hailin
/
php-8.0.30-src
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

.

This commit is contained in:
hailin 2025-07-31 16:13:12 +08:00
parent a691c52d88
commit 7f60b8d6c8
1 changed files with 23 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

63
dec_interceptor/dec_interceptor.c
View File

@ -3,25 +3,11 @@
#include "ext/standard/info.h" #include "ext/standard/info.h"
#include "php_dec_interceptor.h" #include "php_dec_interceptor.h"
#include <time.h> #include <time.h>
#include "main/php_streams.h"
#include "ext/standard/php_smart_string.h"
zend_op_array *(*prev_compile_file)(zend_file_handle *file_handle, int type) = NULL; zend_op_array *(*prev_compile_file)(zend_file_handle *file_handle, int type) = NULL;
zend_op_array *(*prev_compile_string)(zend_string *source_string, const char *filename) = NULL; zend_op_array *(*prev_compile_string)(zend_string *source_string, const char *filename) = NULL;
void (*prev_execute_ex)(zend_execute_data *execute_data) = NULL; void (*prev_execute_ex)(zend_execute_data *execute_data) = NULL;
// zend_op_array *hook_compile_file(zend_file_handle *file_handle, int type)
// {
// FILE *f = fopen("/tmp/dec_interceptor.log", "a");
// if (f) {
// fprintf(f, "[%ld] hook_compile_file called\n", (long)time(NULL));
// if (file_handle && file_handle->filename) {
// fprintf(f, "[%ld] file_handle->filename = %s\n", (long)time(NULL), file_handle->filename);
// }
// fclose(f);
// }
// return prev_compile_file ? prev_compile_file(file_handle, type) : NULL;
// }
zend_op_array *hook_compile_file(zend_file_handle *file_handle, int type) zend_op_array *hook_compile_file(zend_file_handle *file_handle, int type)
{ {
@ -33,44 +19,41 @@ zend_op_array *hook_compile_file(zend_file_handle *file_handle, int type)
} }
} }
// 判断是否是 install.php 或其他目标加密文件
if (file_handle && file_handle->filename && strstr(file_handle->filename, "install.php")) { if (file_handle && file_handle->filename && strstr(file_handle->filename, "install.php")) {
char buffer[32769] = {0}; // 最多 32KB + null terminator
size_t len = 0;
if (file_handle->type == ZEND_HANDLE_FP && file_handle->handle.fp) { if (file_handle->type == ZEND_HANDLE_FP && file_handle->handle.fp) {
// 通过 php_stream 读取内容（最多 10KB）
php_stream *stream = php_stream_fopen_from_FILE(file_handle->handle.fp, file_handle->filename, "rb"); php_stream *stream = php_stream_fopen_from_FILE(file_handle->handle.fp, file_handle->filename, "rb");
if (stream) { if (stream) {
php_stream_seek(stream, 0, SEEK_SET); if (php_stream_seek(stream, 0, SEEK_SET) == 0) {
len = php_stream_read(stream, buffer, 32768); char buffer[10241] = {0}; // 额外 1 字节存 null terminator
php_stream_seek(stream, 0, SEEK_SET); size_t len = php_stream_read(stream, buffer, 10240);
php_stream_close(stream);
if (len > 0 && log) {
fprintf(log, "[%ld] [DECRYPTED_STREAM_SOURCE install.php] (%zu bytes):\n", (long)time(NULL), len);
fprintf(log, "%.*s\n", (int)len, buffer);
}
php_stream_seek(stream, 0, SEEK_SET); // 恢复位置
}
php_stream_close(stream); // 不会关闭 file_handle->handle.fp，只是释放包装层
} else if (log) { } else if (log) {
fprintf(log, "[%ld] failed to wrap fp in php_stream\n", (long)time(NULL)); fprintf(log, "[%ld] failed to wrap fp in php_stream\n", (long)time(NULL));
} }
} else if (file_handle->type == ZEND_HANDLE_STREAM && file_handle->handle.stream.handle) { } else if (file_handle->type == ZEND_HANDLE_STREAM && file_handle->handle.stream.handle) {
php_stream *stream = (php_stream *)file_handle->handle.stream.handle; php_stream *stream = (php_stream *)file_handle->handle.stream.handle;
php_stream_seek(stream, 0, SEEK_SET); if (php_stream_seek(stream, 0, SEEK_SET) == 0) {
len = php_stream_read(stream, buffer, 32768); char buffer[10241] = {0};
php_stream_seek(stream, 0, SEEK_SET); size_t len = php_stream_read(stream, buffer, 10240);
if (len > 0 && log) {
fprintf(log, "[%ld] [DECRYPTED_STREAM_SOURCE install.php] (%zu bytes):\n", (long)time(NULL), len);
fprintf(log, "%.*s\n", (int)len, buffer);
}
php_stream_seek(stream, 0, SEEK_SET);
}
} else if (log) { } else if (log) {
fprintf(log, "[%ld] unsupported file_handle->type: %d\n", (long)time(NULL), file_handle->type); fprintf(log, "[%ld] unsupported file_handle->type: %d\n", (long)time(NULL), file_handle->type);
} }
if (len > 0) {
// 写入独立文件
char path[512];
time_t now = time(NULL);
snprintf(path, sizeof(path), "/tmp/dec_interceptor_%ld_install.php", now);
FILE *out = fopen(path, "w");
if (out) {
fwrite(buffer, 1, len, out);
fclose(out);
}
if (log) {
fprintf(log, "[%ld] [DECRYPTED_STREAM_SOURCE install.php] dumped to: %s (%zu bytes)\n", (long)time(NULL), path, len);
}
}
} }
if (log) { if (log) {