Fix. Scanner. hex2bin decoding fixed. (#4)

CleanTalk · May 7, 2024 · 02e2a0e · 02e2a0e
1 parent 2264094
commit 02e2a0e
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 15 deletions.
diff --git a/HeuristicAnalyser.php b/HeuristicAnalyser.php
@@ -365,7 +365,7 @@ public function processContent()
 
                 // Executing decoding functions
                 // @ToDo there was many false positives!
-                // $this->transformations->decodeData($key);
+                $this->transformations->decodeData($key);
             }
 
             $this->variables->concatenate(); // Concatenates variable content if it's possible

diff --git a/Modules/Transformations.php b/Modules/Transformations.php
@@ -132,23 +132,20 @@ private function transformHexStringIntoTokens($hex_string)
                 $data = @hex2bin($data);
             }
             if ( $data ) {
-                //tokenize data to from parts
-                $data = @token_get_all('<?php ' . $data);
                 //unset unnecessary tokens
-                $this->tokens->unsetTokens('prev1', 'next1', 'next2', 'next3', 'next4');
-
-                //add new tokens to the line
-                for ( $i = 0; $i < count($data); $i++ ) {
-                    $new_token_value         = is_array($data[$i]) && isset($data[$i][1]) ? $data[$i][1] : $data[$i];
-                    $this->tokens['current'] = new Token(
-                        'T_STRING',
-                        '' . $new_token_value . '',
-                        $this->tokens->current->line,
-                        $this->tokens->current->key
-                    );
-                    $this->tokens->next();
+                if ( $this->tokens->prev1->value === '@' ) {
+                    $this->tokens->unsetTokens($this->tokens->prev1[3]);
                 }
 
+                $this->tokens->unsetTokens('next1', 'next2');
+
+                //add new tokens to the line
+                $this->tokens['current'] = new Token(
+                    'T_CONSTANT_ENCAPSED_STRING',
+                    '"' . $data . '"',
+                    $this->tokens->current->line,
+                    $this->tokens->current->key
+                );
                 return true;
             }
         }