Search code examples
cdeobfuscation

How this obfuscated C line prints "EMIL"?


Can you explain how does the following code work?

main(O){10<putchar(4^--O?77-(15&5128>>4*O):10)&&main(2+O);}

Output:

EMIL

You can test it on Ideone. I have found this line on unwind's profile.


Solution

  • Deobfuscation can easily be done in a step-by-step basis.

    White-space always helps:

    main(O)
    {
      10 < putchar(4 ^ --O ? 77 - (15 & 5128 >> 4 * O)
                           : 10)
      && main(2+O);
    }
    

    Add a variable:

    main(O)
    {
      int i = 4 ^ --O ? 77 - (15 & 5128 >> 4 * O)
                      : 10;
      i = putchar(i);
      10 < i && main(2+O);
    }
    

    Replace ?: with if-else:

    main(O)
    {
      int i;
      if (4 ^ --O)
        i = 77 - (15 & 5128 >> 4 * O)
      else
        i = 10;
      i = putchar(i);
      10 < i && main(2 + O);
    }
    

    Replace && with if:

    main(O)
    {
      int i;
      if (4 ^ --O)
        i = 77 - (15 & 5128 >> 4 * O)
      else
        i = 10;
      i = putchar(i);
      if (10 < i)
        main(2 + O);
    }
    

    Brackets for clarity:

    main(O)
    {
      int i;
      if (4 ^ --O)
        i = 77 - (15 & (5128 >> (4 * O)))
      else
        i = 10;
      i = putchar(i);
      if (10 < i)
        main(2 + O);
    }
    

    From here it's a simple case of applying basic C knowledge of operators.

    Run through the code: (initial parameter of main is 1, we can check this)

    main(1)
      4 ^ 0 = 4 = true
        5128 >> 4 * 0 = 5128
        15 & 5128 = 8
        i = 77 - 8 = 69
      putchar(69) -> 'E'
      10 < 69
        call main(2+0)
    main(2)
      ...
    

    How whomever wrote it came up with it? Well, to my knowledge, that's mostly a mystery when it comes to obfuscated code.