1

I need to understand what the following obfuscated application does:

interpreter.py:
    string = "lambda x : obfuscated_code_to_interpret_variable_x"
    interpreter = eval(string)

    instructions = read_instructions(argv[1])
    interpreter(instructions)

instructions.txt:
    04GFUHSDSLGHLDFIHGLDSHLFHGLSDGHFLFSHGLIFSHLGFLGFIIGFL...

You run the application typing the command python3 interpreter.py instructions.txt

instructions.txt contains machine code (of some hypothetical machine). interpreter.py contains an interpreter that runs the machine code.

I want to modify the interpreter by adding print(variable) statements inside the string, to see what the code does.

The problem is that somewhere in the instructions.txt file, a file interpreter.py is read as a string, hashed, and checked that the hash equals to a predefined value. Thus, any modification to the interpreter variable will invalidate the hash.

I also have no idea what the numbers inside the instructions.txt file mean, because only the obfuscated interpreter understands the meaning of those numbers. So I can't remove the hash check from the instructions.txt file, because I don't know where it is.

Any ideas, how to deobfuscate such application?

4
  • Can you elaborate on how the obfuscated code obfuscated_code_to_interpret_variable_x looks like?
    – w s
    Jul 19 at 10:55
  • e.g. def x(y): return z(y+1) def z(x): return x if x ^ 234 < 10 else 0 ... and so on, like 200 functions, with if/else statements, maths expressions, such as (x || y && z ^ 2), all of that to construct one big function F, which is then evaluated with an argument x, so string = "lambda x : F(x)" Jul 19 at 11:05
  • @ws basically, the whole interpreter processing is hidden behind F(x). I would add print statements to print the variables of the inner functions of the implementation of F(x), if I see that some variable is a constant, then I can delete the code computing that variable to simplify the function, and keep iterating. This technique has worked for me before. But now adding print statements changes the value of string, and thus the hash(string). Jul 19 at 11:13
  • Are you sure that the integrity checking relies on reading the actual file ? Do you see something like such a file reading and hashing inside the obfuscated code?
    – w s
    Jul 19 at 11:26

1 Answer 1

2

If your suggestion that "the obfuscated code actually reads the file and checks the kind of checksum of it" is correct you can do the following (or at least that's the order of the actions I'd perform):

  • First' I'd check that it really reads the file and not takes its contents from somewhere else. For this I'd run this on linux with strace and check how the python interpreter deals with this file on a level of system calls. If additional read exists, the option may be real. In addition it is possible that it loads some libraries, which can be seen when python interpreter is running with command line options -d (debug) and -v (verbose).
  • If it opens "interpreter.py" I'd copy the script and run the copy from the same folder with changes. If it reads it by name and checks only its checksum the problem is solved.
  • If this doesn't work, I'd suggest that it takes the file name from __FILE__ constant, and change it in the copy to point to the original file. If the same assumptions remain, problem solved.
  • If this doesn't work, I'd try to check for a library function that computes checksum and override it. If it exists, overridden function will return the required value, and same assumptions remain, problem solved.
  • In addition I'd check if it imports inspect module and calls something like inspect.getsource (this gets the source of the function). If it is so - just override it with something that will return the original function.
  • If this doesn't work, I'd seriously try to understand the obfuscated function, but there is one more option: it is possible to write LD_PRELOAD like library which will override all the file IO, and will push to the obfuscated code the original version for computing the checksum.

Good luck.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.