All;
I am new to this forum. I am working on a project using a piece of commercial software (that I paid for and have a license for) that is written in PERL and uses a obfuscation process. What I am trying to do is add custom features to this software that I feel are necessary for my customers. However, the writers of the product are not able to justify developing these features in terms of time and money involved. What are my best options here? I am open to suggestions.
Thanks
FSD

Are you saying that the application is delivered in plaintext Perl script files, that have obfuscated code in them? Or something else?

Yes, that is correct. The product is delivered as a bunch of PERL/CGI files that are already obfuscated. The only clue I have as to how it is encrypted is the PERL module RC4.pm located in one of the directories. Typically, the files would look something like this:

#!/usr/bin/perl
my $xpGD_Z = q"{76:$3U9gn5:8:w/z{);L1Fp8J$_=$xpGD_Z;
undef($xpGD_Z);eval;

Like I said, I paid for this software and have a valid license for it, but I need to add more functionality. Any improvements I make will go into the public domain.

why don't you ask author to add those features? would save you a lots of time

Dude, I only wish life was that easy. I tried multiple times to no avail. I even asked if I could get access to the source if I signed an NDA and gave him copies of my work in return. The company is not responsive at all.

Without knowing much detail about what functionality you wish to add to the program, it is my impression that you risk spending quite a bit of time and effort reconstructing obfuscated code in order to reuse and expand over the package functionality. In fact de-obfuscating the modules could well take you longer than re-writing the necessary code from scratch.

Fortunately PERL and CGI environment share a very convenient feature: The input and the output are accessible, plain text, even if the algorithms may remain hidden in a black box fashion. Ask yourself, how much of the extra functionality you wish to add to the package can be implemented by looking at the raw input data and or the raw output data? In the field I have a little experience with, Mass Spectroscopy analysis, the answer is: Quite a bit.

Another avenue to explore, in case you have not searched before. Is there an open source equivalent to the software package in question? Chances are it will not have all the bells and whistles of the commercial, obfuscated product, but you would be on much safer technical grounds, not to mention safer legal grounds if you plan to repackage and sell your improved product to your clients.

It is usually relatively simple to write de-obfuscators for scripting languages, except that you will probably never get back the real names of functions, variables etc.

You will be able to trace the deobfuscated program in a debugger though, which might be enough to find the correct point to inject your patch, which preferably would be done by a small "hook" that jumps to real/readable code in a Perl module of your own.

My condolences for having to deal with obfuscated Perl code though, it's obfuscated enough in its original format.

eh eh, I agree, even if someone may assert that assembler is more obfuscated than Perl...

to the good hints of dELTA (and naides) I would recommend to use google as usual: it is possible that that kind of obfuscation was made by someone else, and documented in some way... unfortunately RC4.PM is too little as a clue (there are 1180 entries in Google and the dot cannot be forced - by the way, does anybody know if forcing the dot is possible, in other words: searching EXACTLY rc4.pm? -): formulate your search adding something more...

Best regards, bilbo

RC4 sounds like the encryption algo.
Here's some hits for rc4.pm:
http://www.google.com/codesearch?q=rc4%5C.pm

Put the search term in quotes ;

"rc4.pm"

http://www.google.com/search?hl=en&q=%22rc4.pm%22&aq=f&oq=

Woodmann

that's not exact: it will give the 1180 superfluous results...

that's a great hint, and - strangely - the backslash(5C) is required before the dot: without the backslash only 4 results are shown

Anyway, it looks like I was wrong: no ready to use Perl obfscation method using RC4 seems available on the net...

Best regards, bilbo

Backslash escapes the period - otherwise it means "any symbol" (regular expression syntax).

I see, reverser, but if this would be true I should find more hits, not less!
Best regards, bilbo

I don't believe the perl code is obfuscated, just encrypted, by calling eval function it will evaluate the encrypted text, decrypt it, and again I bet the decrypted text will call eval to execute itself in it's decrypted state. So eventually eval function will accept the code in clear text. Maybe you should locate eval function and dump it's parameters when called.