Could not able to understand Obfuscated C Code [closed]

Question

I saw this code in http://www.cise.ufl.edu/~manuel/obfuscate/obfuscate.html (http://www.cise.ufl.edu/~manuel/obfuscate/savastio) website.But this code is very very crazy. I could not able to understand what is happening when it is happening. Please help me. Let me know what is happening when each line is getting executed. e.g. printf function is there, if we will see there is no statement called as "Enter the number". But still while executing it is asking "Enter the number". From where it is comming. And why the code is written like this. It looks like "n!"(Though it means factorial). Please help me.

#include <stdio.h>

#define l11l 0xFFFF
#define ll1 for
#define ll111 if
#define l1l1 unsigned
#define l111 struct
#define lll11 short
#define ll11l long
#define ll1ll putchar
#define l1l1l(l) l=malloc(sizeof(l111 llll1));l->lll1l=1-1;l->ll1l1=1-1;
#define l1ll1 *lllll++=l1ll%10000;l1ll/=10000;
#define l1lll ll111(!l1->lll1l){l1l1l(l1->lll1l);l1->lll1l->ll1l1=l1;}\
lllll=(l1=l1->lll1l)->lll;ll=1-1;
#define llll 1000




                                                     l111 llll1 {
                                                     l111 llll1 *
      lll1l,*ll1l1        ;l1l1                      lll11 lll [
      llll];};main      (){l111 llll1                *ll11,*l1l,*
      l1, *ll1l, *    malloc ( ) ; l1l1              ll11l l1ll ;
      ll11l l11,ll  ,l;l1l1 lll11 *lll1,*            lllll; ll1(l
      =1-1 ;l< 14; ll1ll("\t\"8)>l\"9!.)>vl"         [l]^'L'),++l
      );scanf("%d",&l);l1l1l(l1l) l1l1l(ll11         ) (l1=l1l)->
      lll[l1l->lll[1-1]     =1]=l11l;ll1(l11         =1+1;l11<=l;
      ++l11){l1=ll11;         lll1 = (ll1l=(         ll11=l1l))->
      lll; lllll =(            l1l=l1)->lll;         ll=(l1ll=1-1
      );ll1(;ll1l->             lll1l||l11l!=        *lll1;){l1ll
      +=l11**lll1++             ;l1ll1 ll111         (++ll>llll){
      l1lll lll1=(              ll1l =ll1l->         lll1l)->lll;
      }}ll1(;l1ll;              ){l1ll1 ll111        (++ll>=llll)
      { l1lll} } *              lllll=l11l;}
      ll1(l=(ll=1-              1);(l<llll)&&
      (l1->lll[ l]              !=l11l);++l);        ll1 (;l1;l1=
      l1->ll1l1,l=              llll){ll1(--l        ;l>=1-1;--l,
      ++ll)printf(              (ll)?((ll%19)        ?"%04d":(ll=
      19,"\n%04d")              ):"%4d",l1->         lll[l] ) ; }
                                                     ll1ll(10); }

Answer 1

As a start, you can get the code indented properly and remove the indirection caused by the #defines. The indentation can be done by GNU indent and gcc -E will do the preprocessing. Assuming the code is in factorial.c (this requires using the command line):

> gcc -E factorial.c | indent > clean_factorial.c

A thing to note is the preprocessing step will dump all of stdio.h into clean_factorial.c; but that is irrelevant information, so we should comment out/delete #include<stdio.h> before running gcc -E. This basically gives:

struct llll1
{
  struct llll1 *lll1l, *ll1l1;
  unsigned short lll[1000];
};
main ()
{
  struct llll1 *ll11, *l1l, *l1, *ll1l, *malloc ();
  unsigned long l1ll;
  long l11, ll, l;
  unsigned short *lll1, *lllll;
  for (l = 1 - 1; l < 14; putchar ("\t\"8)>l\"9!.)>vl"[l] ^ 'L'), ++l);
  scanf ("%d", &l);
  l1l = malloc (sizeof (struct llll1));
  l1l->lll1l = 1 - 1;
  l1l->ll1l1 = 1 - 1;
  ll11 = malloc (sizeof (struct llll1));
  ll11->lll1l = 1 - 1;
  ll11->ll1l1 = 1 - 1;
  (l1 = l1l)->lll[l1l->lll[1 - 1] = 1] = 0xFFFF;
  for (l11 = 1 + 1; l11 <= l; ++l11)
    {
      l1 = ll11;
      lll1 = (ll1l = (ll11 = l1l))->lll;
      lllll = (l1l = l1)->lll;
      ll = (l1ll = 1 - 1);
      for (; ll1l->lll1l || 0xFFFF != *lll1;)
        {
          l1ll += l11 ** lll1++;
          *lllll++ = l1ll % 10000;
          l1ll /= 10000;
          if (++ll > 1000)
            {
              if (!l1->lll1l)
                {
                  l1->lll1l = malloc (sizeof (struct llll1));
                  l1->lll1l->lll1l = 1 - 1;
                  l1->lll1l->ll1l1 = 1 - 1;;
                  l1->lll1l->ll1l1 = l1;
                }
              lllll = (l1 = l1->lll1l)->lll;
              ll = 1 - 1;
              lll1 = (ll1l = ll1l->lll1l)->lll;
            }
        }
      for (; l1ll;)
        {
          *lllll++ = l1ll % 10000;
          l1ll /= 10000;
          if (++ll >= 1000)
            {
              if (!l1->lll1l)
                {
                  l1->lll1l = malloc (sizeof (struct llll1));
                  l1->lll1l->lll1l = 1 - 1;
                  l1->lll1l->ll1l1 = 1 - 1;;
                  l1->lll1l->ll1l1 = l1;
                }
              lllll = (l1 = l1->lll1l)->lll;
              ll = 1 - 1;
            }
        }
      *lllll = 0xFFFF;
    }
  for (l = (ll = 1 - 1); (l < 1000) && (l1->lll[l] != 0xFFFF); ++l);
  for (; l1; l1 = l1->ll1l1, l = 1000)
    {
      for (--l; l >= 1 - 1; --l, ++ll)
        printf ((ll) ? ((ll % 19) ? "%04d" : (ll =
                                              19, "\n%04d")) : "%4d",
                l1->lll[l]);
    }
  putchar (10);
}

This is slightly readable, and we can do things like rename variables so that we can tell them apart easily, even if we don't know what they do yet. E.g. this will rename the struct to structure, and call the pointers inside it left and right (you can do this with the find-replace tool in your editor too):

> sed -i 's/llll1/structure/g; s/lll1l/left/g; s/ll1l1/right/g;' clean_factorial.c

(you have to be careful of the order, or the replacement for lll might conflict with lllll, for example).

There are some other easy things to do:

• 1 - 1 occurs a lot: replace it with 0 (and 1 + 1 too, except replace that with 2 instead of 0).
• The line with "\t\"8)>l\"9!.)>vl"[l] ^ 'L' just goes along the string printing each character after xor'ing it with 'L' (work out why! It might help to put the putchar in the body of the for loop, rather than in the comma-statement).
• putchar(10) just prints a new line.
• Know about the comma operator.

Other than that, it's just a lot of hard work. You can and should use tools like a debugger to trace the flow of execution and work out what is happening where.

Answer 2

Here's my attempt at unwrapping it, got a bit stuck on the prompt logic, so I just initialized longC to zero, and printed out the request for a number manually:

#include <stdio.h>

struct StructName
{
    struct StructName *structA, *structB;

    unsigned short unsignedShortArrayA[1000];
};

main ()
{
    struct StructName *structC, *structD, *structE, *structF, *malloc();

    unsigned long unsignedLongA;

    long longA, longB, longC = 0;

    unsigned short *unsignedShortA, *unsignedShortB;

    //for(longC=0; longC< 14; putchar("\t\"8)>longC\"9!.)>vl" [longC]^'longC'),++longC )
    //;

    printf("%s", "Enter a number: " );

    scanf("%d", &longC);

    structD = malloc(sizeof(struct StructName));
    structD->structA=0;
    structD->structB=0;

    structC=malloc(sizeof(struct StructName));
    structC->structA=0;
    structC->structB=0;

    (structE=structD)->unsignedShortArrayA[structD->unsignedShortArrayA[0] =1] = 0xFFFF;

    for( longA=1+1;longA<=longC;++longA)
    {
        structE=structC;
        unsignedShortA = (structF=( structC=structD))->unsignedShortArrayA;
        unsignedShortB =( structD=structE)->unsignedShortArrayA;
        longB=(unsignedLongA=0);

        for( ; structF->structA || 0xFFFF != *unsignedShortA; )
        {
            unsignedLongA+=longA**unsignedShortA++;
            *unsignedShortB++=unsignedLongA%10000;
            unsignedLongA/=10000;

            if( ++longB>1000 )
            {
                if( !structE->structA )
                {
                    structE->structA=malloc(sizeof(struct StructName));
                    structE->structA->structA=0;
                    structE->structA->structB=0;

                    structE->structA->structB=structE;
                }

                unsignedShortB=(structE=structE->structA)->unsignedShortArrayA;
                longB=0;
                unsignedShortA=( structF =structF-> structA)->unsignedShortArrayA;
            }
        }

        for( ; unsignedLongA; )
        {
            *unsignedShortB++=unsignedLongA%10000;
            unsignedLongA/=10000;

            if( ++longB>=1000 )
            {
                if( !structE->structA )
                {
                    structE->structA=malloc(sizeof(struct StructName));
                    structE->structA->structA=0;
                    structE->structA->structB=0;

                    structE->structA->structB=structE;
                }

                unsignedShortB=(structE=structE->structA)->unsignedShortArrayA;
                longB=0;
            }
        }

        * unsignedShortB=0xFFFF;
    }

    for( longC=(longB=1- 1); (longC<1000) && (structE->unsignedShortArrayA[ longC] !=0xFFFF); ++longC )
    {
        ;
    }

    for( ; structE; structE=structE->structB, longC=1000 )
    {
        for( --longC; longC>=0; --longC, ++longB)
        {
            printf( (longB)?((longB%19) ? "%04d" : (longB=19,"\n%04d") ):"%4d",structE-> unsignedShortArrayA[longC] );
        }
    }

    putchar(10);
}

EDIT: Cleaned up a bit.