diff --git a/HeuristicAnalyser.php b/HeuristicAnalyser.php index 735873a..20256f8 100644 --- a/HeuristicAnalyser.php +++ b/HeuristicAnalyser.php @@ -365,7 +365,7 @@ public function processContent() // Executing decoding functions // @ToDo there was many false positives! - // $this->transformations->decodeData($key); + $this->transformations->decodeData($key); } $this->variables->concatenate(); // Concatenates variable content if it's possible diff --git a/Modules/Transformations.php b/Modules/Transformations.php index b2cebc9..3f8a094 100644 --- a/Modules/Transformations.php +++ b/Modules/Transformations.php @@ -132,23 +132,20 @@ private function transformHexStringIntoTokens($hex_string) $data = @hex2bin($data); } if ( $data ) { - //tokenize data to from parts - $data = @token_get_all('tokens->unsetTokens('prev1', 'next1', 'next2', 'next3', 'next4'); - - //add new tokens to the line - for ( $i = 0; $i < count($data); $i++ ) { - $new_token_value = is_array($data[$i]) && isset($data[$i][1]) ? $data[$i][1] : $data[$i]; - $this->tokens['current'] = new Token( - 'T_STRING', - '' . $new_token_value . '', - $this->tokens->current->line, - $this->tokens->current->key - ); - $this->tokens->next(); + if ( $this->tokens->prev1->value === '@' ) { + $this->tokens->unsetTokens($this->tokens->prev1[3]); } + $this->tokens->unsetTokens('next1', 'next2'); + + //add new tokens to the line + $this->tokens['current'] = new Token( + 'T_CONSTANT_ENCAPSED_STRING', + '"' . $data . '"', + $this->tokens->current->line, + $this->tokens->current->key + ); return true; } }