Need help explain an obfuscated C++ code?

Question

This code snippet drove me crazy, anyone could help me explain this?

#include <stdio.h>
char*_="XxTIHRCXCxTIHRXRCxTIHXHRCxTIXIHRCxTXTIHRCxXxTIHRCX";
int main(int l){for(l+=7;l!=putchar(010);++l);if(*(++_))main
    (*_!=88?(putchar(*_^073)|putchar(33))&1:0xffff2a8b);}

Thanks,
Chan Nguyen

Answer 1

In order to understand how this code works, start rewriting it in a readable way:

#include <stdio.h>

char*_="XxTIHRCXCxTIHRXRCxTIHXHRCxTIXIHRCxTXTIHRCxXxTIHRCX";

int main(int l)
{
    for( l += 7; l != putchar(010); ++l ) {
    }

    if( *(++_) ) {
        main( ( *_ != 88 ) ? ( putchar(*_^073) | putchar(33) )&1 : 0xffff2a8b );
    }

    return 0;
}

Now let's understand it:

• its parameter l (which will be 1, if you run this program without parameters) gets incremented by 7 (it becomes 8)

• the loop will print 010 (octal for 8: ascii backspace) until l==8 (thus it won't do anything when you run the program

• if the next character pointed by _ (it's x now) is different than 0 (this will probably mean "until we reached the end of _"), main is called, but lets see what happens while we're evaluating its parameters:

  • the character currently pointed by _ is different from 88 (88 is x in ascii), thus the parameter for main will be the result of expression ( putchar(*_^073) | putchar(33) )&1:

    while evaluating main's parameter two characters will be printed

    • first one is: *_^073, that's it, 120^59 (since x is 120, in ascii, and 073 in octal is 59 in decimal), which is 67: 120(0b1000011) XOR 59(0b111011) = 67 0b1000011

    • second one is 33 (!)

    main parameter will then be the result of (67|33)&1, which is 1

If you really want to understand what happens in the details you'll have to go on with this work, but you'll be able to see what happens by running the program (maybe put an usleep(10000) somewhere, so that you can actually see the output). It will write a roteating string "Corsix!".

Writing a program like this is pretty easy: once you decide how your algorithm works, it's easy to generate a string, like _, that makes the algorithm generate what you want, but to reverse engineer it is a lot more difficult.