title: How to properly deobfusacte a Perl script?
body: <p>I'm trying to deobfuscate the following Perl code (<a href="http://www.cafepress.co.uk/+just_another_genome_hacker_white_t,5065189" rel="nofollow noreferrer">source</a>):</p>
  <pre><code>#!/usr/bin/perl
  (my$d=q[AA                GTCAGTTCCT
    CGCTATGTA                 ACACACACCA
      TTTGTGAGT                ATGTAACATA
        CTCGCTGGC              TATGTCAGAC
          AGATTGATC          GATCGATAGA
            ATGATAGATC     GAACGAGTGA
              TAGATAGAGT GATAGATAGA
                GAGAGA GATAGAACGA
                  TC GATAGAGAGA
                   TAGATAGACA G
                 ATCGAGAGAC AGATA
               GAACGACAGA TAGATAGAT
             TGAGTGATAG    ACTGAGAGAT
           AGATAGATTG        ATAGATAGAT
         AGATAGATAG           ACTGATAGAT
       AGAGTGATAG             ATAGAATGAG
     AGATAGACAG               ACAGACAGAT
    AGATAGACAG               AGAGACAGAT
    TGATAGATAG             ATAGATAGAT
    TGATAGATAG           AATGATAGAT
     AGATTGAGTG        ACAGATCGAT
       AGAACCTTTCT   CAGTAACAGT
         CTTTCTCGC TGGCTTGCTT
           TCTAA CAACCTTACT
             G ACTGCCTTTC
             TGAGATAGAT CGA
           TAGATAGATA GACAGAC
         AGATAGATAG  ATAGAATGAC
       AGACAGAGAG      ACAGAATGAT
     CGAGAGACAG          ATAGATAGAT
    AGAATGATAG             ACAGATAGAC
    AGATAGATAG               ACAGACAGAT
    AGACAGACTG                 ATAGATAGAT
     AGATAGATAG                 AATGACAGAT
       CGATTGAATG               ACAGATAGAT
         CGACAGATAG             ATAGACAGAT
           AGAGTGATAG          ATTGATCGAC
             TGATTGATAG      ACTGATTGAT
               AGACAGATAG  AGTGACAGAT
                 CGACAGA TAGATAGATA
                   GATA GATAGATAG
                      ATAGACAGA G
                    AGATAGATAG ACA
                  GTCGCAAGTTC GCTCACA
  ])=~s/\s+//g;%a=map{chr $_=&gt;$i++}65,84,67,
  71;$p=join$;,keys%a;while($d=~/([$p]{4})/g
  ){next if$j++%96&gt;=16;$c=0;for$d(0..3){$c+=
  $a{substr($1,$d,1)}*(4**$d)}$perl.=chr $c}
               eval $perl;
  </code></pre>
  <p>When run, it prints out <code>Just another genome hacker.</code></p>
  <p>After running the code trough <code>Deparse</code> and <code>perltidy</code> (<code>perl -MO=Deparse jagh.pl | perltidy</code>) the code looks like this:</p>
  <pre><code>( my $d =
  &quot;AA...GCTCACA\n&quot; # snipped double helix part
  ) =~ s/\s+//g;
  (%a) = map( { chr $_, $i++; } 65, 84, 67, 71 );
  $p = join( $;, keys %a );
  while ( $d =~ /([$p]{4})/g ) {
      next if $j++ % 96 &gt;= 16;
      $c = 0;
      foreach $d ( 0 .. 3 ) {
          $c += $a{ substr $1, $d, 1 } * 4**$d;
      }
      $perl .= chr $c;
  }
  </code></pre>
  <p>Here's what I've been able to decipher on my own.</p>
  <pre><code>( my $d =
  &quot;AA...GCTCACA\n&quot; # snipped double helix part
  ) =~ s/\s+//g;
  </code></pre>
  <p>removes all whitespace in <code>$d</code> (the double helix).</p>
  <pre><code>(%a) = map( { chr $_, $i++; } 65, 84, 67, 71 );
  </code></pre>
  <p>makes a hash with as keys <code>A</code>, <code>T</code>, <code>C</code> and <code>G</code> and as values <code>0</code>, <code>1</code>, <code>2</code> and <code>3</code>.
  I normally code in Python, so this translates to a dictionary <code>{'A': 0, 'B': 1, 'C': 2, 'D': 3}</code> in Python.</p>
  <pre><code>$p = join( $;, keys %a );
  </code></pre>
  <p>joins the keys of the hash with <code>$;</code> the <a href="http://perldoc.perl.org/perlvar.html" rel="nofollow noreferrer">subscript separator for multidimensional array emulation</a>. The documentation says that the default is &quot;\034&quot;, the same as SUBSEP in awk, but when I do:</p>
  <pre><code>my @ascii = unpack(&quot;C*&quot;, $p);
  print @ascii[1];
  </code></pre>
  <p>I get the value <code>28</code>? Also, it is not clear to me how this emulates a multidimensional array. Is <code>$p</code> now something like <code>[['A'], ['T'], ['C'], ['G']]</code> in Python?</p>
  <pre><code>    while ( $d =~ /([$p]{4})/g ) {
  </code></pre>
  <p>As long as <code>$d</code> matches <code>([$p]{4})</code>, execute the code in the while block. but since I don't completely understand what structure <code>$p</code> is, i also have a hard time understanding what happens here.</p>
  <pre><code>next if $j++ % 96 &gt;= 16;
  </code></pre>
  <p>Continue if the <code>$j</code> modulo 96 is greater or equal to 16. <code>$j</code> increments with each pass  of the while loop (?).</p>
  <pre><code>$c = 0;
  foreach $d ( 0 .. 3 ) {
      $c += $a{ substr $1, $d, 1 } * 4**$d;
  }
  </code></pre>
  <p>For <code>$d</code> in the range from <code>0</code> to <code>3</code> extract some substring, but at this point I'm completely lost. The last few lines concatenate everything and evaluates the result.</p>