Post Reply 
 
Thread Rating:
  • 1 Vote(s) - 5 Average
  • 1
  • 2
  • 3
  • 4
  • 5
DeZender empty functions
07-27-2012, 04:40 PM (This post was last modified: 07-27-2012 07:53 PM by yannik.)
Post: #1
DeZender empty functions
When DeZending some of my files I often get output such as this:

PHP Code:
$p_contents base64_decode( ( ( str_replace"-"""$contents ) ) ) ); 

As you can see, DeZender failed to retrieve the nested functions.

The opcodes for the function above look like this:

Code:
99  USER_OPCODE                  [-]   0[0]  -
   100  FETCH_CLASS                  [-]   4[4] NULL - , 'gwzy1im42l'
   101  INIT_STATIC_METHOD_CALL      [-]   0[0]  - NULL, 'ii%01%0D%25%2Fu'
   102  FETCH_CLASS                  [-]   4[4] NULL - , 'gwzy1im42l'
   103  INIT_STATIC_METHOD_CALL      [-]   0[0]  - NULL, 'qibv%3E%5B%40'
   104  SEND_VAL                     [-]  60[0]  - '-' -
   105  SEND_VAL                     [-]  60[0]  - '' -
   106  SEND_VAR                     [-]  60[0]  - $contents -
   107  USER_OPCODE                  [-]   3[0] $Var_96
   108  SEND_VAR_NO_REF              [-]   4[0]  - $Var_96 -
   109  DO_FCALL_BY_NAME             [-]   1[0] $Var_96 -  -
   110  SEND_VAR_NO_REF              [-]   4[0]  - $Var_96 -
   111  DO_FCALL_BY_NAME             [-]   1[0] $Var_96 -  -
   112  SEND_VAR_NO_REF              [-]   4[0]  - $Var_96 -
   113  DO_FCALL_BY_NAME             [-]   1[0] $Var_96 -  -
   114  ASSIGN                       [-]   0[1] $Var_120, $contents, $Var_96
[/php]

Calls 100-103 are especially important, as they are the missing functions.
The class 'gwzy1im42l' does actually exist. However, i do not know how to convert 'ii%01%0D%25%2Fu' to a _obfuscated_XXX function.

How can I do that? It would be nice if one of the devs could have a look at this bug.
Find all posts by this user
Quote this message in a reply
07-31-2012, 04:58 PM
Post: #2
RE: DeZender empty functions
Anyone having ideas on this?
Find all posts by this user
Quote this message in a reply
01-26-2014, 01:28 PM
Post: #3
RE: DeZender empty functions
(07-31-2012 04:58 PM)yannik Wrote:  Anyone having ideas on this?

Have you found the solution for this problem?
Find all posts by this user
Quote this message in a reply
Post Reply 


Forum Jump:


User(s) browsing this thread: 1 Guest(s)

Contact Us | Homepage | Return to Top | Return to Content | Lite (Archive) Mode | RSS Syndication