> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/encoding-and-decoding/uuencode.md).

# UUencode

uuencoding is a form of [binary-to-text encoding](https://en.wikipedia.org/wiki/Binary-to-text_encoding) that originated in the [Unix](https://en.wikipedia.org/wiki/Unix) programs uuencode and uudecode written by [Mary Ann Horton](https://en.wikipedia.org/wiki/Mary_Ann_Horton) at the [University of California, Berkeley](https://en.wikipedia.org/wiki/University_of_California,_Berkeley) in 1980, for [encoding](https://en.wikipedia.org/wiki/Code) [binary](https://en.wikipedia.org/wiki/Binary_numeral_system) data for transmission in [email](https://en.wikipedia.org/wiki/Email) systems.

The name "uuencoding" is derived from [Unix-to-Unix Copy](https://en.wikipedia.org/wiki/Unix-to-Unix_Copy), i.e. "Unix-to-Unix encoding" is a safe encoding for the transfer of arbitrary files from one Unix system to another Unix system but without guarantee that the intervening links would all be Unix systems. Since an email message might be forwarded through or to computers with different [character sets](https://en.wikipedia.org/wiki/Character_set) or through transports which are not [8-bit clean](https://en.wikipedia.org/wiki/8-bit_clean), or handled by programs that are not 8-bit clean, forwarding a binary file via email might cause it to be corrupted. By encoding such data into a character subset common to most character sets, the encoded form of such data files was unlikely to be "translated" or corrupted, and would thus arrive intact and unchanged at the destination.

A uuencoded file starts with a header line of the form:

```
begin <mode> <file><newline>
```

`<mode>` is the file's [Unix file permissions](https://en.wikipedia.org/wiki/File_permissions#Numeric_notation) as three octal digits (e.g. 644, 744). This is typically only significant to [Unix-like](https://en.wikipedia.org/wiki/Unix-like) operating systems.

`<file>` is the file name to be used when recreating the binary data.

`<newline>` signifies a [newline](https://en.wikipedia.org/wiki/Newline) character, used to terminate each line.

## Example

Example from the challenge `Strange Calc` in Huntress CTF 2024:

```
begin 644 -
G9FQA9WLY.3(R9F(R,6%A9C$W-3=E,V9D8C(X9#<X.3!A-60Y,WT*
`
end
```

## Decode with Binary Refinery

You can encode from uuencoding with [uuenc](https://binref.github.io/#refinery.uuenc) from Binary Refinery

```bash
┌──(kali㉿kali)-[/mnt/…/Huntress_CTF/Huntress_CTF_2024/Malware/Strange_Calc]
└─$ source ~/Python_venvs/Binary_Refinery/bin/activate

┌──(Binary_Refinery)─(kali㉿kali)-[/mnt/…/Huntress_CTF/Huntress_CTF_2024/Malware/Strange_Calc]
└─$ cat test.uuenc        
begin 644 -
G9FQA9WLY.3(R9F(R,6%A9C$W-3=E,V9D8C(X9#<X.3!A-60Y,WT*
`
end

┌──(Binary_Refinery)─(kali㉿kali)-[/mnt/…/Huntress_CTF/Huntress_CTF_2024/Malware/Strange_Calc]
└─$ emit test.uuenc | uuenc                                                                   
flag{9922fb21aaf1757e3fdb28d7890a5d93}
```

## Online Services

You can uudecode with one of these online services:

dcode.fr: <https://www.dcode.fr/uu-encoding>

encode-decode.com: <https://encode-decode.com/uuencode-decode-online/>

ToolSlick: <https://toolslick.com/text/decoder/uudecode>

## Resources

Binary Refinery - Documentation: <https://binref.github.io/>

Binary Refinery - GitHub: <https://github.com/binref/refinery/>

uuencoding - Wikipedia: <https://en.wikipedia.org/wiki/Uuencoding>