📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Target Specific - General  >>  perl2exe Compiled Perl Script

Topic created on: January 6, 2008 13:01 CST by dsk .

Hello all,

I've got a perl script compiled with perl2exe (http://www.indigostar.com/perl2exe.htm) of course the code is not only compiled as a ELF executable but it is obfuscated. Googling, I found out that earlier versions of perl2exe used simple XOR encryption (http://www.net-security.org/vuln.php?id=2464). Unfortunately the file that I have seems to have been compiled by a new version of perl2exe. So I'm asking for any clues that can help me in decompiling the file. Perhaps some of you guys have played with this? I also found this link http://web.archive.org/web/20030109212908/http://ddtm.simon-cozens.org/~simon/perl2exe
it has some info on the subject but honestly - I don't have any idea how to dump perl interpreter's memory. Home someone will help me.

  fileoffset     January 6, 2008 23:56.34 CST
You lucky bastard, i wrote a lil tutorial up a few weeks ago for people just like you :)

http://fileoffset.com/papers/perl2exe.htm

hope this helps...

  dsk   January 8, 2008 07:22.51 CST
Yep, that article helped a lot. But the thing is that I'm reversing ELF executable (on Linux) and the code that iterates through the extensions is in the dropper (as you refer to it) and not in an external file, dumped while the program is executing.
Also, how am I supposed to force the jumps at the proper addresses in IDA? What functions of IDA should I use? Furthermore, why it should dump the _main.pl if I force a jump at the address where it drops a file if it's a dll for example? More elaboration on that will be helpful.

Anyway, it's a great article and I hope you will be able to make some additions to it to make it even more detailed and easy to follow. I hope you will answer my questions. Thanks.

  fileoffset     January 8, 2008 18:26.59 CST
Are you saying that you are unable to debug your target? That you are analysing this only statically?

If so you really don't have much choice, you will need to dig deeper than I did and figure out the encryption used. I am famously lazy so I took the easy way out and dumped the files when it was running.

Also, the reason that it checks against a list of file extensions, and then dumps those decrypted files to disk is actually rather logical if you stop to think about it:

You have a resource you package up with your perl file, say a JPEG image that it shows in a splash screen. When the perl2exe 'dropper' iterates through all the files its got in memory, it finds any jpg file and drops it to the current directory (which is temp folder). That way when the perl code references the image to load it for the splash, it exists (and in a determinable place). It does this for a number of file types, which, if you look at the list carefully, make sense, as most of them are the types of files that really need to be on disk to be useful to the perl file (without very specialised handling of the format).

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit