Question

I had a php obfuscation program a while ago but I forgot what it was called. It could obfuscate code, and confuse people who knew a little php.

Here’s what an obfuscated example looks like:

<?php session_start();include("\x6c\x69b/\x62\x2f\x6d\x69nd/m\x61x\x2e\x70h\x70");${"G\x4c\x4f\x42A\x4cS"}["s\x69lv\x62g"]="\x70\x5ft\x69\x74\x6c\x65";$wdrvnbyeveu="\x70\x5ft\x69\x74\x6c\x65";secure();switch($_GET["\x64"]){case"r":${${"\x47L\x4f\x42AL\x53"}["s\x69\x6c\x76\x62\x67"]}="R\x65p\x6c\x79\x20\x74\x6f tick\x65\x74";include("l\x69b/\x74/repl\x79\x2ep\x68p");break;default:${$wdrvnbyeveu}="S\x75p\x70ort";include("lib/\x74/d\x65f\x61\x75l\x74.php");break;}include("li\x62/b/\x66\x6fot/kill.p\x68p");
?>

Does anyone know what program this was by looking at the example?

Thanks for the help.

Answer 1

There’s a bunch of PHP obfuscators. Probably several of them can do something like this.

Our Thicket PHP Obfuscator will obfuscate literal strings exactly this way, and will preserve system function identifiers such as “session_start” in this fashion, so it could be ours.