deobfuscate.py

import base64
import marshal
import zlib
import re
import sys
import os

# --- Decoder Functions (Reverted to the WORKING format) ---

def decoder_zlib_base64(s):
    """Decodes Base64 and decompresses Zlib data."""
    # Rely on Base64 decoder to handle padding, which was successful in the working iteration.
    data = base64.b64decode(s)
    return zlib.decompress(data)

def decoder_base64(s):
    """Decodes Base64 data."""
    # Rely on Base64 decoder to handle padding.
    return base64.b64decode(s)

# --- Pattern Definitions (Highly Robust) ---

# Pattern 1: zlib.decompress(base64.b64decode('...')) - Uses non-greedy capture (.*?)
PATTERN_ZLIB_B64 = (
    r"zlib\.decompress\s*\(\s*base64\.b64decode\s*\(\s*['\"](.*?)['\"]\s*\)\s*\)\s*"
)

# Pattern 2: base64.b64decode('...') - Uses non-greedy capture (.*?)
PATTERN_B64 = (
    r"base64\.b64decode\s*\(\s*['\"](.*?)['\"]\s*\)\s*"
)

# Pattern 3: marshal.loads(b'...')
PATTERN_MARSHAL = r"marshal\.loads\s*\(\s*(b['\"])(.*?)\1\s*\)"

# Utility for final content check
OBFUSCATION_HEADERS = ['base64.b64decode', 'marshal.loads', 'zlib.decompress']


# List of all patterns, their decoder functions, and display names
DEOBFUSCATION_CHAIN = [
    (PATTERN_ZLIB_B64, decoder_zlib_base64, "Zlib+Base64"),
    (PATTERN_B64, decoder_base64, "Simple Base64"),
]

# --- Main Logic ---

def iterative_deobfuscate(content):
    """
    Iteratively removes obfuscation layers until plain code or an unsupported format is reached.
    Returns: The final decoded content (string or bytes) and the final obfuscation type.
    """
    current_content = content
    current_obf_type = "Initial"
    layer = 1
    
    while True:
        original_content = current_content
        found_match = False
        
        # 1. Marshal.loads check (Skipped here for brevity, keeping the logic consistent with previous successful versions)
        if 'marshal.loads' in current_content:
            match = re.search(PATTERN_MARSHAL, current_content, re.DOTALL)
            
            if match:
                found_match = True
                current_obf_type = "Marshal"
                
                quote_type = match.group(1)
                bytes_repr = match.group(2)
                
                print(f"\n[+] Layer {layer}: Marshal layer detected.")
                print(f"Debug: Marshal raw bytes captured (length: {len(bytes_repr)})")

                try:
                    bytes_content = eval(quote_type + bytes_repr + quote_type[-1])
                    decoded = marshal.loads(bytes_content)
                    
                    if isinstance(decoded, bytes):
                        print("[!] Marshal successful. Result is compiled bytecode.")
                        return decoded, f"{current_obf_type} (Bytecode)"
                    
                    current_content = decoded.decode('utf-8') if isinstance(decoded, bytes) else str(decoded)
                    print(f"[+] Layer {layer} removed: Marshal (Source). New content length: {len(current_content)}")
                    layer += 1
                    continue

                except Exception as e:
                    print(f"[!] Marshal decode failed: {e}")
                    return original_content, "Failed Marshal"
        
        # 2. Iterate through other common patterns (Zlib/Base64)
        for pattern, decoder_func, obf_name in DEOBFUSCATION_CHAIN:
            
            print(f"Debug: Trying pattern: {obf_name}")
            
            # Use re.search across the whole content (reverting back to the simple search that worked)
            match = re.search(pattern, current_content, re.DOTALL)

            if match:
                found_match = True
                current_obf_type = obf_name
                encoded_str = match.group(1)
                
                print(f"\n[+] Layer {layer}: {obf_name} detected.")
                print(f"Debug: Encoded string captured (length: {len(encoded_str)})")

                try:
                    decoded = decoder_func(encoded_str)
                    
                    # Attempt to decode to utf-8
                    try:
                        current_content = decoded.decode('utf-8')
                        print(f"[+] Layer {layer} removed: {obf_name}. New content length: {len(current_content)}")
                    except UnicodeDecodeError:
                        current_content = decoded
                        print("[!] Decompressed data is not UTF-8 (likely next layer is bytecode/marshal).")
                        return current_content, f"{obf_name} (Bytes)"
                    
                    layer += 1
                    # Success! Break out of for-loop to continue to next while-loop iteration
                    break 
                except Exception as e:
                    # Crucially: Log the failure, and revert the match flag.
                    # DO NOT return immediately. This allows the loop to check the next pattern
                    # and eventually finish the whole iterative process gracefully.
                    print(f"[!] {obf_name} decode failed: {e}. Skipping this pattern.")
                    found_match = False
    
        # 3. Check if any decoding/pattern matching occurred in this iteration
        if not found_match:
            # No supported obfuscation pattern was found in this pass. Exit loop.
            break

    return current_content, current_obf_type

def main():
    input_file = input("Enter the encoded file name (e.g., encoded.py): ").strip()
    if not input_file:
        print("Error: Input file name required.")
        sys.exit(1)

    try:
        with open(input_file, 'r') as f:
            initial_content = f.read()
        print(f"Debug: File loaded (length: {len(initial_content)})")
    except FileNotFoundError:
        print(f"Error: {input_file} not found.")
        sys.exit(1)
    except Exception as e:
        print(f"Read error: {e}")
        sys.exit(1)

    # --- Start the iterative process ---
    final_content, final_type = iterative_deobfuscate(initial_content)
    
    # --- Final Output & Saving ---
    output_file = 'original_deobfuscated.py'

    if isinstance(final_content, str):
        # 1. Save the content
        with open(output_file, 'w') as out:
            out.write(final_content)
            
        # 2. Determine final status: If the final_type doesn't say "Failed," assume success.
        is_failure = "Failed" in final_type
        
        # 3. Print result
        print("\n=======================================================")
        if is_failure:
            print(f"[ERROR] Deobfuscation stopped due to decoding failure.")
        else:
            # This is the correct success message when the iterative loop completed naturally.
            print(f"[SUCCESS] Deobfuscation Complete! All accessible layers removed.")
        
        print(f"Final output saved to: {output_file}")
        # Only show "Plain Source Code" if it wasn't a specific failure type
        final_status_display = final_type if is_failure else "Plain Source Code"
        print(f"Final content type: {final_status_display}")
        print("=======================================================")
        
    elif isinstance(final_content, bytes):
        # Handle Bytecode (Marshal) output
        bytecode_file = 'original_bytecode.pyc'
        with open(bytecode_file, 'wb') as out:
            out.write(final_content)
        print("\n=======================================================")
        print(f"[SUCCESS] Deobfuscation Complete, but stopped at Bytecode.")
        print(f"Final data saved to: {bytecode_file}")
        print(f"Final content type: {final_type}. A decompiler (e.g., uncompyle6) is required.")
        print("=======================================================")
        
    else:
        print("\n[ERROR] Deobfuscation failed to find any supported pattern.")
        print("File content remains unchanged.")

if __name__ == "__main__":
    main()