pk-fr / yakpro-po

YAK Pro - Php Obfuscator
http://www.php-obfuscator.com
Other
1.29k stars 363 forks source link

Reserved class method names are scrambled under certain conditions #11

Closed mologie closed 8 years ago

mologie commented 8 years ago

When limiting the scope of predefined functions which are scanned, the scrambler catches some reserved function names such as __call because they do not appear in any of the scanned predefined classes.

The reason for this is that in scrambler.php, line 265, t_ignore is populated with a list of reserved functions, not methods. No fancy example this time ;).

pk-fr commented 8 years ago

_in scrambler.php, line 265, tignore is populated with a list of reserved functions, not methods.

As you can see in http://php.net/manual/en/reserved.keywords.php: These words have special meaning in PHP. Some of them represent things which look like functions, some look like constants, and so on - but they're not, really: they are language constructs. You cannot use any of the following words as constants, class names, function or method names.

_call is processed differently, it is part of $t_reserved_method_names: as you can see in http://php.net/manual/en/language.oop5.magic.php:
The function names construct(), destruct(), call(), callStatic(), get(), set(), isset(), unset(), sleep(), wakeup(), toString(), invoke(), __set_state(), clone() and debugInfo() are magical in PHP classes. You cannot have functions with these names in any of your classes unless you want the magic functionality associated with them.

mologie commented 8 years ago

Hello, this issue is not resolved - please reopen. We may have misunderstood eachother.

The issue is that I do want the functionality of __call, but the scrambler replaces __call by something random. The resulting code is not equivalent to the input, so this is a bug.

Please check this line:

https://github.com/pk-fr/yakpro-po/blob/master/include/classes/scrambler.php#L265

The t_ignore array is only populated with reserved functions, which may in itself be correct like you described. (But take care: You do not ignore reserved functions in any other context either, and I do not see the advantage of doing so when dealing with function method names on the input side anyway.)

The ignore list should additionally be populated with $this->t_reserved_method_names so that magic method names like __call are not scrambled.

pk-fr commented 8 years ago

Hi Oliver,
I misunderstood what you were trying to tell me (perhaps due to the lack of a small example ;o) )... There is effectively a bug due to the new config file $conf->t_ignore_pre_defined_classes element introduced in 1.8.0 , replacing the old $conf->t_ignore_module_methods ... The internal associated $t_reserved_method_names property had its structure changed... but the code near the line 265 was not changed accordingly... additionally, there was a side effect of the $conf->t_ignore_pre_defined_classes with the default value 'all' was hiding the issue.
fixed in 1.8.5 (I hope so)
Happy Christmas...