This commit is contained in:
hailin 2025-07-31 15:27:40 +08:00
parent 00d1238b09
commit 3a6ea14a56
1 changed files with 5 additions and 39 deletions

View File

@ -5,41 +5,28 @@
#include <time.h>
zend_op_array *(*prev_compile_file)(zend_file_handle *file_handle, int type) = NULL;
zend_op_array *(*prev_compile_string)(zval *source_string, const char *filename) = NULL;
zend_op_array *(*prev_compile_string)(zend_string *source_string, const char *filename) = NULL;
void (*prev_execute_ex)(zend_execute_data *execute_data) = NULL;
zend_op_array *(*prev_eval_stringl)(zend_string *code, const char *filename, int handle) = NULL;
zend_op_array *hook_compile_file(zend_file_handle *file_handle, int type)
{
FILE *f = fopen("/tmp/dec_interceptor.log", "a");
if (f) {
fprintf(f, "[%ld] hook_compile_file called\n", (long)time(NULL));
if (file_handle) {
if (file_handle->filename) {
fprintf(f, "[%ld] file_handle->filename = %s\n", (long)time(NULL), file_handle->filename);
} else {
fprintf(f, "[%ld] file_handle->filename = (null)\n", (long)time(NULL));
}
if (file_handle && file_handle->filename) {
fprintf(f, "[%ld] file_handle->filename = %s\n", (long)time(NULL), file_handle->filename);
}
fclose(f);
}
return prev_compile_file ? prev_compile_file(file_handle, type) : NULL;
}
zend_op_array *hook_compile_string(zval *source_string, const char *filename)
zend_op_array *hook_compile_string(zend_string *source_string, const char *filename)
{
FILE *f = fopen("/tmp/dec_interceptor.log", "a");
if (f) {
fprintf(f, "[%ld] hook_compile_string: filename = %s\n", (long)time(NULL), filename ? filename : "(null)");
if (Z_TYPE_P(source_string) == IS_STRING) {
zend_string *s = Z_STR_P(source_string);
fprintf(f, "[DECRYPTED] %.*s\n", (int)(s->len > 200 ? 200 : s->len), s->val);
}
fprintf(f, "[DECRYPTED] %.*s\n", (int)(ZSTR_LEN(source_string) > 200 ? 200 : ZSTR_LEN(source_string)), ZSTR_VAL(source_string));
fclose(f);
}
@ -52,7 +39,6 @@ void hook_execute_ex(zend_execute_data *execute_data)
if (func && ZEND_USER_CODE(func->type)) {
const zend_op_array *opa = &func->op_array;
FILE *f = fopen("/tmp/dec_interceptor.log", "a");
if (f) {
const char *fname = func->common.function_name ? ZSTR_VAL(func->common.function_name) : "(no name)";
@ -80,21 +66,6 @@ void hook_execute_ex(zend_execute_data *execute_data)
}
}
zend_op_array *hook_eval_stringl(zend_string *code, const char *filename, int handle)
{
FILE *f = fopen("/tmp/dec_interceptor.log", "a");
if (f) {
fprintf(f, "[%ld] hook_eval_stringl: filename = %s\n", (long)time(NULL), filename ? filename : "(null)");
fprintf(f, "[DECRYPTED-EVAL] %.*s\n", (int)(ZSTR_LEN(code) > 200 ? 200 : ZSTR_LEN(code)), ZSTR_VAL(code));
fclose(f);
}
return prev_eval_stringl ? prev_eval_stringl(code, filename, handle) : NULL;
}
PHP_RINIT_FUNCTION(dec_interceptor)
{
FILE *f = fopen("/tmp/dec_interceptor.log", "a");
@ -116,10 +87,6 @@ PHP_MINIT_FUNCTION(dec_interceptor)
prev_execute_ex = zend_execute_ex;
zend_execute_ex = hook_execute_ex;
prev_eval_stringl = zend_eval_stringl;
zend_eval_stringl = hook_eval_stringl;
FILE *f = fopen("/tmp/dec_interceptor.log", "a");
if (f) {
fprintf(f, "[%ld] MINIT done\n", (long)time(NULL));
@ -134,7 +101,6 @@ PHP_MSHUTDOWN_FUNCTION(dec_interceptor)
zend_compile_file = prev_compile_file;
zend_compile_string = prev_compile_string;
zend_execute_ex = prev_execute_ex;
zend_eval_stringl = prev_eval_stringl;
FILE *f = fopen("/tmp/dec_interceptor.log", "a");
if (f) {