note
Adam
Yes, you caught the general ideas, but I'll explain the parts you had questions on. Your formating of the code is correct, and the $a assignment is definatly there to throw you, which it didn't. <P>
<tt>*$=sub{};</tt> is equivalent to <tt>&$=sub{}</tt>. This is equivalent to <tt>sub $ {}</tt>, except that you can't do that. The magic is in the typeglob, which recognizes that its getting an anonymous sub, and names it &$. The value of $$ (the PID) is left unchanged. :-)<P>
Next, you said: <i>sub u(){$_} is the same as sub u { return $_; }</i>, which it isn't. The parens() act as an empty prototype basically telling Perl that the letter u by itself is a valid function call. Otherwise you have to use &u or u(). This allows the <tt>u=>u</tt> in the next line. Also note that even though this sub is defined inside the scope of the other sub, it is still a package global subroutine - all subroutines are, regardless of where they are defined. Granted there is some magic involved with localized variables and closures, but this doesn't run into any of that.
<code>
s[]{82G5S="!A;F]T:&5R(%!E<FP\@:&%C:V5R}six;
</code>
Is kind of cool in that it takes $_, which is undefined, and replaces it with the payload, uuencoded. The six are just useless extensions, but distracting ones. Its also sort of a joke in that this was my sixth obfuscation posted here. Note that this will generate a warning about using an undefined variable, but will still pass [strict].<P>
And last but not least, <tt> die &$=>$/</tt> calls the sub defined earlier, which basically does <tt>die unpack( u=>u), $/</tt> Now you asked about $/, it's default value is "\n". If you [die] with a string ending in a newline, then the "at blah.pl line X" is supressed. That's also true with [warn]. The <tt>u=>u</tt> is equivalent to <tt>"u", u()</tt> where the first <tt>u</tt> tells [unpack] to uudecode the return from <tt>u()</tt>, which just returns <tt>$_</tt>.<P>
Good job of taking this obfu apart.
<!--
*$=sub{$a=q;}die;;sub u(){$_}$=&&unpack u=>u};s[]
{82G5S="!A;F]T:&5R(%!E<FP\@:&%C:V5R}six;die&$=>$/
-->
66546
66664