Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added a shell script to deobfuscate in batches #17

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
# Composer
/vendor/
/composer.lock
/deobfuscated/
/toDeobfuscate/
4 changes: 4 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,10 @@ optional arguments:

The deobfuscated output is printed to STDOUT.

#### Batch Processing

Create a "toDeobfuscate" directory and put the files or directories you wish to deobfuscate inside it. Run `bash batchDeobfuscate.sh`. It will create a "deobfuscated" directory with the outputs. If the "deobfuscated" directory already exists, it will clear it before running.

### Web Server

`index.php` outputs a simple textarea to paste the PHP code into. Deobfuscated code is printed when the form is submitted
Expand Down
26 changes: 26 additions & 0 deletions batchDeobfuscate.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
# Create the "deobfuscated" directory if it doesn't exist and clear it if it does
mkdir -p deobfuscated
rm -rf deobfuscated/*

# Find all the files inside the "toDeobfuscate" directory and loop over them
find toDeobfuscate -type f | while read file; do

# Create the directory structure inside "deobfuscated"
mkdir -p "deobfuscated/$(dirname "$file" | sed 's/toDeobfuscate\///g')"

echo $file

if [[ "$file" == *.php ]]; then
# run index.php using -f and save the output to the corresponding directory inside "deobfuscated"
php index.php -f "$file" > "deobfuscated/$(echo "$file" | sed 's/toDeobfuscate\///g')"
else
# if the file is not a PHP file, just copy it
cp "$file" "deobfuscated/$(echo "$file" | sed 's/toDeobfuscate\///g')"
fi
done

echo "Done decoding!"

echo "Missing files:"
# Compare the "toDeobfuscate" and "deobfuscated" directories and echo a list with any missing files
diff -qr toDeobfuscate deobfuscated | grep "Only in toDeobfuscate:" | awk '{print $4}'