How to detect Multi-ary programming of Picture Trojans by php
This article is about how php detects multi-ary programming of picture Trojans. The editor thinks it is very practical, so share it with you as a reference and follow the editor to have a look.
Not long ago, I applied to join an open source organization, and they asked me to write a feature to detect whether there are Trojan scripts in the picture.
In fact, at first I didn't know anything, but later I checked some information on the Internet, and all I found were tutorials for making picture Trojans, but I didn't find the detection program.
After several thoughts, I decided to analyze this Trojan program from the production principle. This Trojan program was written in hexadecimal code, and I had an idea to write the following upload class. Finally passed the organization test. He he
Now take it out to share with you, if there is anything wrong, please correct it! Anyon@139.com
The code is as follows:
, /
/ * matching the case in hexadecimal is also possible * /
If (preg_match ("/ (3c25.*?28.*?29.*?253e) | (3c3f.*?28.*?29.*?3f3e) | (3C534352495054) | (2F5343524950543E) | (3C736372697074) | (2F7363726970743E) / is", $hexCode)
Self::$status = 5
Else
Self::$status = 0
Return self::$status
} else {
Return self::$status = 9
}
}
/ / @ Private create directory
Private static function umkdir ($dir) {
If (! file_exists ($dir) & &! is_dir ($dir)) {
Self::umkdir (dirname ($dir))
@ mkdir ($dir)
}
}
}
Thank you for reading! On "php how to detect picture Trojans multi-ary programming" this article is shared here, I hope the above content can be of some help to you, so that you can learn more knowledge, if you think the article is good, you can share it out for more people to see it!
