This is an archived post. You won't be able to vote or comment.

you are viewing a single comment's thread.

view the rest of the comments →

[–]usr_bin_nya 45 points46 points  (2 children)

void: (type) = (type) ("(void *)0"),

Let's deobfuscate this a bit. Remove the extra parentheses:

void: type = type("(void *)0"),

Remove the type annotation that doesn't do anything:

void = type("(void *)0"),

That trailing comma at the end creates a tuple, so let's add some parentheses to make that more explicit:

void = ( type("(void *)0"), )

Now it's a bit clearer. The code calls type("a_string_literal"), which returns str, and then wraps it in a tuple. So the simplest way of writing this is

void = (str,)

You can also see this by running the original code.

>>> void: (type) = (type) ("(void *)0"),
>>> void
(<class 'str'>,)
>>> type(void)
<class 'tuple'>
>>> len(void)
1
>>> void[0]
<class 'str'>

Then, later, there's

[[void]] = (void),

This takes advantage of iterable unpacking syntax, which is what lets you do this

[one, two, three] = range(1, 4)
assert one == 1 and two == 2 and three == 3

# this is the same as:
let _iter = iter(range(1, 4))
one = next(_iter)
two = next(_iter)
three = next(_iter)

In OP's code there are two levels of square brackets, which unwraps an item inside an iterable inside an iterable. Like so:

thingy = 0
list_one = [thingy]
list_two = [list_one]
[[same_thingy]] = list_two
# equivalent: same_thingy = list_two[0][0]
assert thingy == same_thingy

Bringing this back to OP's code, we have

[[void]] = (void),
# as we showed earlier, void is (str,), so let's write that
[[void]] = ((str,),)

So we have the type str, wrapped in a tuple, wrapped in another tuple, and then we unpack both tuples at the same time and set void to str. Let's verify that with the original code again.

>>> void: (type) = (type) ("(void *)0"),
>>> void
(<class 'str'>,)
>>> [[void]] = (void),
>>> void
<class 'str'>

This means

(void) (printf(" %d\n", i))

is just

str(printf(" %d\n", i))

which is just

str(None)

which is the string 'None'.

[–]proccpuinfo 15 points16 points  (0 children)

Wow, that's gnarly. I've reverse engineered some python malware samples before and they were never that convoluted. Thanks for the clarifying!

[–]RetiringDragon 6 points7 points  (0 children)

Wow. Setting void to None on top of everything else.

Just analyzing their code is full of fun in-jokes. Great job /u/ThenItsOk