BiDe (Bitrix Deobfuscator)

Advanced PHP deobfuscation tool specifically designed for Bitrix and other obfuscated PHP code. BiDe automatically detects, analyzes, and deobfuscates malicious code while preserving legitimate functionality.

🚀 Features

• Automated Detection: Scans for common obfuscation patterns
• Smart Learning: Learns new obfuscation patterns from your codebase
• Custom Mappings: User-defined variable and function name mappings
• Safe Processing: Automatic backups and size limits
• Code Formatting: Clean, readable output with proper indentation
• Pattern Recognition: Discovers common coding patterns for better deobfuscation

📋 Requirements

• PHP 8.3 or higher
• Command-line access (CLI)
• Read/write permissions for target files

🛠 Installation

1. Clone the repository:

git clone https://github.com/SirAndrewGotham/BiDe.git
cd BiDe

2. Ensure all PHP files are in your working directory:

• BiDe.php
• deobfuscation_map.php
• custom_mappings.php

3. Run the deobfuscator:

php BiDe.php

🎯 Usage

Basic Usage

php BiDe.php

The tool will guide you through:

1. Processing Mode Selection: Scan for new files or use existing target list
2. File Discovery: Automatically detects obfuscated files
3. Deobfuscation: Processes files with configurable options
4. Output: Creates [filename]_deobfuscated.php files

Configuration

Edit custom_mappings.php to add your own variable mappings:

return [
    'mappings' => [
        '_malicious_var' => '$clean_name',
        '____obfuscated' => 'important_function',
        // ... your custom mappings
    ]
];

Advanced Options

Modify the DeobfuscationConfig in BiDe.php for:

• auto_confirm: Skip confirmation prompts
• enable_backup: Create backup files
• max_file_size_mb: Set file size limits
• learn_new_variables: Enable pattern learning
• remove_obfuscated_blocks: Clean up obfuscated code

📁 File Structure

BiDe/
├── BiDe.php                 # Main deobfuscator script
├── deobfuscation_map.php    # Automated mappings (generated)
├── custom_mappings.php      # User-defined mappings
├── deobfuscation_targets.txt # Target file list (generated)
├── README.md               # This file
├── LICENSE                 # MIT License
└── .gitignore             # Git ignore rules

🔧 How It Works

1. Pattern Detection: Uses multiple regex patterns to identify obfuscated code
2. Variable Extraction: Extracts and analyzes global arrays and functions
3. Code Execution: Safely executes obfuscated functions to reveal original code
4. Replacement: Replaces obfuscated names with clean, readable ones
5. Cleanup: Removes unnecessary obfuscation blocks
6. Formatting: Applies proper code formatting and indentation

⚠️ Important Notes

• PHP 8.3 Required: This tool uses modern PHP features requiring version 8.3 or higher
• Backup Your Files: The tool can modify your source files. Use backups!
• Test Thoroughly: Always test deobfuscated files in a safe environment
• Size Limits: Large files (>10MB) are skipped by default for safety
• Custom Mappings: Some obfuscation may require manual mapping additions

🐛 Troubleshooting

Common Issues

1. PHP Version Error

   # Check your PHP version
   php --version
   
   # Upgrade PHP if needed (Ubuntu/Debian example)
   sudo apt update && sudo apt install php8.3

2. "File not found" errors

   • Check file permissions
   • Verify file paths in deobfuscation_targets.txt

3. Memory exhaustion

   • Reduce max_file_size_mb in configuration
   • Process smaller files first

4. Incomplete deobfuscation

   • Add custom mappings for unrecognized patterns
   • Enable pattern learning for better detection

Getting Help

• Check the generated deobfuscation_targets.txt for processing logs
• Review the console output for specific error messages
• Examine backup files if original code was modified unexpectedly

🤝 Contributing

Contributions are welcome! Please feel free to submit pull requests or open issues for:

- New obfuscation pattern detection
- Performance improvements
- Additional features
- Bug fixes

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

🙏 Acknowledgments

- Built for the PHP security community
- Special thanks to contributors and testers
- Inspired by the need for better deobfuscation tools

Disclaimer

Disclaimer: Use this tool responsibly and only on code you have permission to modify. Always test deobfuscated files thoroughly before deployment.