执行时捕获php命令

Question

Are there any methods to catch the php commands instead of executing them? There's a backdoor which is encoded in my server, I was able to get declared classes and methods names, of the backdoor, but I need to find out the real code.

Answer 1

I can think of 2 things.

1. Use a profiler tool.

2. In your own code define a class with the same name. Then when the backdoor class is loaded, it will give a fatal error ('class name already defined') and tell you where the other class resides. Do enable stacktraces in case the backdoor is obfuscated/eval'd/remote included.