Unpacking ionCube

Unpacking ionCube takes time and effort, but the author decided to pay for reverse engineering software once in their life after using Binary Ninja for the task. The program is a complex PHP encoder that takes source code and produces an obfuscated file containing several nested layers of encryption and decryption. To find the entry point, the author located the zend_extension_entry symbol and analyzed the zend_startup_module, MINIT, MSHUTDOWN, RINIT, RSHUTDOWN, and MINFO handlers.

The encoded file contains multiple nested blobs that need to be peeled one by one, with the payload being base64-encoded with a custom alphabet and transformed through various containers. The decryption key is produced by an exported function and used to seed a PRNG for decrypting the next layer. The payload includes a serialized opcode stream, a structural header containing metadata, and a custom deserialization pipeline that reconstructs PHP variables.

The loader also supports various key sources for different files, and the encryption/decryption process involves multiple generators and a custom PHP interpreter.