diff --git a/README.md b/README.md
index 9a09edf..64c1cea 100644
--- a/README.md
+++ b/README.md
@@ -9,6 +9,9 @@ aslr : Switch on/off aslr (for lazy guys)
C
cprint : Column print a file (only ascii printable)
+P
+phpeval.py: Deobfuscate php code like eval(gzinflate(base64(backdoorcode)))
+
R
ropval.py : Find values in ELF, usefull for rop like ADD EAX,[EBX]
diff --git a/phpeval.py b/phpeval.py
new file mode 100755
index 0000000..faffc07
--- /dev/null
+++ b/phpeval.py
@@ -0,0 +1,175 @@
+#!/usr/bin/python
+import sys
+import re
+import base64
+import zlib
+
+# v 0.1 Beta de Beta de chez Beta
+
+# Copyleft Thanat0s
+# http://Thanat0s.trollprod.org
+#
+# Licence GNU GPL
+
+# Extract Php Code from obfuscated
+# Understand :
+# base64
+# bzinflate
+# eval
+
+func_payload = ''
+phpoutput = ''
+CRLF = chr(0x0a)
+ROUND = 0
+
+def evaluate(strline):
+ global phpoutput
+ global PHP_Variable
+ global func_payload
+ global ROUND
+# Evaluate the code in a string
+ if re.match('^\$' ,strline):
+ variable = re.split('=', strline, 1)
+ print "Set variable : " + variable[0]
+ PHP_Variable[variable[0]]= variable[1]
+ phpoutput = phpoutput + strline + "; " + CRLF
+
+ elif re.match('^eval(\s)*\(.*\)' ,strline):
+ print "Fonction eval " ,
+ code_regex = re.match(r"^eval(\s)*\((?P.*)\)", strline)
+ code = code_regex.group('CODE')
+ if not re.match('^(\'|\"|\$)',code ):
+ print ", Sub",
+ evaluate(code)
+ else:
+ func_payload = code
+ ROUND = ROUND + 1
+ phpoutput = phpoutput + "// DECODING ROUND " + str(ROUND) + CRLF
+ phpoutput = phpoutput + func_payload + ";" + CRLF
+
+ elif re.match("^gzinflate(\s)*\((?P.*)\)", strline):
+ code_regex = re.match(r"^gzinflate(\s)*\((?P.*)\)", strline)
+ code = code_regex.group('CODE')
+ print "Function gzinflate " ,
+ if not re.match('^(\'|\"|\$)',code ):
+ print ", Sub",
+ evaluate(code)
+ # No more nested function
+ if re.match('^\$', code): # gzinflate variable
+ func_payload = PHP_Variable[code] # from previous set variable
+ #else:
+ #// func_payload = code #
+ func_payload = zlib.decompressobj().decompress('x\x9c' + func_payload)
+
+ elif re.match("^base64_decode(\s)*\((?P.*)\)", strline):
+ code_regex = re.match(r"^base64_decode(\s)*\((?P.*)\)", strline)
+ code = code_regex.group('CODE')
+ print "Function base64_decode " ,
+ if not re.match('^(\'|\"|\$)',code ):
+ print ", Sub",
+ evaluate(code)
+ # No more nested function
+ if re.match('^\$', code): # gzinflate variable
+ func_payload = PHP_Variable[code] # from previous set variable
+ func_payload = re.sub('(\"|\')$', '', func_payload)
+ func_payload = re.sub('^(\"|\')', '', func_payload)
+ else:
+ func_payload = code
+ func_payload = re.sub('^[\"\']', '', func_payload)
+ func_payload = re.sub('[\"\']$', '', func_payload)#
+ func_payload = base64.b64decode(func_payload)
+ print "Done"
+
+ else:
+ print "Unknown sentence : " + strline
+ phpoutput = phpoutput + strline + ";"+ CRLF
+
+
+if len(sys.argv) != 2:
+ print 'Deobfuscate PHP Code from a file'
+ print 'To Use: ' + sys.argv[0] + ' infile'
+ sys.exit()
+
+file = open(sys.argv[1], 'rb')
+byteArr = bytearray(file.read())
+file.close()
+fileSize = len(byteArr)
+
+Result = ''
+PenDown = False
+Comment = False
+CommentType = ''
+byte = 0
+
+# Preproccessing .. clean UP ;
+while ( byte <= fileSize-1) :
+ # Ignore dans les strings
+ if ((byteArr[byte] == ord("'")) and (CommentType != '"')):
+ Comment = not Comment # Toggle True to False
+ if Comment == True:
+ CommentType = "'"
+ else:
+ CommentType = ''
+
+ # Ignore dans les strings
+ if ((byteArr[byte] == ord('"')) and (CommentType != "'" )):
+ Comment = not Comment # Toggle True to False
+ if Comment == True:
+ CommentType = '"'
+ else:
+ CommentType = ''
+
+ # Prend entre et ?>
+ if Comment == False:
+ if (byteArr[byte] == ord("<")) and (byteArr[byte+1] == ord("?")) and (byteArr[byte+2] == ord("p")) and (byteArr[byte+3] == ord("h")) and (byteArr[byte+4] == ord("p")) :
+ PenDown = True
+ byte = byte + 5
+
+ if (byteArr[byte] == ord("<")) and (byteArr[byte+1] == ord("?")) :
+ PenDown = True
+ byte = byte + 2
+
+ if (byteArr[byte] == ord("?")) and (byteArr[byte+1] == ord(">")) :
+ PenDown = False
+ byte = byte + 2
+
+ # CRLF on ;
+ if (byteArr[byte] == ord(";")) :
+ Result = Result + chr(0x0a)
+ byte = byte + 1
+
+ if (byteArr[byte] == 0x0d ) :
+ byte = byte + 1
+
+ if PenDown == True:
+ Result = Result + chr(byteArr[byte])
+ byte = byte + 1
+
+
+line = []
+byte = 0
+tmpbuffer = ''
+# Convert Array to strings
+for char in Result:
+ if char == chr(0x0A) :
+ # Chomp line
+ tmpbuffer = tmpbuffer.rstrip('\n')
+ tmpbuffer = re.sub('\s+', ' ', tmpbuffer)
+ tmpbuffer = re.sub('^\s', '', tmpbuffer)
+ # Comment out
+ tmpbuffer = re.sub('^\/\*.*\*\/', '', tmpbuffer)
+ tmpbuffer = re.sub('^\/\/.*$', '', tmpbuffer)
+ if tmpbuffer != "":
+ line.append ( tmpbuffer)
+ tmpbuffer = ''
+ tmpbuffer = tmpbuffer + char
+
+
+phpoutput = phpoutput + "// Decoded by phpeval.py" + CRLF
+phpoutput = phpoutput + "// DECODING ROUND " + str(ROUND) + CRLF
+PHP_Variable={}
+for strline in line:
+ evaluate(strline)
+phpoutput = phpoutput + "// END OF DECODING ROUND " + str(ROUND) + CRLF
+
+print phpoutput
diff --git a/xphp.py b/xphp.py
index e33f59e..620d4e8 100755
--- a/xphp.py
+++ b/xphp.py
@@ -37,7 +37,7 @@
if ((byteArr[byte] == ord('"')) and (CommentType == '' or CommentType == ord('"'))):
Comment = not Comment # Toggle True to False
if Comment == True:
- CommentType = "'"
+ CommentType = '"'
else:
CommentType = ''