RevPHPNodeVisitor.php

<?php
class RevPHPNodeVisitor extends PhpParser\NodeVisitorAbstract
{
	var $symtbl;
	var $decode_func_names;
	var $decode_func_names2;
	var $special_func_names;
	var $replaced_func_names;
	var $replacement_func_names;
	var $pretty_printer;

	public function __construct(
		$extra_functions = null,
		$special_functions = null,
		$replacement_functions = null,
		$remove_comments = true,
		$replacement_function_names
	) {

		// Array of single-string-arg function names to apply to
		// string arguments to do a limited amount of decoding.
		$this->decode_func_names = array(
			'base64_decode', 'gzuncompress', 'strrev', 'gzinflate',
			'str_rot13', 'urldecode', 'chr', 'ord', 'strtolower',
			'strtoupper', 'base64_encode'
		);
		// Diadic functions to run and save return values of.
		$this->decode_func_names2 = array(
			'range'
		);
		foreach ($special_functions as $fname) {
			$this->decode_func_names[] = strtolower($fname);
		}

		// Function where knowing the value of string
		// argument(s) helps. Used to get obfuscated code to run.
		// Note that eval() is a "language construct".
		$this->special_func_names = array(
			'assert', 'preg_replace', 'eval', 'print',
			'file_put_contents', 'basename', 'function_exists',
			'mkdir', 'fopen', 'symlink', 'chdir', 'file', 'eregi',
			'chmod', 'die', 'strpos', 'curl_setopt', 'rmdir',
			'unlink', 'symlink', 'explode', 'file_exists',
			'filesize', 'ini_set', 'error_reporting', 'base64_decode'
		);
		// Superglobals - worth decoding the dimension.
		$this->superglobals = array(
			'_SERVER', '_REQUEST', '_GET', '_POST', '_COOKIE', 'GLOBALS'
		);

		foreach ($extra_functions as $fname)
			$this->special_func_names[] = strtolower($fname);

		$this->replaced_func_names = array('base64_decode');
		foreach ($replacement_functions  as $fname)
			$this->replaced_func_names[] = strtolower($fname);

		$this->replacement_func_names = array();
		if (is_array($replacement_function_names)) {
			foreach ($replacement_function_names as $key => $val) {
				$this->replacement_func_names[strtolower($key)] = $val;
			}
		}

		$this->symtbl = new SymbolTable();
		$this->pretty_printer = new PhpParser\PrettyPrinter\Standard;

		$this->remove_comments = $remove_comments;
	}

	public function afterTraverse(array $nodes) {
		$this->symtbl = null;
		$this->pretty_printer = null;
	}

	# Actually execute select functions if they have statically-
	# determined argument values.
	public function evaluateFunctionCall(PhpParser\Node\Expr\FuncCall $fcall, &$function_return) {
		#fwrite(STDERR, "enter evaluateFunctionCall, {$fcall->getType()}\n");
		$found_return = FALSE;
		if ($this->findValue($fcall->name, $fname)) {
			#fwrite(STDERR, "Found function name \"$fname\"\n");
			// single argument functions
			if (in_array(strtolower($fname), $this->decode_func_names)) {
				if ($this->findValue($fcall->args[0], $string_arg)) {
					# XXX - Is suppressing errors really a good idea?
					$function_return = @$fname($string_arg);
					if ($function_return !== null)
						$found_return = TRUE;
					else
						fwrite(STDERR, "Called function named \"$fname\", null return\n");
				}
			} else
			// two argument functions
			if (in_array(strtolower($fname), $this->decode_func_names2)) {
				if ($this->findValue($fcall->args[0], $arg0)) {
					if ($this->findValue($fcall->args[1], $arg1)) {
						$function_return = @$fname($arg0, $arg1);
						if ($function_return !== null)
							$found_return = TRUE;
					}
				}
			}
		}
		return $found_return;
	}

	// return TRUE if you can statically find the value of
	// $node (a few functions get evaluated, see evaluateFunctionCall(),
	// and arrays might get created. Return FALSE if you can't
	// statically find the value of a PhpParser\Node.
	public function findValue(PhpParser\Node $node, &$value) {
		#fwrite(STDERR, "Enter findValue() node type {$node->getType()} at source line {$node->getLine()}\n");

		$found_value = FALSE;

		if ($node instanceof PhpParser\Node\Scalar\String_) {
			$value = $node->value;
			$found_value = TRUE;
		} else
		if ($node instanceof PhpParser\Node\Expr\BinaryOp\Concat) {
			if ($this->concatStrings($node, $value)) {
				$found_value = TRUE;
			} else {
			}
		} else
		if ($node instanceof PhpParser\Node\Expr\Variable) {
			$variable_value = null;
			if ($node->name instanceof PhpParser\Node)
				$this->findValue($node->name,$name_string);
			else
				$name_string = $node->name;

			if ($this->symtbl->symbolValue($name_string, $variable_value)) {
				$value = $variable_value;
				$found_value = TRUE;
			}
		} else
		if ($node instanceof PhpParser\Node\Name) {
			$value = $node->parts[0];
			$found_value = TRUE;
		} else
		if ($node instanceof PhpParser\Node\Expr\FuncCall) {
			if ($this->evaluateFunctionCall($node, $value))
				$found_value = TRUE;
		} else
		if ($node instanceof PhpParser\Node\Arg) {
			$arg_string = null;
			if ($this->findValue($node->value,$arg_string)) {
				$value = $arg_string;
				$found_value = TRUE;
			}
		} else
		if ($node instanceof PhpParser\Node\Name) {
			# This doesn't seem right.
			$value = $node->parts[0];
			$found_value = TRUE;
		} else
		if ($node instanceof PhpParser\Node\Scalar\LNumber) {
			$value = intval($node->value);
			$found_value = TRUE;
		} else
		if ($node instanceof PhpParser\Node\Expr\ArrayDimFetch) {
			$array_name = null;
			if ($this->findName($node->var, $array_name)) {
				if ($array_name == 'GLOBALS') {
					if ($this->findValue($node->dim, $globals_name)) {
						if ($this->symtbl->globalSymbolValue($globals_name, $value))
							$found_value = TRUE;
					}
				} else {
					# The following is a hack around the way that $GLOBALS['varname']
					# has a value in the global symbol table, but I'm not passing the
					# "this variable is a global" back up from where the code finds 'varname'.
					# I can't think of what context this might misfire, however.
					if (!$this->symtbl->symbolValue($array_name, $the_array))
						$found_the_array = $this->symtbl->globalSymbolValue($array_name, $the_array);
					else
						$found_the_array = TRUE;

					if ($found_the_array) {
						# Check for indirection of array name: ${$contains_name}[$something]
						if (isset($node->var->name) && $node->var->name instanceof PhpParser\Node\Expr\Variable) {
							$array_name = $the_array;
							$this->symtbl->symbolValue($array_name, $the_array);
						}

						# $the_array should actually hold something of type array() at this point.
						if ($this->findValue($node->dim, $dimvalue)) {
							#echo "ArrayDimFetch, dimension value $dimvalue\n";
							if (isset($the_array[$dimvalue])) {
								$value = $the_array[$dimvalue];
								$found_value = TRUE;
							} else {
								fwrite(STDERR, "Problem accessing array \${$array_name}[".$dimvalue."] at line {$node->getLine()}\n");
							}
						}
					}
				}
			} else {
				fwrite(STDERR, "Could not find array name, so no value, line {$node->var->getLine()}\n");
			}
		}
		#fwrite(STDERR, "Exit findValue() node type {$node->getType()} at source line {$node->getLine()}\n");
		return $found_value;
	}

	// Find whatever string the Node evaluates to,
	// don't find the value of the string in the symbol table.
	public function findName(PhpParser\Node $node, &$varname) {
		#fwrite(STDERR, "enter findName, {$node->getType()}\n");
		$found_string = FALSE;
		if ($node instanceof PhpParser\Node\Expr\BinaryOp\Concat) {
			if ($this->concatStrings($node, $varname))
				$found_string = TRUE;
		} else
		if ($node instanceof PhpParser\Node\Scalar\String_) {
			$varname = $node->value; # XXX - ???
			$found_string = TRUE;
		} else
		if ($node instanceof PhpParser\Node\Expr\ArrayDimFetch) {
			if ($this->findName($node->var, $array_name)) {
				if ($array_name === 'GLOBALS') {
					# Then the variable name is the "dim" of the ArrayDimFetch, right?
					if ($this->findValue($node->dim, $globals_name)) {
						$varname = $globals_name;
						$found_string = TRUE;
						# XXX - for the lvalue of an assignment, how do we tell
						# the caller that this is a global variable?
					}
				} else {
					# Try to get the value of the array at the key.
					if ($this->symtbl->symbolValue($array_name, $the_array)) {
						if ($node->dim) {
							if ($this->findValue($node->dim, $dimvalue)) {
								$varname = $the_array[$dimvalue];
								$found_string = TRUE;
							}
						}
					}
				}
			}
		} else
		if ($node instanceof PhpParser\Node\Expr\Variable) {
			if ($node->name instanceof PhpParser\Node\Expr) {
				if ($this->findName($node->name, $varname)) {
					$found_string = TRUE;
				}
			} else
			if (is_string($node->name)) {
				$varname = $node->name;
				$found_string = TRUE;
			} else {
				fwrite(STDERR, "Problem in findName(), \$node of type {$node->getType()}, at source line {$node->getLine()}\n");
				debug_print_backtrace();
			}
		} else
		if ($node instanceof PhpParser\Node\Expr\List_) {
			if ($node->getSubNodeNames()[0] instanceof PhpParser\Node) {
				if ($this->findName($node->name, $varname)) {
					$found_string = TRUE;
				}
			}
		} else {
			if (isset($node->name) && is_string($node->name)) {
				$varname = $node->name;
				$found_string = TRUE;
			} else {
				# Something dreadfully wrong. This is pretty much the
				# very last thing it could be.
				fwrite(STDERR, "Problem in findName(), no name, line {$node->getLine()}: ".print_r($node, TRUE)."\n");
				debug_print_backtrace();
			}
		}
		#fwrite(STDERR, "leave findName, {$node->getType()}, name: \"$varname\"\n");
		return $found_string;
	}

	public function concatStrings(PhpParser\Node\Expr\BinaryOp\Concat $concat, &$concatenated) {
		$found_string = FALSE;
		if ($this->findValue($concat->left, $leftstring)
			&& $this->findValue($concat->right, $rightstring)) {
			$concatenated = $leftstring.$rightstring;
			$found_string = TRUE;
		} else {
			# Replace left or right nodes with statically-determinable values, if possible
			if ($this->findValue($concat->left, $leftvalue)) {
				if (is_string($leftvalue))
					$concat->left = $this->newNodeAsType($leftvalue, false);
			}
			if ($this->findValue($concat->right, $rightvalue)) {
				if (is_string($rightvalue))
					$concat->right = $this->newNodeAsType($rightvalue, false);
			}
		}
		return $found_string;
	}

	public function enterNode(PhpParser\Node $node) {
		if ($node instanceof PhpParser\Node\Stmt\Function_) {
			$this->symtbl->pushScope();

			foreach ($node->params as $formal_argument)
				$this->symtbl->addSymbol($formal_argument->name, NULL, FALSE);
		}
	}

	public function newNodeAsType($something, $as_name = FALSE) {
		$noder = null;
		if (is_string($something)) {
			$noder = $as_name? new PhpParser\Node\Expr\Variable($something)
				:new PhpParser\Node\Scalar\String_($something);
		} else
		if (is_int($something)) {
			$noder = new PhpParser\Node\Scalar\LNumber($something);
		} else
		if (is_float($something)) {
			$noder = new PhpParser\Node\Scalar\DNumber($something);
		} else
		if (is_array($something)) {
			$array_as_string = 'array(';
			$comma = '';
			$element_count = 0;
			
			foreach ($something as $val) {
				$array_as_string .= $comma.$val;
				$comma = ', ';
				++$element_count;
				if ($element_count > 10) break;
			}

			if (count($something) > 10)
				$array_as_string .= '...';

			$array_as_string .= ')';
			$noder = new PhpParser\Node\Scalar\String_($array_as_string);
		} else
		if (is_bool($something)) {
			$noder = new PhpParser\Node\Expr\ConstFetch(
				new PhpParser\Node\Name($something?'true':'false')
			);
		} else { # Punt.  Treat it as a string.
			$noder = new PhpParser\Node\Scalar\String_($something);
		}
		return $noder;
	}

	// Find an lvalue and an rvalue, match them in $this->symtbl.
    public function performAssignment(PhpParser\Node\Expr\Assign $node) {
		$namestring = null;

		// Put the rvalue into the parse tree.
		if ($this->findValue($node->expr, $valuestring)) {
			$node->expr = $this->newNodeAsType($valuestring);
		}

		if ($node->var instanceof PhpParser\Node\Expr\ArrayDimFetch) {
			// A little redundant, but the code to do $GLOBALS[] is
			// in place elsewhere.
			if ($this->findName($node->var->var, $arrayname)) {
				if ($arrayname != 'GLOBALS') {
					$this->performArrayAssignment($node);
					return;
				}
			}
		}

		if ($this->findName($node->var, $namestring)) {
			$valuestring = null;

			if ($node->expr instanceof PhpParser\Node\Expr\Array_) {
				// Only a separate case because I can't figure out how to
				// set up a call to array() with all the different arguments.
				$array_node = $node->expr;
				foreach ($array_node->items as $idx => $item) {
					if ($this->findValue($item->value, $item_value))
						$array_node->items[$idx] = $this->newNodeAsType($item_value);
				}
				$array_as_string = $this->pretty_printer->prettyPrint(array($node->expr));
				eval('$array_val = '.$array_as_string.';'); # XXX - this seems sloppy.
				$this->symtbl->addSymbol($namestring, $array_val);

			} else
			if ($node->expr instanceof PhpParser\Node\Expr\Closure) {
				#fwrite(STDERR, "Assigning a Closure to a variable\n");
				# Just note that $namestring denotes a symbol, not a value.
				$this->symtbl->addSymbol($namestring, 'Anonymous Function Closure');
			} else
			if ($this->findValue($node->expr, $valuestring)) {
				$node->expr = $this->newNodeAsType($valuestring);
				# Need to add name of variable and value into
				# the symbol table.
				$this->symtbl->addSymbol($namestring, $valuestring);
			}
			else {
				# Just note that $namestring denotes a symbol, not a value.
				$this->symtbl->addSymbol($namestring, null, FALSE);
			}
		} else {
			if ($node->expr instanceof PhpParser\Node\Expr\Array_) {
				$array_node = $node->expr;
				foreach ($array_node->items as $idx => $item) {
					if ($this->findValue($item->value, $item_value))
						$array_node->items[$idx] = $this->newNodeAsType($item_value);
				}
			}
		}
	}

	# Special case: something like $a[$x] = $something; or
	# $x[] = (some expression);
	# Apparently the boolean return isn't too useful.
    public function performArrayAssignment(PhpParser\Node\Expr\Assign $node) {
		$array_assigned = FALSE;
		// lvalue:
		// Find array name.
		if ($this->findName($node->var->var, $arrayname)) {
			// Find array itself in symtbl.
			if ($this->symtbl->symbolValue($arrayname, $array)) {
				// find rvalue.
				if ($this->findValue($node->expr, $rvalue)) {
					// Find dimension.
					if (!isset($node->var->dim)) {
						// If dimesion is null, this is an array push in disgues,
						array_push($array, $rvalue);
						$array_assigned = TRUE;
					} else {
						if ($this->findValue($node->var->dim, $dimvalue)) {
							// otherwise insert rvalue into array with dimension as key.
							$array[$dimvalue] = $rvalue;
							$array_assigned = TRUE;
						}
					}
					$node->expr = $this->newNodeAsType($rvalue);
				}
			}
		}
		if ($array_assigned) {
			$this->symtbl->updateValue($arrayname, $array);
		}
		return $array_assigned;
	}

	// Replace obfuscated/unclear function names at the call site
	// with user-specified function names
	public function replaceFunctionCallNames(PhpParser\Node\Expr\FuncCall $node) {
		if ($this->findValue($node->name, $lookup)) {
			$lookup = strtolower($lookup);
			if (array_key_exists($lookup, $this->replacement_func_names)) {
				$node->name = new PhpParser\Node\Name($this->replacement_func_names[$lookup]);
			}
		}
	}

	// Put in statically-determined strings for the arguments
	// of select functions: preg_replace(), eval(), assert().
	public function replaceArguments(PhpParser\Node\Expr\FuncCall $node) {
		if ($this->findValue($node->name, $function_name)) {
			if (in_array(strtolower($function_name), $this->special_func_names)) {
				foreach ($node->args as $idx => $arg) {
					if ($this->findValue($arg->value, $valuestring)) {
						$node->args[$idx]->value = $this->newNodeAsType($valuestring);
					}
				}
			}
		} else {
			fwrite(STDERR, "Could not find function name to see if arguments get replaced, line {$node->name->getLine()}.\n");
		}
	}

	// Replace all arguments if they are FuncCalls with particular names
	public function replaceSelectArguments(PhpParser\Node\Expr\FuncCall $node) {
		if (count($node->args) < 1) return;
		foreach ($node->args as $idx => $arg) {
			if ($arg->value instanceof PhpParser\Node\Expr\FuncCall) {
				$fc = $arg->value;
				if ($this->findValue($fc->name, $function_name)) {
					if (in_array(strtolower($function_name), $this->replaced_func_names)) {
						if ($this->evaluateFunctionCall($fc, $valuestring)) {
							$node->args[$idx]->value = $this->newNodeAsType($valuestring);
						}
					}
				}
			}
		}
	}

	# Replace an indirected function call ($func($args), for example) with
	# the actual statically-determinable function name. Oddly, language
	# constructs like "eval" can be indirected exactly as functions.
	public function fixIndirectFuncName(PhpParser\Node\Expr\FuncCall $node) {
		#fwrite(STDERR, "Enter fixIndirectFuncName() node type {$node->getType()} at source line {$node->getLine()}\n");

		$found_function_name = FALSE;

		if ($node->name instanceof PhpParser\Node\Name) {
			#fwrite(STDERR, "Exit fixIndirectFuncName() node type {$node->getType()} at source line {$node->getLine()}\n");
			return FALSE;  // This is a common, directly-named function call.
		} else
		if ($node->name instanceof PhpParser\Node\Expr\ArrayDimFetch) {
			if ($this->findValue($node->name, $function_name)) {
				$found_function_name = TRUE;
			}
		} else
		if ($node->name instanceof PhpParser\Node\Expr\FuncCall) {
			if ($this->findValue($node->name, $function_name)) {
				$found_function_name = TRUE;
			}
		} else
		if ($node->name instanceof PhpParser\Node\Expr\Variable) {
			if ($this->findValue($node->name, $function_name)) {
				$found_function_name = TRUE;
			}
		}

		if ($found_function_name) {
			$comment = array(
				new PhpParser\Comment(
					"# Replaced function indirection with static value \"$function_name\"",
				 	$node->name->getLine()
				)
			);
			$attributes = array(
				'startLine' => $node->name->getAttribute('startLine'),
				'endLine' => $node->name->getAttribute('endLine')
			);
			$node->name = new PhpParser\Node\Name($function_name,
				$attributes); # Value of $attributes is required.
			$node->setAttribute('comments', $comment);
		}
		#fwrite(STDERR, "Exit fixIndirectFuncName() node type {$node->getType()} at source line {$node->getLine()}\n");
	}

	// Substitute user-specified function name for the real function name
	// at the function declaration site.
	public function substituteFunctionName(PhpParser\Node\Stmt\Function_ $node) {
		if (isset($node->name)) {
			$lookup = strtolower($node->name);
			if (array_key_exists($lookup, $this->replacement_func_names)) {
				$node->name = $this->replacement_func_names[$lookup];
			}
		}
	}

    public function leaveNode(PhpParser\Node $node) {

		if ($this->remove_comments) {
			# Remove all comments - they're mostly deliberately misleading anyway.
			if ($node->hasAttribute('comments')) {
				$node->setAttribute('comments', array());
			}
		}

        if ($node instanceof PhpParser\Node\Expr\Assign) {
    		$this->performAssignment($node);
		} else
        if ($node instanceof PhpParser\Node\Expr\FuncCall) {
			# Here's where we replace indirect function calls
			# of the form $variable($a1, $a2..) with the value of
			# $variable, if we can.
			$this->fixIndirectFuncName($node);

			# Replace any decodeable arguments of select functions
			# with the statically-determinate, decoded values.
			# Happens more often than fixing an indirect function call.
			$this->replaceArguments($node);

			if (count($this->replaced_func_names) > 0)
				$this->replaceSelectArguments($node);

			// Replace select function names with user-defined
			// names.
			if (count($this->replacement_func_names) > 0)
				$this->replaceFunctionCallNames($node);

		} else
        if ($node instanceof PhpParser\Node\Expr\ArrayDimFetch) {
			#fwrite(STDERR, "Standalone manipulation of ArrayDimFetch\n");
			# Fix up $GLOBALS[] references
			if ($this->findName($node->var, $array_name)) {
				if ($array_name == 'GLOBALS') {
					if ($this->symtbl->globalSymbolValue($array_name, $real_name)) {
						# Replace $GLOBALS['something'] with value of $something
						if ($this->findValue($real_name, $real_value)) {
							$node->var = $this->newNodeAsType($real_value, TRUE);
						}
					}
				} 

				if (in_array($array_name, $this->superglobals)) {
					# See if we can't put a static value on the *dimension*
					# of $_REQUEST, $_SERVER, etc.
					if ($this->findValue($node->dim, $dim_value)) {
						$node->dim = $this->newNodeAsType($dim_value);
					}
				}
			}
		} else
		# Handle a few "language constructs" - these end up in subclasses
		# of PhpParser\Node, and have enough pecularities to deal with
		# on a case-by-case basis.
		if ($node instanceof PhpParser\Node\Expr\Eval_) {
			# Put in statically-determined strings for the argument
			# of any eval() constructs.
			if ($this->findValue($node->expr, $eval_body)) {
				# XXX - this should actually look through the code that
				# makes up the eval's body, and substitute it for $node.
				$node->expr = new PhpParser\Node\Scalar\String_($eval_body);
			}
		} else
		if ($node instanceof PhpParser\Node\Stmt\Global_) {
			foreach ($node->vars as $variable) {
				$value = null;
				if ($this->symtbl->globalSymbolValue($variable->name, $value))
					$this->symtbl->addSymbol($variable->name, $value);
			}
		} else
		if ($node instanceof PhpParser\Node\Stmt\Echo_) {
			foreach ($node->exprs as $idx => $subnode) {
				$subnode_as_string = null;
				if ($this->findValue($subnode, $subnode_as_string)) {
					$as_name = $this->symtbl->isSymbol($subnode_as_string);
					$node->exprs[$idx] = $this->newNodeAsType($subnode_as_string, $as_name);
				}
			}
		} else
		if ($node instanceof PhpParser\Node\Expr\Print_) {
			if ($this->findValue($node->expr, $subnode_as_string)) {
				$as_name = $this->symtbl->isSymbol($subnode_as_string);
				$node->expr = $this->newNodeAsType($subnode_as_string, $as_name);
			} else
			if ($this->findName($node->expr, $subnode_as_string)) {
				$as_name = $this->symtbl->isSymbol($subnode_as_string);
				$node->expr = $this->newNodeAsType($subnode_as_string, $as_name);
			}
		} else
        if ($node instanceof PhpParser\Node\Expr\AssignOp\Concat) {
			if ($this->findName($node->var, $var_name)) {
				if ($this->findValue($node->expr, $exprvalue)) {
					if ($this->findValue($node->var, $varvalue)) {
						$concatenated_string = $varvalue . $exprvalue;
						$this->symtbl->addSymbol($var_name, $concatenated_string);
					}
					// Substitute RHS of ".=" into parse tree for better readability.
					$node->expr = $this->newNodeAsType($exprvalue);
				}
			}
		} else
		if ($node instanceof PhpParser\Node\Expr\BinaryOp\Equal
			|| $node instanceof PhpParser\Node\Expr\BinaryOp\NotEqual
		) {
			if ($this->findValue($node->left, $leftvalue)) {
				if (is_string($leftvalue))
					$node->left = $this->newNodeAsType($leftvalue, false);
			}
			if ($this->findValue($node->right, $rightvalue)) {
				if (is_string($rightvalue))
					$node->right = $this->newNodeAsType($rightvalue, false);
			}
		} else
		if ($node instanceof PhpParser\Node\Expr\BinaryOp\Concat) {
			# Roll up any substrings. This can be computationally inefficient.
			if ($this->findValue($node->left, $leftvalue)) {
				if (is_string($leftvalue))
					$node->left = $this->newNodeAsType($leftvalue, false);
			}
			if ($this->findValue($node->right, $rightvalue)) {
				if (is_string($rightvalue)) {
					if ($node->left instanceof PhpParser\Node\Expr\BinaryOp\Concat) {
						if ($this->findValue($node->left->right, $othervalue)) {
							if (is_string($othervalue)) {
								$node->right = $this->newNodeAsType($othervalue.$rightvalue);
								$node->left  = $node->left->left;
							}
						}
					} else {
						$node->right = $this->newNodeAsType($rightvalue, false);
					}
				}
			}
		} else
		if ($node instanceof PhpParser\Node\Stmt\Function_) {
			$this->substituteFunctionName($node);
			$this->symtbl->popScope();
		}
    }
}

class FuncPHPNodeVisitor extends PhpParser\NodeVisitorAbstract
{
	public $function_names;
	public function __construct() {
		$this->function_names = Array();
	}

	public function enterNode(PhpParser\Node $node) {
		if ($node instanceof PhpParser\Node\Stmt\Function_) {
			$this->function_names[] = $node->name;
		}
	}
}