Simple python script to deobfuscate the hex and replace the junk variables:<p><pre><code> import re
a = open('test.php')
line = a.readlines()
# Replace hex values with ASCII, regex to find the \x values and a lambda to replace each match individually
def decoder(char):
return char[2:].decode("hex")
unhex = re.sub("\\\\x[a-f0-9][a-f0-9]", lambda m: decoder(m.group()), line[0])
# Replace ${"GLOBALS"}["foo"] = "bar"
for match in re.findall('\${"GLOBALS"}["[a-z0-9]+"]="[a-z0-9]+"', unhex):
variable = re.findall(r'"(.*?)"', match)
pattern = '\${\${"GLOBALS"}\["'+variable[1]+'"\]}'
unhex = re.sub(pattern, variable[2], unhex)
unhex = unhex.replace(match+";", '')
# Replace $bar = "foo"
for match in re.findall('\$[a-z0-9]+="[a-z0-9]+"', unhex):
replace = re.findall(r'"(.*?)"', match)[0]
pattern = re.findall(r'\$[a-z]+', match)[0]
unhex = unhex.replace(pattern, replace)
# Chuck in newlines
unhex = unhex.replace(";", ";\n ")
b = open('out.php', 'w')
b.writelines(unhex)
</code></pre>
The files all seemed to be one liners, so this works. More work to replace everything else though. Blergh.<p>Edited to include variable replacement. I think there are some catches with things like ${sgasklgna} but it largely works. Just needs prettifying.