Skip to content

Releases: bediger4000/reverse-php-malware

Obscurely indirected variables renamed.

14 Mar 16:07
28bc979

Choose a tag to compare

When run with "-R" flag, it tries to replace the code that indirectly-names variables with the "true name", the result of the indirection, of the variable.

Array creation, copying and assignment

02 Aug 06:08

Choose a tag to compare

Changes to keeping arrays in the symbol table: actually create PHP arrays from the parse trees, instead of just creating a string representation of arrays.

There's also some changes around executing functions like strrev(), str_rot13(), etc. Code no longer makes a distinction between 1- and 2-argument functions, as it uses parse tree to create an array of arguments, and calls the specified function via call_user_func_array().

This latter change also makes it easier to use external decoder functions, because they can have arbitrary numbers of arguments.

Better GLOBALS handling

22 Jun 04:46

Choose a tag to compare

Handle $GLOBALS peculiarities.

Handle create_function()

28 Sep 03:55

Choose a tag to compare

A few minor cleanups, some added zoo/ test cases, and the ability to deal with one or more create_function() invocations.

Decent documentation

07 Jun 03:22

Choose a tag to compare

v1.1

Add "testing" section. Expand -D, -r usage.

Old CVS tip

23 May 21:06

Choose a tag to compare

Files from my CVS repository. This is just a "marker" release, to preserve a consistent set of files at a point in time.