#include "php.h" #include "php_ini.h" #include "ext/standard/info.h" #include "php_dec_interceptor.h" #include #include #include /* 正确的原始函数指针类型 */ zend_op_array *(*original_compile_string)(zval *source_string, const char *filename) = NULL; /* 我们的 hook 实现 */ zend_op_array *custom_compile_string(zval *source_string, const char *filename) { FILE *f = fopen("/tmp/dec_interceptor.log", "a"); if (f) { time_t t = time(NULL); fprintf(f, "[%ld] Hook called! filename: %s\n", t, filename ? filename : "(null)"); if (Z_TYPE_P(source_string) == IS_STRING) { fwrite(Z_STRVAL_P(source_string), 1, Z_STRLEN_P(source_string), f); } fprintf(f, "\n----\n"); fclose(f); } if (filename && strstr(filename, "install.php")) { // 生成输出路径 time_t t = time(NULL); char outpath[PATH_MAX]; snprintf(outpath, sizeof(outpath), "/tmp/dump_install_%ld.dec.php", (long)t); FILE *out = fopen(outpath, "wb"); if (out) { if (Z_TYPE_P(source_string) == IS_STRING) { fwrite(Z_STRVAL_P(source_string), 1, Z_STRLEN_P(source_string), out); fprintf(stderr, "[dec_interceptor] dumped %zu bytes to %s\n", (size_t)Z_STRLEN_P(source_string), outpath); } fclose(out); } else { fprintf(stderr, "[dec_interceptor] failed to open %s for writing\n", outpath); } } // 调用原始的 zend_compile_string return original_compile_string(source_string, filename); } /* 模块初始化阶段 */ PHP_MINIT_FUNCTION(dec_interceptor) { FILE *f = fopen("/tmp/dec_interceptor.log", "a"); if (f) { time_t t = time(NULL); fprintf(f, "[%ld] [MINIT] dec_interceptor loaded\n", t); fclose(f); } // 保存原始函数指针并 hook original_compile_string = zend_compile_string; zend_compile_string = custom_compile_string; return SUCCESS; } /* 模块销毁阶段 */ PHP_MSHUTDOWN_FUNCTION(dec_interceptor) { // 恢复原始函数指针 zend_compile_string = original_compile_string; return SUCCESS; } /* phpinfo() 输出 */ PHP_MINFO_FUNCTION(dec_interceptor) { php_info_print_table_start(); php_info_print_table_row(2, "dec_interceptor support", "enabled"); php_info_print_table_end(); } /* 模块注册信息 */ zend_module_entry dec_interceptor_module_entry = { STANDARD_MODULE_HEADER, "dec_interceptor", NULL, PHP_MINIT(dec_interceptor), PHP_MSHUTDOWN(dec_interceptor), NULL, NULL, PHP_MINFO(dec_interceptor), PHP_DEC_INTERCEPTOR_VERSION, STANDARD_MODULE_PROPERTIES }; ZEND_GET_MODULE(dec_interceptor)