Unfuck: A utility for deobfuscating Python 2.7 bytecode

https://github.com/landaire/unfuck

by mmastrac • 5 years ago

82 30 5 years ago

voz_• 5 years ago

Ooof, really bad name. Makes me think the project or maintainer are immature...

sodality2• 5 years ago

Do you think the same for Brainfuck?

johnny53169• 5 years ago

Not OP but yes, but free stuff can be as immature as they want, who is it going to be upset?

echelon2• 5 years ago

I absolutely adore the name.

landr0id4• 5 years ago

I am the maintainer. I explained on reddit:

Why the name?
There were many times that I looked at a code graph and said “this is fucked”. Seemed like a good name.

it's just a fun side project. not that serious

pmdulaney2• 5 years ago

I was at a social event many years ago at a friend's home. Several families and their children were in attendance. One child started pulling books out of a bookcase. The mother said to the host, "Do you mind Jimmy taking books out of your bookcase?" She answered, "Well, I don't really mind -- but do you really want to be training your child that it's ok to be doing this?"

Yes, I do find it crass and offensive. But the real question is: Do you want to be known as someone who glibly uses this kind of language -- not even in a fit of anger, but totally gratuitously?

dbsmith83• 5 years ago

Makes me think you are uptight. It's just a side project

handrous• 5 years ago

Counterpoint: un-fuck is maybe the most engineery naughty word that exists.

echelon2• 5 years ago

"Successback". It's not naughty, it's just gross.

Failover / failback --> Successover / successback

Ugh.

xvilka3• 5 years ago

Not to deobfuscate, but Rizin[1][2] supports disassembling the Python bytecode for both 2.x and 3.x versions out of the box.

[1] https://rizin.re

[2] https://github.com/rizinorg/rizin

landr0id4• 5 years ago

I haven't heard of this tool before, but I don't think it would work for obfuscated code. Check out the graph image on my wiki [1]. While this image doesn't show the exact scenario, imagine that the first instruction is a `JUMP_ABSOLUTE 100` and the rest of the instructions between offset [3,100) are just garbage or invalid.

A naive disassembler (like the `dis` module in python) interprets the bytecode linearly -- i.e. one instruction after another. Rizin's diassembler [2] seems to take the same approach. The way I do disassembly is to only disassemble code paths that are potentially executed by queueing non-conditional jumps, both targets of a conditional jump, and the next instruction when the current instruction is non-jumping instruction.

[1] https://github.com/landaire/unfuck/wiki/Obfuscation-Tricks

[2] https://github.com/rizinorg/rizin/blob/e3d1b967854c33cf9dfbb...

sharikone• 5 years ago

Rizin is basically the name of a fork of Radare2 disassembler after the community had particularly nasty "value" disagreements.

xvilka3• 5 years ago

Thanks for the details, we will look into that.

ameminator2• 5 years ago

Look, I get that edgy names are fun, but I'm happy that I will never have to use this tool for work, and I pity the fool who has to explain why "unfuck" was needed to solve a real problem.

tasogare• 5 years ago

Thanks for giving me an idea: I'll name each of my project I don't want to be used in professional setting with outrageous names for Americans. Btw Coq will be soon free to use for another project.

gunfighthacksaw2• 5 years ago

I’m going to write a personal budgeting app and call it <redacted for pearl-clutching Americans> (an archaic word for miser/pennypincher, roughly homophonous but etymologically unrelated to an extremely offensive slur)

ameminator2• 5 years ago

(Un)fortunately, it should be recognized that the name of the tool has an impact on what people will want to use. I think it's deliberately obtuse to ignore that certain workplaces just don't accept language like this.

But you go ahead and name your projects whatever foul names you can think of. It will never come back to bite you, I promise.

barongrounds• 5 years ago

The Fuck[1] is a handy tool that I use daily in the office.

Is fsck something you'd avoid because of its name, or is the single letter change enough to make it safe?

[1] https://github.com/nvbn/thefuck

akerl_• 5 years ago

Fsck stands for file system check

jordemort• 5 years ago

I feel bad for the person that had to deal with obfuscated Python 2.7 bytecode so frequently that they had the itch to write this.

landr0id4• 5 years ago

Myself and other “enthusiasts” wanted to know how certain functionality was implemented in a commercial application, so I wrote this. I was taking about a month off from work for a winter break and spent 2 weeks deep diving and reverse engineering the initial PoC, and some time off and on over the next 2 months or so refining it. So far it’s been an invaluable tool for this enthusiast community.

arthur2e5• 5 years ago

I’ve seen people obfuscating .NET, gotta say seeing python bytecode getting used like this is a first…

God I hope the RenPy game studios don’t see the obfuscator.

shoghicp• 5 years ago

Interesting dual licensing

This project is dual-licensed under MIT and the ABSE ("Anyone But Stefan Esser") license. Note that an additional exception to the license is added, forbidding use/redistribution of said content to his trainees as well, but only when in a 5 mile radius from "Stefan Esser" or while holding any sort of (video)conference/chat with him.
Note that this license will only be used as long as what would capstone decode / that one other arm64 ida plugin thing by i0n1c ("Stefan Esser") are not under the MIT license. afterwards, all exceptions are cleared and basically MIT license applies

colejohnson66• 5 years ago

But why?

nonameiguess• 5 years ago

Others have expressed the thought that this is a bad name because of obscenity. I think it's a bad name for another reason. It's incredibly generic and very likely people are already using some tool, likely an internal one, with exactly the same name. My houseguest was just bragging yesterday about a tool called unfuck he wrote for Wikipedia when he was there.

Call it py27-unfuck or unfuck-py27.

Reminds me of a guy who wrote a tool called "cmp" at an old employer. Stupid choice, man.