BinaryCheckModule.php

<?php

namespace CleantalkSP\SpbctWP\Scanner\BinaryCheckModule;

class BinaryCheckModule
{
    /**
     * @var int Total count of binary files for analysis
     */
    private $total_count = 0;

    /**
     * @var int Count of scanned files
     */
    private $scanned_count = 0;

    /**
     * @var array Statuses of scanned files
     */
    private $statuses = array();

    /**
     * Runs the BinaryCheckModule to find malicious binary files.
     * @return array Analysis results
     */
    public function run()
    {
        $this->total_count = 0;
        $this->scanned_count = 0;
        $this->statuses = array();

        $binary_files = $this->getBinaryFiles();
        $this->total_count = count($binary_files);
        $this->analyzeBinaryFiles($binary_files);

        return array(
            'success' => true,
            'end' => 1,
            'total_count' => $this->total_count,
            'scanned_count' => $this->scanned_count,
            'statuses' => $this->statuses,
        );
    }

    /**
     * @return array
     */
    public function getBinaryFiles()
    {
        global $wpdb;

        $binary_files = $wpdb->get_results(
            $wpdb->prepare(
                "SELECT * FROM " . SPBC_TBL_SCAN_FILES . " WHERE source = %s",
                'BINARY'
            )
        );

        return $binary_files ?: array();
    }

    /**
     * @param array $binary_files
     * @return void
     */
    private function analyzeBinaryFiles($binary_files)
    {
        foreach ($binary_files as $binary_file) {
            $path = realpath(ABSPATH . $binary_file->path);
            if (!$path || !file_exists($path)) {
                $this->incrementStatus('SKIPPED_NOT_FOUND');
                continue;
            }

            if (!is_readable($path)) {
                $this->incrementStatus('SKIPPED_NOT_READABLE');
                continue;
            }

            $isCritical = $this->analyzeBinaryFile($path);
            $this->scanned_count++;

            if ($isCritical) {
                $this->markAsCritical($binary_file->path);
                $this->incrementStatus('CRITICAL');
            } else {
                $this->incrementStatus('OK');
            }
        }
    }

    /**
     * @param string $status
     * @return void
     */
    private function incrementStatus($status)
    {
        if (!isset($this->statuses[$status])) {
            $this->statuses[$status] = 0;
        }
        $this->statuses[$status]++;
    }

    private function analyzeBinaryFile($binary_file_path)
    {
        // Read first bytes of the file (we need at least 4 bytes for all checks)
        $handle = fopen($binary_file_path, 'rb');
        if (!$handle) {
            return false;
        }

        // Read first 4 bytes
        $first_bytes = fread($handle, 4);
        fclose($handle);

        if (strlen($first_bytes) < 4) {
            return false;
        }

        // Method 1: Check using ord() to get byte values
        $byte1 = ord($first_bytes[0]);
        $byte2 = ord($first_bytes[1]);
        $byte3 = ord($first_bytes[2]);
        $byte4 = ord($first_bytes[3]);

        // Check for ELF (0x7F followed by "ELF" = 0x45 0x4C 0x46)
        if ($byte1 === 0x7F && $byte2 === 0x45 && $byte3 === 0x4C && $byte4 === 0x46) {
            return true; // ELF file detected
        }

        // Check for PE/MZ (Windows executable: 0x4D 0x5A = "MZ")
        if ($byte1 === 0x4D && $byte2 === 0x5A) {
            return true; // PE file detected
        }

        // Check for MACHO (macOS/iOS executables)
        // 32-bit big-endian: 0xFE 0xED 0xFA 0xCE
        // 32-bit little-endian: 0xCE 0xFA 0xED 0xFE
        // 64-bit big-endian: 0xFE 0xED 0xFA 0xCF
        // 64-bit little-endian: 0xCF 0xFA 0xED 0xFE
        $macho_signatures = array(
            array(0xFE, 0xED, 0xFA, 0xCE), // 32-bit big-endian
            array(0xCE, 0xFA, 0xED, 0xFE), // 32-bit little-endian
            array(0xFE, 0xED, 0xFA, 0xCF), // 64-bit big-endian
            array(0xCF, 0xFA, 0xED, 0xFE), // 64-bit little-endian
        );

        foreach ($macho_signatures as $signature) {
            if ($byte1 === $signature[0] && $byte2 === $signature[1] &&
                $byte3 === $signature[2] && $byte4 === $signature[3]) {
                return true; // MACHO file detected
            }
        }

        return false;
    }

    private function markAsCritical($binary_file_path)
    {
        global $wpdb;

        $wpdb->query(
            $wpdb->prepare(
                "UPDATE " . SPBC_TBL_SCAN_FILES . " SET status = 'INFECTED', severity = 'CRITICAL' WHERE path = %s",
                $binary_file_path
            )
        );
    }
}