0

I have a PHP file that is encrypted with Ioncube. Searching on the internet I found one guy which has decoded it, but when I run the decoded file, the code behavior changes so I can't replace the decoded file with the encrypted file.

Reading the code of the decoded PHP file, I found that on the first line of it, has a function like this:

function AUE92043HBAHIALA($process)
{
    clearstatcache(true);
    if (file_exists('/var/myfolder/myfolder2/database/' . $process . '.monitor')) {
        $pid = intval(file_get_contents('/var/myfolder/myfolder2/database/' . $process . '.monitor'));
    }
    if (!empty($pid)) {
        if (file_exists('/proc/' . $pid)) {
            $name = trim(file_get_contents('/proc/' . $pid . '/cmdline'));
            if ($name == 'Software[' . $process . ']') {
                posix_kill($pid, 9);
            }
        } else {
            shell_exec('kill -9 `ps -ef | grep \'Software\\[' . $process . '\\]\' | grep -v grep | awk \'{print $2}\'`;');
        }
        file_put_contents('/var/myfolder/myfolder2/database/' . $process . '.monitor', getmypid());
    }
}

Then below this function, there is more code which calls this function. What I need to modify on the encrypted file by Ioncube is the folder name /var/myfolder/myfolder2/database/ to this /home/software/logs/database/ on the AUE92043HBAHIALA function.

Do you have some advices to achieve this? I don't know if I can achieve this by using runkit7_function_redefine or decompiling PHP. I would like to hear all your suggestions, thanks.

1
  • You don't have to decompile PHP. Its open source, patch the functions required, recompile and install. – sudhackar Feb 16 at 14:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.