Skip to content

Instantly share code, notes, and snippets.

@underdown
Last active October 20, 2015 05:46
Show Gist options
  • Select an option

  • Save underdown/38c42d0f7617fe9b133c to your computer and use it in GitHub Desktop.

Select an option

Save underdown/38c42d0f7617fe9b133c to your computer and use it in GitHub Desktop.
how to reverse engineer some simple obfuscation
<?php
//grabbed the code from phpQUERY-oneFile.php which houses a good chunk of the setup scripts that run cwp
// found this method of obfuscation - just getting the ord (ascii value) for a character and then shifting values.
/* rewrote their script to make logical. The function decryptme must be converted back to the original function name as its called further down the line in the obnfuscated code. */
/* so far havent found anything objectionable in their code - just looking for obvious backdoors */
if(!function_exists("decryptme"))
{ function decryptme($obfuscated) {
$initialize="";
$counter=0;
$length=strlen($obfuscated);
while($counter < $length) {
if($obfuscated[$counter] == ' ') {
$initialize.=" "; }
else if($obfuscated[$counter] == '!') {
$initialize.=chr((ord($obfuscated[$counter+1])-ord('A'))*16+(ord($obfuscated[$counter+2])-ord('a')));
$counter+=2;}
else { $initialize.=chr(ord($obfuscated[$counter])+1); }
$counter++;
}
return $initialize;
}
}
echo(decryptme('du`k!Ci`..............'));
/* original code */
if(!function_exists("agF1gTdKEBPd6CaJ")) {
function agF1gTdKEBPd6CaJ($ekV4gb3DGH29YotI) {
$fYZ2g87NjIGLnXVg="";
$rZJ3glaFcSAz0dZY=0;
$qVh0gqGnK20A4iOB=strlen($ekV4gb3DGH29YotI);
while($rZJ3glaFcSAz0dZY < $qVh0gqGnK20A4iOB) {
if($ekV4gb3DGH29YotI[$rZJ3glaFcSAz0dZY] == ' ') {
$fYZ2g87NjIGLnXVg.=" "; }
else if($ekV4gb3DGH29YotI[$rZJ3glaFcSAz0dZY] == '!') {
$fYZ2g87NjIGLnXVg.=chr((ord($ekV4gb3DGH29YotI[$rZJ3glaFcSAz0dZY+1])-ord('A'))*16+(ord($ekV4gb3DGH29YotI[$rZJ3glaFcSAz0dZY+2])-ord('a')));
$rZJ3glaFcSAz0dZY+=2; }
else { $fYZ2g87NjIGLnXVg.=chr(ord($ekV4gb3DGH29YotI[$rZJ3glaFcSAz0dZY])+1); }
$rZJ3glaFcSAz0dZY++;
}
return $fYZ2g87NjIGLnXVg;
} }eval(agF1gTdKEBPd6CaJ('du`k!Ci`
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment