Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Not correct decode #2

Closed
Vladzimir opened this issue Sep 15, 2020 · 4 comments
Closed

Not correct decode #2

Vladzimir opened this issue Sep 15, 2020 · 4 comments

Comments

@Vladzimir
Copy link

Not correct decode goto and multi label.
lab1:
lab2:
lab3:

@simon816
Copy link
Owner

Hi, it is unclear what the problem is from your description. Could you share a snippet of code that doesn't deobfuscate well?

@Vladzimir
Copy link
Author

Vladzimir commented Sep 15, 2020

encode file https://pastebin.com/FCiBc6Yc
decode file https://pastebin.com/egh6SW8s
Constant glue

        /* $f = DIR_SYSTEM . "library/adw/autofield.php"; */
        $f = "DIR_SYSTEMlibrary/adw/autofield.php";

End goto not full decode

    protected function validate()
    {
        if ($this->user->hasPermission("modify", "extension/module/autofield")) {
            goto Kk5SZ;
        }
        $this->error["warning"] = $this->language->get("error_permission");
        Kk5SZ:
        return !$this->error;
    }

@simon816
Copy link
Owner

I see. The obfuscation in that file appears to rewrite if/else into ifs and gotos.
I'll see if I can convert them back to if/else. Hopefully the code is more readable so you can manually follow the control flow.

The reason why DIR_SYSTEM is being concatenated to the string is because it's emulating PHP's behaviour where undefined constants become the string value of it's name.
example:

<?php

echo "VALUE: " . DIR_SYSTEM;

Demo: https://3v4l.org/trpHp

Warning: Use of undefined constant DIR_SYSTEM - assumed 'DIR_SYSTEM' (this will throw an Error in a future version of PHP) in /in/trpHp on line 3
VALUE: DIR_SYSTEM

If you define the constant, it will concatenate it, e.g:

<?php

define('DIR_SYSTEM', '/');

echo DIR_SYSTEM . "library/adw/autofield.php";

Becomes:

<?php

define('DIR_SYSTEM', '/');
echo "/library/adw/autofield.php";

@Vladzimir
Copy link
Author

Thanks for answers.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants