2

I have a plugin, which was obfuscated by plugin developer with sourcecop. At some point it began sending out lots of php warnings to debug.log. I couldn't debug it myself since it was obfuscated, but plugin support was also silent. Online Deobfuscateors I tried didn't help. How to Deobfuscate it?

2
  • What are the benefits of using a plugin that goes around the principle of open source? Did you find out after the fact? Feb 2, 2023 at 15:27
  • 1
    @NoraMcDougall-Collins I don't think there ever were any benefits of it being obfuscated, it's just a plugin that client installed and has been using for a long time, I assume it does it's job well, and maybe there were no alternatives? Feb 3, 2023 at 17:01

1 Answer 1

2

I came up with a single (linux) terminal command to deal with this. Logic is to just change eval( code_to_eval ) in obfuscated php files to file_put_contents( __FILE__, code_to_eval ). At least that worked for me (my problematic plugin was "Wishlist 1Click Registration" by "HappyPlugins"). Here's the command:

grep -irl --include \*.php "eval(.*);" . | xargs -i sh -c "echo {}; sed -i 's/eval(\(.*\));/file_put_contents(__FILE__,\1);/g' {}" | xargs -i sh -c "echo {}; php {} > /dev/null || true; sed -i '1s/^?>//g' {}"

What the command does:

  • gets all .php files in current directory (need to cd to plugin root directory) that contain eval() in them,
  • replaces all eval( code ) with file_put_contents( __FILE__, code ),
  • executes those files with php (need to have php available from command line) - this runs all file_put_contents() statements and replaces all current obfuscated code in .php file with whatever was passed to eval().
  • removes ?> from beginning of each of those files afterwards - it was used for eval code to work for some reason, but now it would just echo "?>" to browser, which we don't need.

Afterwards, you can also probably delete the "scopbin" folder in plugin's root - it contains one, now unused, .php file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.