php - How to use regular expressions to match gzinflate(base64_decode(
I'm writing the Yara rules. I tried using regular expression matching to remove the gzinflate(base64_decode(. But in PHP, function names can be concatenated with strings. Just like this
eval("\$x=gzin"."flate(base"."64_de"."code()));
There are various ways of stitching.
Except for trying to match "."
after every letter.
Is there a better solution?
Any help please.
Answer
Solution:
You could create an array, then implode it:
$array = ["\$x=gzin", "flate(base", "64_de", "code()"];
$str = implode($array);
Source