<?php
// scanner.php - Accurate PHP Malware Scanner (Skips Itself)
set_time_limit(0);

$startDir = __DIR__;
$selfFile = basename(__FILE__);

$suspiciousFunctions = [
    'eval',
    'base64_decode',
    'gzinflate',
    'str_rot13',
    'gzuncompress',
    'shell_exec',
    'exec',
    'system',
    'passthru',
    'popen',
    'proc_open',
    'assert',
    'preg_replace',
    'create_function'
];

// These patterns are stricter, matching actual function calls (e.g. eval(, base64_decode( etc.)
$obfuscatedPatterns = [
    '\beval\s*\(',                   // matches "eval("
    '\bbase64_decode\s*\(',
    '\bgzinflate\s*\(',
    '\bgzuncompress\s*\(',
    '\bstr_rot13\s*\(',
    '\bshell_exec\s*\(',
    '\bexec\s*\(',
    '\bsystem\s*\(',
    '\bpassthru\s*\(',
    '\bpopen\s*\(',
    '\bproc_open\s*\(',
    '\bassert\s*\(',
    '\bcreate_function\s*\(',
    'preg_replace\s*\(.*\/e.*',     // deprecated /e modifier
    '\$[a-zA-Z0-9_]+\s*=\s*["\']\\x' // hex obfuscation
];

function scanFile($file)
{
    global $obfuscatedPatterns;
    $contents = @file_get_contents($file);
    $found = [];

    foreach ($obfuscatedPatterns as $pattern) {
        if (preg_match('/' . $pattern . '/i', $contents)) {
            $found[] = "Matched Pattern: " . $pattern;
        }
    }

    return $found;
}

function scanDirRecursive($dir, $selfFile)
{
    $rii = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($dir));
    $foundFiles = [];

    foreach ($rii as $file) {
        if ($file->isDir()) continue;

        $path = $file->getPathname();
        $filename = basename($path);

        if ($filename === $selfFile) continue;
        if (!preg_match('/\.php$/i', $filename)) continue;

        $results = scanFile($path);
        if (!empty($results)) {
            $foundFiles[$path] = $results;
        }
    }

    return $foundFiles;
}

// Run the scan
echo "<pre>";
echo "Scanning directory: $startDir\n";
echo "Skipping file: $selfFile\n";

$results = scanDirRecursive($startDir, $selfFile);

if (empty($results)) {
    echo "\n✅ No suspicious code found.\n";
} else {
    echo "\n⚠️ Suspicious code detected:\n";
    foreach ($results as $file => $flags) {
        echo "\nFile: $file\n";
        foreach ($flags as $flag) {
            echo "  -> $flag\n";
        }
    }
}
echo "</pre>";