Could not able to understand Obfuscated C Code

c, obfuscation

Solution

As a start, you can get the code indented properly and remove the indirection caused by the `#define`s. The indentation can be done by GNU `indent` and `gcc -E` will do the preprocessing. Assuming the code is in `factorial.c` (this requires using the command line):

> gcc -E factorial.c | indent > clean_factorial.c

A thing to note is the preprocessing step will dump all of `stdio.h` into `clean_factorial.c`; but that is irrelevant information, so we should comment out/delete `#include<stdio.h>` before running `gcc -E`. This basically gives:

struct llll1
{
  struct llll1 *lll1l, *ll1l1;
  unsigned short lll[1000];
};
main ()
{
  struct llll1 *ll11, *l1l, *l1, *ll1l, *malloc ();
  unsigned long l1ll;
  long l11, ll, l;
  unsigned short *lll1, *lllll;
  for (l = 1 - 1; l < 14; putchar ("\t\"8)>l\"9!.)>vl"[l] ^ 'L'), ++l);
  scanf ("%d", &l);
  l1l = malloc (sizeof (struct llll1));
  l1l->lll1l = 1 - 1;
  l1l->ll1l1 = 1 - 1;
  ll11 = malloc (sizeof (struct llll1));
  ll11->lll1l = 1 - 1;
  ll11->ll1l1 = 1 - 1;
  (l1 = l1l)->lll[l1l->lll[1 - 1] = 1] = 0xFFFF;
  for (l11 = 1 + 1; l11 <= l; ++l11)
    {
      l1 = ll11;
      lll1 = (ll1l = (ll11 = l1l))->lll;
      lllll = (l1l = l1)->lll;
      ll = (l1ll = 1 - 1);
      for (; ll1l->lll1l || 0xFFFF != *lll1;)
        {
          l1ll += l11 ** lll1++;
          *lllll++ = l1ll % 10000;
          l1ll /= 10000;
          if (++ll > 1000)
            {
              if (!l1->lll1l)
                {
                  l1->lll1l = malloc (sizeof (struct llll1));
                  l1->lll1l->lll1l = 1 - 1;
                  l1->lll1l->ll1l1 = 1 - 1;;
                  l1->lll1l->ll1l1 = l1;
                }
              lllll = (l1 = l1->lll1l)->lll;
              ll = 1 - 1;
              lll1 = (ll1l = ll1l->lll1l)->lll;
            }
        }
      for (; l1ll;)
        {
          *lllll++ = l1ll % 10000;
          l1ll /= 10000;
          if (++ll >= 1000)
            {
              if (!l1->lll1l)
                {
                  l1->lll1l = malloc (sizeof (struct llll1));
                  l1->lll1l->lll1l = 1 - 1;
                  l1->lll1l->ll1l1 = 1 - 1;;
                  l1->lll1l->ll1l1 = l1;
                }
              lllll = (l1 = l1->lll1l)->lll;
              ll = 1 - 1;
            }
        }
      *lllll = 0xFFFF;
    }
  for (l = (ll = 1 - 1); (l < 1000) && (l1->lll[l] != 0xFFFF); ++l);
  for (; l1; l1 = l1->ll1l1, l = 1000)
    {
      for (--l; l >= 1 - 1; --l, ++ll)
        printf ((ll) ? ((ll % 19) ? "%04d" : (ll =
                                              19, "\n%04d")) : "%4d",
                l1->lll[l]);
    }
  putchar (10);
}

This is slightly readable, and we can do things like rename variables so that we can tell them apart easily, even if we don't know what they do yet. E.g. this will rename the struct to `structure`, and call the pointers inside it `left` and `right` (you can do this with the find-replace tool in your editor too):

> sed -i 's/llll1/structure/g; s/lll1l/left/g; s/ll1l1/right/g;' clean_factorial.c

(you have to be careful of the order, or the replacement for `lll` might conflict with `lllll`, for example).

There are some other easy things to do:

- `1 - 1` occurs a lot: replace it with `0` (and `1 + 1` too, except replace that with `2` instead of `0`).

- The line with `"\t\"8)>l\"9!.)>vl"[l] ^ 'L'` just goes along the string printing each character after xor'ing it with `'L'` (work out why! It might help to put the `putchar` in the body of the for loop, rather than in the comma-statement).

- `putchar(10)` just prints a new line.

- Know about the comma operator.

Other than that, it's just a lot of hard work. You can and should use tools like a debugger to trace the flow of execution and work out what is happening where.

Problem

Original source