Search code examples
rubyobfuscationbytecodecompiled

Compiled or obfuscated Ruby

I have a set of files that seem to be obfuscated or compiled by Ruby. If I do a file [sic] to one of the files:

a /usr/bin/env ruby script text executable

all of them start with this:

#!/usr/bin/env ruby
require 'iseq';RubyVM::InstructionSequence.load(Marshal.load(File.read(__FILE__,nil,113))).eval

What is this file? How can I see the code or debug it?

NOTE: Ruby version ruby 2.1.3p242 (2014-09-19 revision 47630) [x86_64-linux]

Solution

  • This is code compiled to a Ruby Virtual Machine. It is using the iseq gem which exposes the private method RubyVM::InstructionSequence::load.

    You can't extract the original source code from it, but the debugger should work. You can read the compiled code in something like a human readable form with RubyVM::InstructionSequence#disassemble. Assuming Marshal.load returns a RubyVM::InstructionSequence object, this should do it.

    require 'iseq';puts RubyVM::InstructionSequence.load(Marshal.load(File.read(__FILE__,nil,161))).disass‌​emble