hello,when I was working with a confused php sample, I found that it couldn't handle s

You've over-complicated the incrementation. You can simply do <code class="notranslate

Unable to handle increment of string about phpdeobfuscator HOT 5 CLOSED

simon816 commented on August 18, 2024

Unable to handle increment of string

from phpdeobfuscator.

Comments (5)

simon816 commented on August 18, 2024

Thanks for letting me know about this. I was not aware you could increment strings like that.

How do you do variable storage? How do I get the value of the specified variable?Is it $node->getAttribute(AttrName::VALUE)?

Yes, there is a utility function Utils::getValue to convert a node to its value:

PHPDeobfuscator/src/Utils.php

Line 59 in 35e9fbc

public static function getValue(Node $node)

It looks like I may have missed the increment operators from the reducers, just needs to be added to UnaryReducer https://github.com/simon816/PHPDeobfuscator/blob/35e9fbcff1be30b0fe9ac3f68f6868385b049ee1/src/Reducer/UnaryReducer.php

from phpdeobfuscator.

simon816 commented on August 18, 2024

A complication with post increment/decrement operators is that they need to be split into two expressions, which is not possible to do in general.

For example:

$a = "a";
foo($a++);

I want to use something like the comma operator from JavaScript, i.e:

$a = "a";
foo( ($a = "b", "a") );

But this is not legal in PHP, so the assignment must go somewhere else, which could lead to a semantically different program.

from phpdeobfuscator.

e1ysiaaa commented on August 18, 2024

Thank you for your reply.
My idea is to get the ASCII value of the last character of the string and convert it through chr() and ord().
For example

public function reduceStringInc(Node\Expr\PostInc $node)
    {
        $val = Utils::getValue($node->var);
        if(is_string($val)) {
            if(strlen($val) > 1){
                $status = True;
                $forwardstr = substr($val,0,strlen($val)-1);
                $backwardstr = substr($val,-1);
            }else{
                $status = False;
                $backwardstr = $val;
            }
            $new_str = chr(ord($backwardstr) + 1);
            if($status){
                $new_string = $forwardstr . $new_str;
            }else{
                $new_string = $new_str;
            }
            return Utils::scalarToNode($new_string);
        }elseif(is_int($val)){
            return Utils::scalarToNode((int) $val + 1);
        }
    }

The result of this code is as follows

<?php
    $a = "qazwsx";
    $a++;
    echo $a;
    $b = 3;
    $b++;
------------------------
$a = "qazwsx";
"qazwsy";
echo "qazwsx";
$b = 3;
4;

$a++ is reduced to qazwsy.
But notice that the result of echo $a is still qazwsx
If there are more than one $a++ operation, the result will be the same.
after each restore of $a++, we need to update the new value to the node of $a.
I tried to use
$node->var->setAttribute(AttrName::VALUE,$new_string);
But it doesn't seem to work 😂.
Is my thinking and method right? How can I update the variable value in real time?

from phpdeobfuscator.

simon816 commented on August 18, 2024

You've over-complicated the incrementation. You can simply do $val++ and let PHP handle the incrementation 🙂

Something as simple as this:

    public function reducePostInc(Node\Expr\PostInc $node)
    {
        $val = Utils::getValue($node->var);
        $val++;
        return new Node\Expr\Assign($node->var, Utils::scalarToNode($val));
    }

However I see this still doesn't actually work, I think we need the new Expr\Assign node to be handled in the Resolver class.

from phpdeobfuscator.

simon816 commented on August 18, 2024

increment is now implemented, this is what it returns for your sample:

<?php

$_ = [];
$_ = @"Array";
// $_='Array';
$_ = $_[false];
// $_=$_[0];
$___ = $_;
// A
$__ = $_;
$__ = "B";
$__ = "C";
$__ = "D";
$__ = "E";
$__ = "F";
$__ = "G";
$__ = "H";
$__ = "I";
$__ = "J";
$__ = "K";
$__ = "L";
$__ = "M";
$__ = "N";
$__ = "O";
$__ = "P";
$__ = "Q";
$__ = "R";
$__ = "S";
$___ = "AS";
// S
$___ = "ASS";
// S
$__ = $_;
$__ = "B";
$__ = "C";
$__ = "D";
$__ = "E";
// E
$___ = "ASSE";
$__ = $_;
$__ = "B";
$__ = "C";
$__ = "D";
$__ = "E";
$__ = "F";
$__ = "G";
$__ = "H";
$__ = "I";
$__ = "J";
$__ = "K";
$__ = "L";
$__ = "M";
$__ = "N";
$__ = "O";
$__ = "P";
$__ = "Q";
$__ = "R";
// R
$___ = "ASSER";
$__ = $_;
$__ = "B";
$__ = "C";
$__ = "D";
$__ = "E";
$__ = "F";
$__ = "G";
$__ = "H";
$__ = "I";
$__ = "J";
$__ = "K";
$__ = "L";
$__ = "M";
$__ = "N";
$__ = "O";
$__ = "P";
$__ = "Q";
$__ = "R";
$__ = "S";
$__ = "T";
// T
$___ = "ASSERT";
$____ = '_';
$__ = $_;
$__ = "B";
$__ = "C";
$__ = "D";
$__ = "E";
$__ = "F";
$__ = "G";
$__ = "H";
$__ = "I";
$__ = "J";
$__ = "K";
$__ = "L";
$__ = "M";
$__ = "N";
$__ = "O";
$__ = "P";
// P
$____ = "_P";
$__ = $_;
$__ = "B";
$__ = "C";
$__ = "D";
$__ = "E";
$__ = "F";
$__ = "G";
$__ = "H";
$__ = "I";
$__ = "J";
$__ = "K";
$__ = "L";
$__ = "M";
$__ = "N";
$__ = "O";
// O
$____ = "_PO";
$__ = $_;
$__ = "B";
$__ = "C";
$__ = "D";
$__ = "E";
$__ = "F";
$__ = "G";
$__ = "H";
$__ = "I";
$__ = "J";
$__ = "K";
$__ = "L";
$__ = "M";
$__ = "N";
$__ = "O";
$__ = "P";
$__ = "Q";
$__ = "R";
$__ = "S";
// S
$____ = "_POS";
$__ = $_;
$__ = "B";
$__ = "C";
$__ = "D";
$__ = "E";
$__ = "F";
$__ = "G";
$__ = "H";
$__ = "I";
$__ = "J";
$__ = "K";
$__ = "L";
$__ = "M";
$__ = "N";
$__ = "O";
$__ = "P";
$__ = "Q";
$__ = "R";
$__ = "S";
$__ = "T";
// T
$____ = "_POST";
$_ = $_POST;
ASSERT($_[_]);
// ASSERT($_POST[_]);

from phpdeobfuscator.

Unable to handle increment of string about phpdeobfuscator HOT 5 CLOSED

Comments (5)

Related Issues (15)

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent