上一篇文章 ：【原创】PHP加密中的“VMProtect”——魔方加密反编译分析过程 https://www.cgzz8.cn/t-32248-1-1.html
自动反汇编反汇编器分析protected function dasmLine($eip, $asm, $args = [])
{
    $this->asm[$eip - 6] = [
        'asm' => $asm,
        'args' => $args,
    ];
}public function __call($name, $arguments)
{
    if (in_array($name, ['func7', 'func8', 'func10', 'func20', 'func33', 'func35', 'func41', 'func44', 'func56'])) {
        // 1 字节立即数
        $this->dasmLine($arguments[0], $this->asmMap[$name], [$this->getInt($arguments[0], 1)]);
        return 1;
    } elseif (in_array($name, ['func1', 'func16'])) {
        // 2 字节立即数
        $this->dasmLine($arguments[0], $this->asmMap[$name], [$this->getInt($arguments[0], 2)]);
        return 2;
    } elseif (method_exists($this, '_' . $name)) {
        // 特殊指令
        $result = $this->{'_' . $name}($arguments[0], $this->asmMap[$name]);
        $this->dasmLine($arguments[0], $this->asmMap[$name], $result[1]);
        return $result[0];
    } elseif (isset($this->asmMap[$name])) {
        // 无操作数指令
        $this->dasmLine($arguments[0], $this->asmMap[$name]);
        return 0;
    } else {
        throw new \Exception('Call undefined function ' . $name);
    }
}protected function getFunc($eip)
{
    $key = $this->getMemory($eip, 1);
    $func = $this->getMemory($eip + 1, 2) . $this->getMemory($eip + 4, 2);
    $func = str_repeat($key, 4) ^ $func;
    $func = base64_decode('zb+8') . $func;
    if (isset($this->fnm[$func])) { // function name map
        $func = $this->fnm[$func];
    } else {
        throw new \Exception('Function not exists: $eip=' . $eip . ' func=' . $func);
    }
    if (ord($key ^ $this->getMemory($eip + 3, 1)) != 6) {
        throw new \Exception('Instruction length is not 6');
    }
    return $func;
}[indent][/indent]代码分块[indent][/indent]if (cond)
    stmts-block
else
    else-blockjnz a
......   <---- 指针 1
jmp b
a:
......   <---- 指针 2
jmp c
b:
......
jmp d
c:
......
d:
......jnz a
......
jmp b
a:
......   <---- 指针 2
jmp c
b:
......   <---- 指针 1
jmp d
c:
......
d:
......jnz a
......
jmp b
a:
......
jmp c
b:
......   <---- 指针 1
jmp d
c:
......   <---- 指针 2
d:
......jnz a
......
jmp b
a:
......
jmp c
b:
......
jmp d
c:
......
d:
......   <---- 指针 1 & 指针 2/**
 * 条件分支语句
 * @param $jump_pointer
 * @param $next_pointer
 * home.php?mod=space&uid=155549 mixed
 * @throws \Exception
 */
protected function _jnz($jump_pointer, $next_pointer)
{
    if ($jump_pointer < $next_pointer) {
        throw new \Exception('jump pointer < next pointer');
    }

    // 备份 $asmTree
    $asmTreeElse = $asmTreeStmts = $asmTree = $this->asmTree;
    $asmTreePointer = count($this->asmTree);

    // 并分别走 stmts 块和 else 块
    ++$this->jnzStack;
    while ($jump_pointer != $next_pointer) {
        if (($jump_pointer > $next_pointer && $next_pointer > 0) || $jump_pointer < 0) {
            $this->asmTree = $asmTreeElse;
            try {
                $next_pointer = $this->dissect($next_pointer, $jump_pointer);
            } catch (JumpException $exception) {
                $next_pointer = $exception->jump_pointer;
            }
            $asmTreeElse = $this->asmTree;
        } else {
            $this->asmTree = $asmTreeStmts;
            try {
                $jump_pointer = $this->dissect($jump_pointer, $next_pointer);
            } catch (JumpException $exception) {
                $jump_pointer = $exception->jump_pointer;
            }
            $asmTreeStmts = $this->asmTree;
        }
    }
    --$this->jnzStack;

    // 检测循环
    $asmTreeStmtsLastOne = $asmTreeStmts[count($asmTreeStmts) - 1];
    $loop_begin = false;
    if ($asmTreeStmtsLastOne['asm'] == 'loop_end') {
        $loop_begin = $asmTreeStmtsLastOne['args']['begin'];
        array_pop($asmTreeStmts);
        $asmTreeElse[] = [
            'asm' => 'iter_break',
            'args' => [],
        ];
    }

    // 恢复 $asmTree
    $this->asmTree = $asmTree;

    // 构造 if 指令
    $this->asmTree[] = [
        'asm' => 'if               [esp]',
        'args' => [
            'stmts' => array_slice($asmTreeStmts, $asmTreePointer),
            'else' => array_slice($asmTreeElse, $asmTreePointer),
        ],
    ];

    // 构造 loop 指令
    if ($loop_begin !== false) {
        $loop_stmts = array_slice($this->asmTree, $loop_begin);
        $this->asmTree = array_slice($this->asmTree, 0, $loop_begin);
        $this->asmTree[] = [
            'asm' => 'loop',
            'args' => [
                'stmts' => $loop_stmts,
            ],
        ];
    }

    return $next_pointer;
}反编译线性代码add              esp, 16
push             (null)
db               [esp], 'is_admin'
call (0)         [esp]
not              [esp]
if               [esp]
    pop
else
    pop
    push             (null)
    link             [esp], [ebp+1]
    push             (null)
    db               [esp], 'Grace'
    ....../**
 * 分配局部变量
 * @param int $count
 */
protected function _add($count)
{
    for ($i = 0; $i < $count; ++$i) {
        $this->v[] = new Variable('v' . $i);
    }
}protected function _push()
{
    ++$this->astp;
    $this->ast[$this->astp] = new ConstFetch(new Name('null'));
}/**
 * 读取数据
 * @param string|int $data
 * @throws \Exception
 */
protected function _db($data)
{
    if (is_string($data)) {
        $this->ast[$this->astp] = new String_($data);
    } elseif (is_numeric($data)) {
        $this->ast[$this->astp] = new LNumber($data);
    } elseif (is_array($data)) {
        $this->ast[$this->astp] = new Array_($data);
    } else {
        throw new \Exception('Move invalid data.');
    }
}protected function _call($argCount)
{
    $args = [];
    for ($i = $argCount - 1; $i >= 0; --$i) {
        $args[] = new \PhpParser\Node\Arg($this->ast[$this->astp - $i]);
    }
    $this->ast[$this->astp - $argCount] = new FuncCall(
        new Name($this->ast[$this->astp - $argCount]->value),
        $args
    );
}protected function _not()
{
    $this->ast[$this->astp] = new BooleanNot($this->ast[$this->astp]);
}if               [esp]
    pop
else
    pop$this->ast[$this->astp] = new If_($this->ast[$this->astp]);/**
 * 引用
 * @param int $offset link [esp], [ebp+{$offset}] 中的 $offset
 */
protected function _link($offset)
{
    $this->ast[$this->astp] = $this->v[$offset - 1];
}[indent][/indent]条件分支结构

[*]“逻辑或”短路
[*]三元运算符
[*]if 语句
[*]另一种三元运算符的写法

// 普通 if 语句
$this->_pop();
$cond = $this->ast[$this->astp];
// 备份 AST
$ast = $this->ast;
$astp = $this->astp;
$astbp = $this->astbp;
$stackMap = $this->stackMap;
// 解析 stmts 块
$this->decompile(array_slice($item['args']['stmts'], 1));
$stmts = array_slice($this->ast, $astp + 1, $this->astp - $astp);
// 恢复 AST
$this->ast = $ast;
$this->astp = $astp;
$this->astbp = $astbp;
$this->stackMap = $stackMap;
// 解析 else 块
$this->decompile(array_slice($item['args']['else'], 1));
$else = array_slice($this->ast, $astp + 1, $this->astp - $astp);
// 如果栈差1、只有一条表达式，就换成三元运算符
$is_ternary = ($this->astp - $this->astbp == 1 && count($stmts) == 1 && count($else) == 1
    && $stmts[0] instanceof Expr && $else[0] instanceof Expr);
$this->ast = $ast;
$this->astp = $astp;
$this->astbp = $astbp;
$this->stackMap = $stackMap;
// 构造 AST
if ($is_ternary) {
    $this->ast[$this->astp] = new Ternary($cond, $stmts[0], $else[0]);
} else {
    $this->ast[$this->astp] = new If_($cond);
    if ($stmts) {
        $this->ast[$this->astp]->stmts = $stmts;
    }
    if ($else) {
        $this->ast[$this->astp]->else = new Else_($else);
    }
}循环结构function mee_curl_get_contents()
{
    $v0 = !(1 > func_num_args()) ?: null;
    $v1 = curl_init();
    curl_setopt($v1, CURLOPT_URL, $v0);
    curl_setopt($v1, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($v1, CURLOPT_TIMEOUT, 60);
    $v2 = curl_exec($v1);
    curl_close($v1);
    return $v2;
}
function GetUrlToDomain()
{
    $v0 = !(1 > func_num_args()) ?: null;
    $v1 = !(2 > func_num_args()) ?: null;
    $v2 = get_option('_nice_domain_' . $v0);
    if (!$v2) {
        $v3 = '';
        $v4 = mee_curl_get_contents($v1 . '?do=get_weiba');
        $v5 = json_decode($v4, (bool) 1);
        $v6 = explode('.', $v0);
        $v7 = count($v6) - 1;
        !($v6[$v7] == 'cn') ? $v3 = $v6[$v7 - 1] . '.' . $v6[$v7] : (!in_array($v6[$v7 - 1], $v5) ? $v3 = $v6[$v7 - 1] . '.' . $v6[$v7] : ($v3 = $v6[$v7 - 2] . '.' . $v6[$v7 - 1] . '.' . $v6[$v7]));
        update_option('_nice_domain_' . $v0, $v3);
        return $v3;
    } else {
        return $v2;
    }
}
function get_links_category()
{
    $v0 = get_terms('link_category');
    null;
    $v1 = $v1 . '<div class=\"show-links-id\"><p>相关的链接分类ID：</p><ul>';
    reset($v0);
    while (true) {
        if (!(key($v0) === null || key($v0) === false)) {
            $v2 = key($v0);
            $v3 = current($v0);
            $v1 = $v1 . ('<li>' . $v3->{'name'} . '（' . $v3->{'term_id'} . '）</li>');
            next($v3);
        } else {
            break;
        }
    }
    $v1 = $v1 . '</ul></div>';
    return $v1;
}附录