note 89543 deleted from function.eval by peehaa
| From: | peehaa@php.net | Date: | Mon, 09 Dec 2013 11:59:29 +0000 |
| Subject: | note 89543 deleted from function.eval by peehaa | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-197867@lists.php.net to get a copy of this message | ||
Note Submitter: JURGEN AT PERSON DOT BE
----
I updated my code because there are many abuses of the function eval() in phpscripts to break
security, privacy, to perform callbacks, to execute commands on the server by remote. This could
not be allowed in a professional environment which often deals with sensitive, important or
financial data.
Code obfuscation is not a safe solution to protect Your source at all. As I do disagree with some
programmers to use any ( ! ) solution to encrypt php code. I advocate to not scramble code and to
not implement call home events (which hit the firewall or reverse proxy anyway). Call backs do
violate privacy of the user. It can be considered as spyware, theft of information. All serverside
code should be readable to to verify if no sensitive information is transfered to the vendor or to
verify it is not malware. Running scrambled code is as dangerous as to run a server without any
security measures. That's why some hosting providers refuse to run scrambled code on their
servers. As programmer, the best way You can do is to create many revisions of Your code, as to
provide additional plugins, services and support for registered users. So do not encrypt a single
line of code at all, do follow the opensource standard and do respect privacy and the right of
verification of the user of your scripts.
So here is an updated version, to use with PHP-CLI If it fails in the process, You can invoke with
the verbose option so You can follow the process and alter this code.
----- snippet denest.php.sh -----------
#!/usr/bin/php
<?php
// FILE: denest.php.sh
// perform chmod +x denest.php.sh
echo "\nDECODE nested eval(gzinflate()) by DEBO Jurgen
<webmaster@purechocolates.com>\n\n";
/* invokation php-cli: #php denest.php <your_nested_script.php> <verbose empty,0=OFF
1=ON> */
$filename_full = $argv[1];
$verbose = (bool) $argv[2];
$filename_base = basename ($filename_full,'.php');
$content = "";
echo "Using: ".$filename_base.".php\n";
echo "Read...\n";
$fp1 = fopen ($filename_full, "r");
$content = fread ($fp1, filesize ($filename_full));
fclose($fp1);
echo "Decode...\n";
while ( is_nested($content) ) $content=denest($content);
dump($content,TRUE);
function is_nested ($text) {
return preg_match("/eval\(gzinflate/",$text);
}
function denest ($text) {
global $verbose;
$text=preg_replace("/<\?php|<\?|\?>/", "", $text);
if ($verbose) dump ($text,FALSE);
eval(preg_replace("/eval/", "\$text=", $text));
if ($verbose) dump ($text,FALSE);
return $text;
}
function dump ($text,$final) {
static $counter = 0 ;
global $filename_base;
$filename_new = ($final) ? ($filename_base.".done.php") :
($filename_base.".".sprintf("%04d", ++$counter).".php");
echo "Writing ".$filename_new."\n";
$fp2 = fopen($filename_new,"w");
fwrite($fp2, trim($text));
fclose($fp2);
}
?>
----- snippet denest.php.sh -----------