fix: deobfuscator php string detection

marcocesarato · Dec 31, 2020 · a876561 · a876561
1 parent 62eb024
commit a876561
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/src/Deobfuscator.php b/src/Deobfuscator.php
@@ -77,7 +77,7 @@ public function deobfuscate($str)
      */
     public function decode($code)
     {
-        preg_match_all("/<\?php(.*?)(?!\B\"[^\"]*)(\?>|$|)(?![^\"]*\"\B)/si", $code, $matchesPhp);
+        preg_match_all("/<\?php(.*?)(?!\B\"[^\"]*)(\?>(?=([^\"]*\"[^\"]*\")*[^\"]*$)|$)/si", $code, $matchesPhp);
         foreach ($matchesPhp as $matchPhp) {
             $matchPhp = preg_replace("/<\?php(.*?)(?!\B\"[^\"]*)(\?>|$)(?![^\"]*\"\B)/si", '$1', @$matchPhp[0]);
             $str = preg_replace("/(\\'|\\\")[\s\r\n]*\.[\s\r\n]*('|\")/si", '', $matchPhp); // Remove "ev"."al"
@@ -114,13 +114,14 @@ public function decode($code)
                 // Check decode functions
                 $regexPattern = '/((' . implode('|', $patternDecoder) . ')[\s\r\n]*\((([^()]|(?R))*)?\))/si';
                 preg_match($regexPattern, $str, $match);
+
                 // Get value inside function
                 if ($recursiveLoop && isset($match[0]) && preg_match('/(\((?:\"|\\\')(([^\\\'\"]|(?R))*?)(?:\"|\\\')\))/si', $match[0], $encodedMatch)) {
-                    $value = $encodedMatch[3];
+                    $value = $encodedMatch[2];
                     $decodersFound = array_reverse(explode('(', $match[0]));
                     foreach ($decodersFound as $decoder) {
                         if (in_array($decoder, $decoders) && (is_string($value) && !empty($value))) {
-                            $value = $decoder($value); // Decode
+                            $value = @$decoder($value); // Decode
                         }
                     }
                     if (is_string($value) && !empty($value)) {