGHLDFIHGLDSHLFHGLSDGHFLFSHGLIFSHLGFLGFIIGFL...

You run the application typing the command python3 interpreter.py instructions.txt

instructions.txt contains machine code (of some hypothetical machine). interpreter.py contains an interpreter that runs the machine code.

I want to modify the interpreter by adding print(variable) statements inside the string, to see what the code does.

The problem is that somewhere in the instructions.txt file, a file interpreter.py is read as a string, hashed, and checked that the hash equals to a predefined value. Thus, any modification to the interpreter variable will invalidate the hash.

I also have no idea what the numbers inside the instructions.txt file mean, because only the obfuscated interpreter understands the meaning of those numbers. So I can't remove the hash check from the instructions.txt file, because I don't know where it is.

Any ideas, how to deobfuscate such application?

Answer 1

If your suggestion that "the obfuscated code actually reads the file and checks the kind of checksum of it" is correct you can do the following (or at least that's the order of the actions I'd perform):

• First' I'd check that it really reads the file and not takes its contents from somewhere else. For this I'd run this on linux with strace and check how the python interpreter deals with this file on a level of system calls. If additional read exists, the option may be real. In addition it is possible that it loads some libraries, which can be seen when python interpreter is running with command line options -d (debug) and -v (verbose).
• If it opens "interpreter.py" I'd copy the script and run the copy from the same folder with changes. If it reads it by name and checks only its checksum the problem is solved.
• If this doesn't work, I'd suggest that it takes the file name from __FILE__ constant, and change it in the copy to point to the original file. If the same assumptions remain, problem solved.
• If this doesn't work, I'd try to check for a library function that computes checksum and override it. If it exists, overridden function will return the required value, and same assumptions remain, problem solved.
• In addition I'd check if it imports inspect module and calls something like inspect.getsource (this gets the source of the function). If it is so - just override it with something that will return the original function.
• If this doesn't work, I'd seriously try to understand the obfuscated function, but there is one more option: it is possible to write LD_PRELOAD like library which will override all the file IO, and will push to the obfuscated code the original version for computing the checksum.

Good luck.