1

So i'm fixing my client's web that based on laravel. After i opened it, every controller and model look like this. For example this is one of model file from laravel.

<?php /* ucode version 1.0.0 */ 
$ucode = base64_decode("PER6dyU5LSU2M0ZIPkVMazJma1xOen4oVD7CwkNGPVwmKSfCWWdheH0vXS4kMUTCwldNV0lYWll6c3lrJH18Pio+PDZMRlFVa1hbbygpeXV6LSQ4SGpSZ2hhalhaY2R0JUcvRklHwkhJwldcZVpdXXU4ICddVGBeYXdIwlJXXGFma3B1eiAlKiR2Jn0tPTNAZUhRS1FaamBtMcIvNDk+Q0hNUldcYWZXYFpgYmZ8ciR9JE/CTVJXXGFma3B1eiAleHAieig4LjtewlxhZmtwdXogJSovNC4hMCg3Rz1Kb1pNZWtcbjHCLzQ5PkNITVJXXGFmUFZmbyzCKi80OT5DSE1SV1xhVFFjW2YswiovNDk+Q0hNUldcYTFRX19uLMIqLzQ5PkNITVJXXGFaYFJqcHNvIHAhRcJDSE1SV1xhZmtwdXp0Z3ZufS4kMVY2NEpEQ1dbXGVmLMIqLzQ5PkNITVJXXGFPTWNdXGp6a3tFRcJDSE1SV1xhZmtwdXpran50J3otKyo8XsJcYWZrcHV6ICUqLzQsIC9UwlJXXGFma3B1eiAlKiMpKSoxMjxewlxhZmtwdXogJSovNC0oNz0zQEA+VE5NW2tcbDHCLzQ5PkNITVJXXGFmYFNiWml5b3woLi4vVkFHR0htwmtwdXogJSovNDk+Qz0wPzdGVkxZWWApcmptfid9PjgrOjJBUUdUVFsiwiAlKi80OT5DSE1SV1FEU0taamBteH5+IEcxKSw9RTxcVklYUF9vZXJ9JCQlSsJITVJXXGFma3B1eiBybkQ8QcJDSE1SV1xhZmtwdXogJSovNDk+Qyw9NERCVUpReGpdbGRzJHknTC84MjhBUUdUd3d8JDo/YFBmXGZkek1PVMJhZmtwdXogJSovNDk+Q0hNUldcYUpbUmJgc2hvNyApIykrL0U7TEZMd3d8JDo/YFBmXGZkek1PVMJhZmtwdXogJSovNDk+Qyw9NERCVUpReGRcbWZzJHknSkpPVmxxMyM5Lzk3TSAiJ8I0OT5DSE1SV1xhZmtwdV5vZnZ0KHwkSz0wPzdGVkxZfmlcdHprfUBARUxiZyl4LyUvLUNyd8IlKi80OT5DSE1SV1xhZk9gV2dleG10PH0kND1ZWV5leyFCMkg+SEZcLDHCPkNITVJXXGFma3B1eiBoeXAhfjInLlVAPU9HUnd3fCQ6P2BQZlxmZHpKT8JcYWZrcHV6ICUqLzQ5Pic4Lz89UEVMcztbaWl4NjY7Qlhdfm4leiUjOWhtwnogJSovNDk+Q0hNUldcRVZNXVtuY2oyIyl6Mzk8OEg5SW1tcnkwNVZGXFJcWnBARcJSV1xhZmtwdXogJSovNHwuJTUzRjtCaVtOXVVkdGp3PXx6MSsqPkJDTE1ye3kwNVZGXFJcWnBARcJSV1xhZmtwdXogJSovNHwuJTUzRjtCaU9NY11canpre0VFTkxiZyl4LyUvLUNyd8IlKi80OT5DSE1SV1xhZk9gV2dleG10PCUkOC5ANEZEQ1V3d3wkOj9gUGZcZmR6Sk/CXGFma3B1eiAlKi80OT4nOC8/PVBFTHNjV2YsLDE4TlN0ZHpwengvXmPCcHV6ICUqLzQ5PkNITVI7TENTUWRZYCh4fn4gJygyVF1bcXY4KD40PjxSIifCNDk+Q0hNUldcYWZrcHVeb2Z2dCh8JEs8N0ZMQk9PTWNdXGp6a3tAQEVMYmcpeC8lLy1DcnfCJSovNDk+Q0hNUldcYWZrcHV6ICVtfnUmJDcsM1pXUURTS1pqYG1tdD0nfiIzOzJeXlhfbXQrMFFBV01XVWs+QEXCUldcYWZrcHV6ICUqLzQ5PkNITVI7TENTUWRZYCh5bHtzIzMpNkFHR0hvWVFUZW1kMTErMkBHXWIkcyogKig+cH4kIHJuRCgvLMJITVJXXGFmazdISk0lfnEheCg4LjtSwlxhZmtwdXogUU9VaDlocnF7Ul/CYWZrcHV6ICUqLzQ5cWh0cnUsXE1WUFZfb2VyNsI0OT5DSE1SV1xhZmtSaG1hfmlweyFGSzUzST1JbVpNZWtcbjEqeSImMiU2PjRBXG1PTWNdXGp6a3tAOTMtOTM7QmVqZl5WWWpyacIvNDk+Q0hNUldcYWYyQ0VIwiUqLzQ5PkNITVJXXFZJWFBfb2Vycnk0wj5DSE1SV1xhZmtwdUJSVF9fNFt3QzQ9Nz1GVkxZwnV6ICUqLzQ5R0M9MD83RlZMWVlgek9TKiR2Jn0tPTNAZUhRS1FaamBtJUcvKXsrIzJCOEVFTHRXYFpgaXlvfMI5PkNITVJXXMJma3B1eiAlKltZX3JDcnx7JlxpwmtwdXogJSovNDk+Q3tyfnwgNmZXYFpgaXlvfEA5LCVBVT5HQUdJTWNZamRqMy8gKSMpKy9FO0xGTMJwdXogJSovNDk+Q0hzJScqYWZgU2JaaXlvfCh6MzkqPD1FScJma3B1eiAlKi80OT5qenwoKFwkQGtcZV9lbn50IsI+Q0hNUldcYW9rZVhnX25+dCItIDg+L0FCSk5mOz91b2JxaXgpfixRND03PUZWTFlwM3p0Z3ZufS4kMTwvR00+UFFZXSRmb2lveCl+LMJITVJXXGFmaz07QVQlVF5dZz5Lwk1SV1xhZmtwdXogJV1UYF5hd0g5QjxCS1tRXiLCICUqLzQ5PkNITVJXXGFma2RraCh4fn4gQj43PT0+Y8JhZmtwdXogJSovNDk+Q0hNNEpPQ2BLUl1iKC11cCMuLjZUQUdHSGpva2NbXm93bsI0OT5DSE1SV1xhZms3SEpNJX5xIXgoOC47RkxMTcJrcHV6ICUqLzQ5PkNvICItLWEpRXBhamRqcyR5J8JDSE1SV1xhZnRwal1sZHMkeScyODg5UicrYVtOXVVkdGp3PSApIykyQjhFXH5mYFNiWml5b3woLi4vVjlCPEJLW1FewnogJSovNDk+cnpxdypcJEBrXGVfZW5+dCLCPkNITVJXXGFTVV5fbyApdngiIzNDODQ5S0JWZm9gXGFzan4xT8LCQ0hRRT1QV1NgZHU4IElMSU58LjI3MzZMRlFVc3dfa294MThBVzIpNTM2TGRlWl1dfjbCJSoieS40NjdNVkpCVVxYZWk2wiUowjLCwg==");
ucode($ucode);
?>

In this code, there is a base64 code that will be decoded and a function named "ucode". I tried to find the information about this encryption and found nothing in the internet.

My PHP version is

PHP 5.6.17-pl0-gentoo (cli) (built: Feb 9 2016 01:24:30) Copyright (c) 1997-2015 The PHP Group Zend Engine v2.6.0, Copyright (c) 1998-2015 Zend Technologies with Zend OPcache v7.0.6-dev, Copyright (c) 1999-2015, by Zend Technologies

I tried to trace this "ucode" function and found that this function is built in with the PHP. i mean when tried to make a "test.php" file and call the ucode() in it, it is exist. also when i tried to redeclare ucode() function inside a blank php file, it returned an error because it is already declared.

So i want to ask if somebody know how this work. why the function is this encryption is included in PHP standart function?

Faisal Amirullah
  • 13
  • 1
  • 6
  • 7
    It's not a standard function. It's most likely provided by an extension. Run `php -m` to see a list of enabled extensions. – Peter Feb 11 '19 at 14:01
  • wow after i run that, there is a module named ucode. i googled it and found nothing. is that a self made module? – Faisal Amirullah Feb 11 '19 at 14:03
  • Never heard of it, and Google doesn't turn up anything for me either. Given that you are running on Gentoo you should have the source code on your system somewhere, though, but I don't know enough about Gentoo to help you find it. – Peter Feb 11 '19 at 14:05
  • 4
    Did a quick Google and found this: https://sourceforge.net/projects/microcode/ – Jerodev Feb 11 '19 at 14:07
  • ok thx guys for the information. i will post on answer if i found the solution. – Faisal Amirullah Feb 11 '19 at 14:46

0 Answers0