revphp

#!/usr/bin/env php
<?php
# $Id: revphp,v 1.35 2016/04/12 02:40:07 bediger Exp $
require 'vendor/autoload.php';
include('SymbolTable.php');
include('RevPHPNodeVisitor.php');

use PhpParser\NodeTraverser;
use PhpParser\ParserFactor;
use PhpParser\PrettyPrinter;

$remove_comments = true;
$execute_functions = true;

$cmdline = getopt("Cf:F:D:r:RX");

if (isset($cmdline['C'])) $remove_comments = false;
if (isset($cmdline['X'])) $execute_functions = false;

// Names and pseudonyms of function names to
// replace with the pseudonym. Something like:
// -F  name_in_code=name_I_want
$replacement_func_names = array();
if (isset($cmdline['F'])) {
	if (is_array($cmdline['F'])) {
		foreach ($cmdline['F'] as $replace) {
			$a = explode('=', $replace);
			$replacement_func_names[$a[0]] = $a[1];
		}
	} else {
		$a = explode('=', $cmdline['F']);
		$replacement_func_names[$a[0]] = $a[1];
	}
}

// Try to decode all arguments of any function calls with
// these names. E.g. fprintf() args not ordinarily decoded.
// "-f fprintf" on command line will cause program to try to
// decode all fprintf() args.
$extra_functions = array();
if (isset($cmdline['f'])) {
	if (is_array($cmdline['f'])) {
		foreach ($cmdline['f'] as $func) {
			$extra_functions[] = $func;
		}
	} else
		$extra_functions[] = $cmdline['f'];
}

// Function names for which we should try to de-obfuscate if they appear
// as arguments in another function call. Some built-in functions always
// work this way.
$replaced_functions = array();
if (isset($cmdline['r'])) {
	if (is_array($cmdline['r'])) {
		foreach ($cmdline['r'] as $func) {
			$replaced_functions[] = $func;
		}
	} else
		$replaced_functions[] = $cmdline['r'];
}

$special_functions = array();
if (isset($cmdline['D'])) {
	# File name with PHP code to eval, and then use
	# the functions as "functions of interest", 
	$special_function_names = parse_and_eval($cmdline['D']);
	foreach ($special_function_names as $fn) {
		$special_functions[] = $fn;
	}
}

$fix_variable_names = false;
if (isset($cmdline['R'])) {
	$fix_variable_names = true;
}

$input_filename = $argv[$argc - 1];

$code = file_get_contents($input_filename);

$parser        = (new PhpParser\ParserFactory)->create(PhpParser\ParserFactory::PREFER_PHP7);
$traverser     = new PhpParser\NodeTraverser;
$prettyPrinter = new PhpParser\PrettyPrinter\Standard;

$visitor = new RevPHPNodeVisitor(
	$extra_functions, $special_functions, $replaced_functions,
	$remove_comments, $replacement_func_names, $execute_functions,
	$fix_variable_names
);

$traverser->addVisitor($visitor);

try {
   	$stmts = $parser->parse($code);
}
catch (PhpParser\Error $e) {
	fwrite(STDERR, 'Parse Error: '.$e->getMessage()." in {$input_filename}\n");
	exit;
}

$massagedstmts = $traverser->traverse($stmts);

$code = "<?php\n" . $prettyPrinter->prettyPrint($massagedstmts)."\n";
echo $code;

if (is_array($visitor->anon_functions)) {
	foreach ($visitor->anon_functions as $funstr) {
		echo "\n// Anonymous function from create_function()\n";
		$aparser        = (new PhpParser\ParserFactory)->create(PhpParser\ParserFactory::PREFER_PHP7);
		$atraverser     = new PhpParser\NodeTraverser;
		$atraverser->addVisitor(
			new RevPHPNodeVisitor(
				$extra_functions, $special_functions, $replaced_functions,
				$remove_comments, $replacement_func_names
			)
		);
		try {
			$stmts = $aparser->parse('<?php '.$funstr);
		}
		catch (PhpParser\Error $e) {
			fwrite(STDERR, 'Parse Error: '.$e->getMessage()." in {$input_filename}\n");
		}
		echo (new PhpParser\PrettyPrinter\Standard)->prettyPrint($atraverser->traverse($stmts))."\n\n";
	}
}

exit;

/*
set_error_handler('exceptions_error_handler');

function exceptions_error_handler($severity, $message, $filename, $lineno) {
  if (error_reporting() == 0) {
    return;
  }
  if (error_reporting() & $severity) {
    throw new ErrorException($message, 0, $severity, $filename, $lineno);
  }
}
*/

function parse_and_eval($filename)
{
	$parser        = (new PhpParser\ParserFactory)->create(PhpParser\ParserFactory::PREFER_PHP7);
	$traverser     = new PhpParser\NodeTraverser;
	$prettyPrinter = new PhpParser\PrettyPrinter\Standard;

	$func_finder = new FuncPHPNodeVisitor();

	$traverser->addVisitor($func_finder);

	try {
		$code = file_get_contents($filename);
		$traverser->traverse($parser->parse('<?php '.$code));
	}
	catch (PhpParser\Error $e) {
		fwrite(STDERR, 'Parse Error: '.$e->getMessage()." in {$filename}\n");
		exit;
	}
	$names = $func_finder->function_names;
	if (isset($names) && is_array($names) && count($names) > 0) {
		eval(file_get_contents($filename));
	} else {
		fwrite(STDERR, "Found no PHP functions in $filename\n");
	}
	return $names;
}