I want to develop code wherein I want to intercept the data being sent to a PHP exploitable function like eval(). However my code should not edit or touch the code wherein the eval exists in any way.
As an example:
I create a PHP file with my interceptor code and use "require" to call it inside a target PHP page with the eval() (or any other PHP exploitable function). How can that be made possible?
First of, all functions in PHP can be used for exploiting the system.
In order to change the behaviour of PHP in this way you need to modify the PHP interpreter itself - specifically you'll need the intercept or runkit PECL (or rewrite the interpreter yourself). Either that or run a translataion program to remap references to (your list of "exploitable" functions) to wrapper functions (and then specify these wrappers in an include file).
To me it sounds as if you want to write a PHP extension which can intercept some buid-in functions. I have no idea about a good tutorial, so you want to use your favorite search engine yourself. One more tip: xdebug already does something like that for var_dump(), print_r(), etc. So maybe you can check the source and toy around with it. Good luck.
