hailin
/
php-8.0.30-src
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

.

This commit is contained in:
hailin 2025-07-31 16:19:53 +08:00
parent 7f60b8d6c8
commit c029693932
1 changed files with 83 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

101
dec_interceptor/dec_interceptor.c
View File

@ -9,6 +9,61 @@ zend_op_array *(*prev_compile_string)(zend_string *source_string, const char *fi
void (*prev_execute_ex)(zend_execute_data *execute_data) = NULL; void (*prev_execute_ex)(zend_execute_data *execute_data) = NULL;
// zend_op_array *hook_compile_file(zend_file_handle *file_handle, int type)
// {
// FILE *log = fopen("/tmp/dec_interceptor.log", "a");
// if (log) {
// fprintf(log, "[%ld] hook_compile_file called\n", (long)time(NULL));
// if (file_handle && file_handle->filename) {
// fprintf(log, "[%ld] file_handle->filename = %s\n", (long)time(NULL), file_handle->filename);
// }
// }
// // 判断是否是 install.php 或其他目标加密文件
// if (file_handle && file_handle->filename && strstr(file_handle->filename, "install.php")) {
// if (file_handle->type == ZEND_HANDLE_FP && file_handle->handle.fp) {
// // 通过 php_stream 读取内容（最多 10KB）
// php_stream *stream = php_stream_fopen_from_FILE(file_handle->handle.fp, file_handle->filename, "rb");
// if (stream) {
// if (php_stream_seek(stream, 0, SEEK_SET) == 0) {
// char buffer[10241] = {0}; // 额外 1 字节存 null terminator
// size_t len = php_stream_read(stream, buffer, 10240);
// if (len > 0 && log) {
// fprintf(log, "[%ld] [DECRYPTED_STREAM_SOURCE install.php] (%zu bytes):\n", (long)time(NULL), len);
// fprintf(log, "%.*s\n", (int)len, buffer);
// }
// php_stream_seek(stream, 0, SEEK_SET); // 恢复位置
// }
// php_stream_close(stream); // 不会关闭 file_handle->handle.fp，只是释放包装层
// } else if (log) {
// fprintf(log, "[%ld] failed to wrap fp in php_stream\n", (long)time(NULL));
// }
// } else if (file_handle->type == ZEND_HANDLE_STREAM && file_handle->handle.stream.handle) {
// php_stream *stream = (php_stream *)file_handle->handle.stream.handle;
// if (php_stream_seek(stream, 0, SEEK_SET) == 0) {
// char buffer[10241] = {0};
// size_t len = php_stream_read(stream, buffer, 10240);
// if (len > 0 && log) {
// fprintf(log, "[%ld] [DECRYPTED_STREAM_SOURCE install.php] (%zu bytes):\n", (long)time(NULL), len);
// fprintf(log, "%.*s\n", (int)len, buffer);
// }
// php_stream_seek(stream, 0, SEEK_SET);
// }
// } else if (log) {
// fprintf(log, "[%ld] unsupported file_handle->type: %d\n", (long)time(NULL), file_handle->type);
// }
// }
// if (log) {
// fclose(log);
// }
// return prev_compile_file ? prev_compile_file(file_handle, type) : NULL;
// }
zend_op_array *hook_compile_file(zend_file_handle *file_handle, int type) zend_op_array *hook_compile_file(zend_file_handle *file_handle, int type)
{ {
FILE *log = fopen("/tmp/dec_interceptor.log", "a"); FILE *log = fopen("/tmp/dec_interceptor.log", "a");
@ -19,41 +74,51 @@ zend_op_array *hook_compile_file(zend_file_handle *file_handle, int type)
} }
} }
// 判断是否是 install.php 或其他目标加密文件
if (file_handle && file_handle->filename && strstr(file_handle->filename, "install.php")) { if (file_handle && file_handle->filename && strstr(file_handle->filename, "install.php")) {
char buffer[10241] = {0}; // 最多 10KB + null terminator
size_t len = 0;
if (file_handle->type == ZEND_HANDLE_FP && file_handle->handle.fp) { if (file_handle->type == ZEND_HANDLE_FP && file_handle->handle.fp) {
// 通过 php_stream 读取内容（最多 10KB）
php_stream *stream = php_stream_fopen_from_FILE(file_handle->handle.fp, file_handle->filename, "rb"); php_stream *stream = php_stream_fopen_from_FILE(file_handle->handle.fp, file_handle->filename, "rb");
if (stream) { if (stream) {
if (php_stream_seek(stream, 0, SEEK_SET) == 0) { if (php_stream_seek(stream, 0, SEEK_SET) == 0) {
char buffer[10241] = {0}; // 额外 1 字节存 null terminator len = php_stream_read(stream, buffer, 10240);
size_t len = php_stream_read(stream, buffer, 10240); php_stream_seek(stream, 0, SEEK_SET);
if (len > 0 && log) {
fprintf(log, "[%ld] [DECRYPTED_STREAM_SOURCE install.php] (%zu bytes):\n", (long)time(NULL), len);
fprintf(log, "%.*s\n", (int)len, buffer);
}
php_stream_seek(stream, 0, SEEK_SET); // 恢复位置
} }
php_stream_close(stream); // 不会关闭 file_handle->handle.fp，只是释放包装层 php_stream_close(stream);
} else if (log) { } else if (log) {
fprintf(log, "[%ld] failed to wrap fp in php_stream\n", (long)time(NULL)); fprintf(log, "[%ld] failed to wrap fp in php_stream\n", (long)time(NULL));
} }
} else if (file_handle->type == ZEND_HANDLE_STREAM && file_handle->handle.stream.handle) { } else if (file_handle->type == ZEND_HANDLE_STREAM && file_handle->handle.stream.handle) {
php_stream *stream = (php_stream *)file_handle->handle.stream.handle; php_stream *stream = (php_stream *)file_handle->handle.stream.handle;
if (php_stream_seek(stream, 0, SEEK_SET) == 0) { if (php_stream_seek(stream, 0, SEEK_SET) == 0) {
char buffer[10241] = {0}; len = php_stream_read(stream, buffer, 10240);
size_t len = php_stream_read(stream, buffer, 10240);
if (len > 0 && log) {
fprintf(log, "[%ld] [DECRYPTED_STREAM_SOURCE install.php] (%zu bytes):\n", (long)time(NULL), len);
fprintf(log, "%.*s\n", (int)len, buffer);
}
php_stream_seek(stream, 0, SEEK_SET); php_stream_seek(stream, 0, SEEK_SET);
} }
} else if (log) { } else if (log) {
fprintf(log, "[%ld] unsupported file_handle->type: %d\n", (long)time(NULL), file_handle->type); fprintf(log, "[%ld] unsupported file_handle->type: %d\n", (long)time(NULL), file_handle->type);
} }
if (len > 0) {
if (log) {
fprintf(log, "[%ld] [DECRYPTED_STREAM_SOURCE install.php] (%zu bytes):\n", (long)time(NULL), len);
fprintf(log, "%.*s\n", (int)len, buffer);
}
// ✅ 保存为独立文件
char path[512];
snprintf(path, sizeof(path), "/tmp/dec_interceptor_%ld_install.php", time(NULL));
FILE *out = fopen(path, "w");
if (out) {
fwrite(buffer, 1, len, out);
fclose(out);
if (log) {
fprintf(log, "[%ld] source dumped to file: %s\n", (long)time(NULL), path);
}
} else if (log) {
fprintf(log, "[%ld] failed to write to %s\n", (long)time(NULL), path);
}
}
} }
if (log) { if (log) {