Using PHP Reflection API to Reverse Engineer Scripts

Welcome to TheCredence.com - You may like to subscribe to our RSS feed to stay updated.

Edit - As usual putting php code in the blog is giving me formatting problems so I am using "----" to separate the code from regular text

Reflection is term used in the world of programming to refer to a technology that lets you use your code as a data and actually do logic with it. In compiled languages like C++ or C#, it is a necessity to execute custom code. In dynamic languages like PHP it is usually possible to execute custom code without the help of any refection. For example,

--------------------------------
$func = “test”;
$func();
--------------------------------

As you can see, It is actually possible to store function names in variable and call that function with the variable. In compiled languages, this can’t be done and requires Reflection API. Now PHP has its own Reflection API that has the ability to grab all information about classes, functions and even fetch doc comments.

Reflection API Usage

Here is an example that exports a simple function.

--------------------------------
function test($x) {
echo $x;
}
Reflection::export(new ReflectionFunction('test'))
--------------------------------

The result of this will be,

--------------------------------
Function [ <user> <visibility error> function test ] {
@@ D:\Apache2\www\index.php 2 - 4

- Parameters [1] {
Parameter #0 [ <required> $x ]
}
}
--------------------------------

As you can see the output provides almost all the info about the function including where it resides, how parameters and whether they are required or not.
This is a simple example of reflection API can do. There are several classes that can be used to reverse engineer classes, function etc.

--------------------------------
class Reflection
interface Reflector
class ReflectionException extends Exception { }
class ReflectionFunction implements Reflector { }
class ReflectionParameter implements Reflector { }
class ReflectionMethod extends ReflectionFunction { }
class ReflectionClass implements Reflector { }
class ReflectionObject extends ReflectionClass { }
class ReflectionProperty implements Reflector { }
class ReflectionExtension implements Reflector { }
--------------------------------

To get info about a class we can call like this,

--------------------------------
$class = new ReflectionClass('SoapClient');
--------------------------------

There are many methods available for each refection types. Few of them referred below,

• __toString()
• export()
• getName()
• isInternal()
• isUserDefined()
• isInstantiable()

The complete list can be found at official php website.

It is possible to even invoke functions and classes on the fly. Such as,

• invoke(args)

And to create an object of a class, use this method

• newInstance(args)

For example, we will invoke the test function defined before,

--------------------------------
$func = new ReflectionFunction('test');
$func->invoke(“this is a test”);
--------------------------------
The most amazing is to create on the runtime,
--------------------------------
$class = new ReflectionClass('SoapClient');
$counter = $class->newInstance(“some WSDL”);
--------------------------------

The use of reflection may seem hard to find now. But what if, you wanted to implement a plug-in system that registers new plug-in classes or functions and executes it? The reflection will come really handy in that kind of situation. It can also be sued debug errors. There are many possibilities. We just have to learn how and when to do it.

Links you may find interesting -