Using this project, along with prvd, but renaming classes does not seem to work

[pentestusa]

Ok, so, I posted this issue earlier, and managed to fix it myself.

PHP loads modules in the /etc/php/7.2/apache/conf.d/ directory. It loads them AFTER the php.ini file is loaded. The mysqli/pdo/sqlite3 modules are loaded from the conf.d directory, which means if you have your [xmark] directives in your php.ini file, they will not be able to rename classes as they will not have been loaded yet.

My solution was to add a file to the /etc/php/7.2/apache/conf.d/ directory "30-xmark.ini" and add my xmark module configuration there. After doing that, the classes were successfully renamed and hooking worked successfully.

======= UNFIXED ISSUE TEXT ============

Hi, this is a great project, and it works fantastically for function hooking, however using it along with prvd I noticed that class renaming isn't taking place.

I'm looking at Utils.php, in prvd_load_file($pattern) and despite having my php.ini configured to rename SQLite3, mysqli, and PDO, the classes prvd_SQLite3, prvd_mysqli, and prvd_PDO do not exist, which suggests to me that xmark is not renaming them.

The output of my prvd log is as follows:

error: function/class prvd_mysqli does not exists
error: function/class prvd_pdo does not exists
error: function/class prvd_pg_prepare does not exists
error: function/class prvd_pg_query does not exists
error: function/class prvd_pg_query_params does not exists
error: function/class prvd_pg_send_prepare does not exists
error: function/class prvd_pg_send_query does not exists
error: function/class prvd_pg_send_query_params does not exists
error: function/class prvd_sqlite3 does not exists

Again, function hooking works perfectly, but class hooking seems to not be working. Any help with this is appreciated.

My php.ini is as follows:

extension=/path/to/my/local/php_xmark_hooking/xmark/modules/xmark.so
[xmark]
xmark.enable = 1
xmark.rename_enable = 1
xmark.enable_rename = 1
xmark.rename_classes = "
SQLite3:prvd_SQLite3,
mysqli:prvd_mysqli,
PDO:prvd_PDO
"
xmark.rename_functions = "
base64_decode:prvd_base64_decode,
basename:prvd_basename,
dirname:prvd_dirname,
explode:prvd_explode,
gzuncompress:prvd_gzuncompress,
hex2bin:prvd_hex2bin,
html_entity_decode:prvd_html_entity_decode,
htmlspecialchars_decode:prvd_htmlspecialchars_decode,
implode:prvd_implode,
join:prvd_join,
json_decode:prvd_json_decode,
ltrim:prvd_ltrim,
pathinfo:prvd_pathinfo,
rawurldecode:prvd_rawurldecode,
rawurlencode:prvd_rawurlencode,
rtrim:prvd_rtrim,
sprintf:prvd_sprintf,
str_ireplace:prvd_str_ireplace,
str_pad:prvd_str_pad,
str_replace:prvd_str_replace,
strstr:prvd_strstr,
strtolower:prvd_strtolower,
strtoupper:prvd_strtoupper,
substr:prvd_substr,
trim:prvd_trim,
urldecode:prvd_urldecode,
urlencode:prvd_urlencode,
vsprintf:prvd_vsprintf,
exec:prvd_exec,
passthru:prvd_passthru,
popen:prvd_popen,
proc_open:prvd_proc_open,
shell_exec:prvd_shell_exec,
system:prvd_system,
unserialize:prvd_unserialize,
copy:prvd_copy,
dir:prvd_dir,
file:prvd_file,
file_get_contents:prvd_file_get_contents,
file_put_contents:prvd_file_put_contents,
fopen:prvd_fopen,
glob:prvd_glob,
highlight_file:prvd_highlight_file,
link:prvd_link,
move_uploaded_file:prvd_move_uploaded_file,
opendir:prvd_opendir,
readfile:prvd_readfile,
rename:prvd_rename,
rmdir:prvd_rmdir,
scandir:prvd_scandir,
show_source:prvd_show_source,
unlink:prvd_unlink,
mysqli_init:prvd_mysqli_init,
mysqli_multi_query:prvd_mysqli_multi_query,
mysqli_query:prvd_mysqli_query,
mysqli_prepare:prvd_mysqli_prepare,
mysqli_real_query:prvd_mysqli_real_query,
pg_prepare:prvd_pg_prepare,
pg_query:prvd_pg_query,
pg_query_params:prvd_pg_query_params,
pg_send_prepare:prvd_pg_send_prepare,
pg_send_query:prvd_pg_send_query,
pg_send_query_params:prvd_pg_send_query_params,
curl_exec:prvd_curl_exec,
fsockopen:prvd_fsockopen,
get_headers:prvd_get_headers,
print_r:prvd_print_r,
printf:prvd_printf,
vprintf:prvd_vprintf
"