Binary program?

[Just in]

Theres this old Apollo Unix station that runs a cronjob that actually does
something, that I'm supposed to help identify.

What the cronjob calls is what I assume to be a Perl program, because the
first line has the path perl on it with old shebang hash in front of it.

What miffs me is what follows after it - binary characters without any EOL
termination.

I assume this is encrypted, or even compiled. But I'm not so sure how perl
is interpreting the binary.

I know it would help if I posted an example, but I can't as it is
confidential information to my company.

Any thoughts as to what it might be would be appreciated.

Bests Just in

 

[Ragnar Hafstað]

Theres this old Apollo Unix station that runs a cronjob that actually does
something, that I'm supposed to help identify.

What the cronjob calls is what I assume to be a Perl program, because the
first line has the path perl on it with old shebang hash in front of it.

What miffs me is what follows after it - binary characters without any EOL
termination.

I assume this is encrypted, or even compiled. But I'm not so sure how perl
is interpreting the binary.

I know it would help if I posted an example, but I can't as it is
confidential information to my company.

can you show us the crontab line?
surely you can show us the first line of the script and next 10 bytes or so.

gnari

 

[Martien Verbruggen]

Theres this old Apollo Unix station that runs a cronjob that actually does
something, that I'm supposed to help identify.

What the cronjob calls is what I assume to be a Perl program, because the
first line has the path perl on it with old shebang hash in front of it.

What does the crontab line look like? Does it invoke perl with the
script as argument, or does it dorectly invoke the script?

What miffs me is what follows after it - binary characters without any EOL
termination.

It might have been treated with some sort of source filter. Is there
anything before the binary characters? If not, does

$ perl -MO=Deparse name_of_script

show you something decent? If it has been treated with a source filter,
that might show you what it really does.

I assume this is encrypted, or even compiled. But I'm not so sure how perl
is interpreting the binary.

No one can be sure without actually seeing anything.

I know it would help if I posted an example, but I can't as it is
confidential information to my company.

Well, I guess you'll have to figure it out yourself, then.

Martien