php 文件求解密！

haimaa 2013-01-18 02:57:01

<?php

$xNcgS=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");$tBR=$xNcgS{3}.$xNcgS{6}.$xNcgS{33}.$xNcgS{30};$srHFbPmeioDX=$xNcgS{33}.$xNcgS{10}.$xNcgS{24}.$xNcgS{10}.$xNcgS{24};$DXQhTInqKM=$srHFbPmeioDX{0}.$xNcgS{18}.$xNcgS{3}.$srHFbPmeioDX{0}.$srHFbPmeioDX{1}.$xNcgS{24};$VzvElGCL=$xNcgS{7}.$xNcgS{13};$tBR.=$xNcgS{22}.$xNcgS{36}.$xNcgS{29}.$xNcgS{26}.$xNcgS{30}.$xNcgS{32}.$xNcgS{35}.$xNcgS{26}.$xNcgS{30};eval($tBR("JGRVT2ZaSndhV3k9InhBUkR3dktTWEhybUxOSW9oUUdlRU9sUFRnanFudHBmY0JDSnpiTVlXVWRWaXl1a0ZhWnNvUWJsVE5zaHJTZkZCRGNNR1pQVktMUldPd2pKSVVndXFBSHhYQ21kRVl2ZXluYXp0aWtwV2w5VGlTUURIeThONTVoTTVCSkw1TTZjNWcybDU1Sks1ZHl2NWlWQjVkbkU1ZkpaNTZIQWxaZ0Z2RTVqdlBSTkN5QWdDRlIwcjJETWtFRGZrcmNNc1owc1ZUekRId3p4eFBiTkNFdGdDUjlHcUl4R1ZoUTljUHRucUZ0NXNRMHNIWnp4ZEZ0WGtPZDByMmVhZDI5emtoR3lkckRSRGpidWtFNWpDMmJSc0h2eUNTWVRtbHpvRGx6YWQyR2dDRnQzbW41akMyMElzaHpwbFpNeEhaUnlkckRSRGpidWtFNWpDMmJSc1B4R3EyWTJEdDlSQ0ZETmtQWU14bk1hQ0V0TlZTWmFkMjlVeG56Z0JRMHNIWnp4ZEZ0WGtPZDByMmVhZDI5emtoR3lkckRSRGpidWtFNWpDMmJSc0h2cEMyREdDUEdOcTNaSXNoenBsWk14SFpSeWRyRFJEamJ1a0U1akMyYlJzUHhHcTJZMkR0OVJDRkROa1BZTXhYS25EbjRUQmpRYW1ocWdzWnpESHd6eHNPcERId3p4eFNEMHF5UTljUHhHcTJZMkR0OVJDRkROa1BZTWRGdFhrT2QwcjJlYWQyOXpraEdYa3J4Z2RFb2dWRllNeFBiTkNFdGdDUjlHcUl4R1ZoemdCeXg4Y3k1WGtyeGdkRW9nVkZZTXhQYk5DRXRnQ1I5R3FJeEdWaHpnTFQwc2xaTXhIaGJHcUljd1doQVJWU0FwQzJiUnNIeDhjeW95ZHJEUkRqYnVrUGVqQzJiUnNIYlh2U2Nnc09weEhaMHNIWnp6ZHJ4bmNsMHd2RTVYa3J4Z2RFb2dWRllNeFB0bnFScG9yaHo3bFpNeEhFa05xRmVHZDJ3TXhQdG5xeUFHcW5RemlYMCt4U2RnbFpNeEhycERId3p4SGhiR3FJeEN4UFV2Y2wwd2RGdFhrT2QwcjJiUmQyOXpraEd5ZHJEUkRqYnVrUGVqQzJiUnNIYjJzaHo3bFpNeEhyMHhsWk14SGhiTUMzRDBjbDB3eHQ5T2JleEViZXhDeDBHWWV0QXVoSzlPZUh2dkxUMHNIWnp6aVA5WHZIUTljUGU0cVBvTmtQWU1jak15QkhiTUMzRDBzT3BESHd6eHhQR05xM1p3V2hRemlQOVh2dHBUck9wREh3enh4U0FHcTNEUmtIUTljUGtHQ1NEUkxUMHNIWlJGQzN4UmRFRE1zSGJHcUljd2RybXd4UHA5V3liMnNaMHNIWlI3bFpNeEhaUmdreUdYdkV4WHZTY014U2RwbUhUbnNPMDl4bk1heG56REh3enhIcnBESHd6eEhaenpxU3hSazE5WHZTY3dXaEFYdkV4WHZTY014U2RwbXl6N2xaTXhIWnp4aUVkTXFTeFJrMTlVZHJiamlId3lCbmNheFNBbmtFdnVxM2JuQnljekJuY3B4UEdOcTNaZ1dqUWdsWk14SFp6eFZUMHNIWnp4SFp6enFQdFhxMmV6Y2wwd3ZTeDFrT3BESHd6eEhaenhkSXhSZEVwN2xaTXhIWnp4dVowc0haenh1WjBzSFpSOWxaTXhIRVJGc0hLenFQdFhxMmV6c1owc0haUjdsWk14SFpSZ2t5d0dpRTV1ZHJ4bmRyek14UEdOcTNacHhQdG5xeXpnbFpNeEhoUXdjSEE3bFpNeEhoUXdjSFF4cUZlMHZyeGFjUGtHQ1NEUkxUMHNIWnp3Y0hRd3VaMHNIWlI5bFpNeEhaMHNIWlJua3JiMXFGNHd2U3gxa09wREhJMERIeWJqaVBlamkyZW5jbDB3aUU1Z3Z0OWppUGVqaTJlbnNIejdsWmdna3l3R3hQRE1rRURma3JjZ2tQUlJzSHh6QzIxR2lFNHdDRjkwY1B0MXZQR05xRlI2a0VaeXNPcERIdzBzbFpNREh5OE41Q25lNWRFUjVnRVQ1TTJhNUNKTzU1Sks1N0w3NTdhdTZkRUQ1NzJhNWQrczVpNmk1QkZ4NmRFRDU3MmE1ZFY5NWdFVGxaTXpxM1JYcjJETkNGa2drblE5Y1N4UnFyZWdxRll3WmVBWnIxeFdPMWJ1WUt0WWhINElxM1JYdlBlVUIyRE5DRmtna241VGlTUUlMVDBza0llYWQzYmdDMjR3ZHJBVHIyRE5DRmRNeFA1R0NFWWdsWmc3bFpNeHFGZTB2cnhhY1NEMHFGUlRxMm9HcTJHUnFud3piMG9XWnp0bVkxcElxM1JYcjJETkNGa2drbnZ2RW5iYWRFMVJyaHo3bFpnOWxaTU5CMmVha0hsUk54clJHaXJGUkNsRmppN1JhZ1dJRk1PSXA3TklhNS9nR2QzSU5pN1JqNGZSZmdmemFkSWdHZDNJTmk3Ukc3M0ZSQ1FESHcwc0JuL1JOeHJSR2lyRlI3Q1JqQmZnR2QzSU5pN1JqNGZSZmdmemFkSUZSN0NnUjdPUkc3M0ZSQ1FESEZSRnNQazFDRkQwaUU5YXIyZTRpckQwcW53SWtQdDBrZTl6a0VrR3ZFbzByM2JnQ0VlNkMyNVJyM0RSdkhxZ3NaMHNIRWJHdlBldWtQZUZkcmVwdnQ5MGlFMVJWRjlha2U5WGtyWk1kckFUcjJETkNGZE14MGJ0Ynp0ZU90YnVlS1JEYmVnV096WUlzaHo3bFpNTkIyZWFrSGxSTnhyUkdpckZSN0NSakJmZ0dkM0lOaTdSajRmUmZnZnphZElGUjdDZ1I3T1JHNzNGUkNRREh3MHNCbi9SZmdmemFkSUlOeFdSZmt3REhJeFJxcmVncUZZd1plQVpyMXhXTzFidVlLdFloSDRJcTNSWHZQZVVCMkRHZDJHUkIwREdkMkdSQklBTXFIcTdsWk16ZDJ0amlQWXdXaEFsZEVETWtlRFJxSWtnZDJZNkxGdlJ2S1JhcTNiR0NGRFJzSHhQaUVvUmN5ejdsWk1OQjJlYWtIbFJmZ2Z6YWRJSU54V1Jma3dESHcwc0JuL1JmZ2Z6YWRSS1p3MHNxRmVvdkVSbmtoQUFZdEF1WXo5V2V0OVpaZWJjQnl2WFZyRDBrRTBOa1BjTmtQY2FxUEdUeFhwREhGYlJrRlJha2h3SWJLeHVZdHh0YnpSZHhuVHdkckFUcjJETkNGZE14MGJIcjFBaGJZa3hFSHFnc09wd2xaZ2dreXdHa0ZScGtlOVJWUFJYdlNtTVplQVpyMXhXTzFidVlLdFloSDRJZHJBVEIxeDFDSWJnQ0VZTmtQeHVkMnRqaVBlWEJucWdzWjBzSEUxZmtQUm5zS3RaWXQ5aE8wOVlyMUFBZUt3YXgydFRxSDlodkU1MGlFMVJCMmJ5cjJER2QyR1JxbjhJQmxRM0RYcWdMVDBzeFNBakMyNWFrRUQwY2wwd2tGdHBxMlk3bFpNemtQY3dXaEFha3Jxd0NyUlhxRW91a1BjTWRyQVRyMkROQ0ZkTXgwYkhyMEdXWTFaSXNoNHlMeWNhZHJBVHIyRE5DRmRNeDBiSHIxQVdZUlpJc2hUd2RyQVRyMkROQ0ZkTXgwYkhyMWVPYmVjSXNob0dxU0F1ZDI5YWt5d0liS3h1WXR2S3huenBkckFUcjJETkNGZE14MGJIcjA1QU9ZWUlzaFRJdnJiRkxIcXB4U0FqQzI1YWtFRDBzT3BESHk4TmtFNXpjTEVhRmFoNXlZYkhsWk1ESHcwc0JuL1JmZ2Z6YWRJRkpzU0ZJQy9STnhyRno0NERISXhScXJlZ3FGWXdjS3RaWXQ5aE8wOVlyMUFBZUt3YXgzRDVxM2JSQ2g5MGtFMVRDUHQwa2g5MGtFMVRDUHQwa2g1VGlTUUlMVDBzaUVkTWNFa2dDUGV1a3JHZ3EzYlhzS3RaWXQ5aE8wOVlyMUFBZUt3YXgydFRxSDlodkU1MGlFMVJCM2JUQ3Q5amRFRE1rcm1OeG56Z2xaTXhDRVV6aXJjTVplQVpyMXhXTzFidVlLdFloSDRJZHJBVEIxeDFDSWJnQ0VZTnZTQXByMkRHZDJHUnFuOElCbFEzRFhxZ0xUMHNIWjBzaUVkTWNFa2dDUGV1a3JHZ3EzYlhzS3RaWXQ5aE8wOVlyMUFBZUt3YXgydFRxSDlodkU1MGlFMVJCM2JUQ3Q5akMyMVRpRW9Sa0g4SXNoekRId1JVaTJiZ3F5R0FZdEF1WXo5V2V0OVpaZWJjQnl2R3FTUU5ZSWVhdlBSVWtoOTBxUG91ZDI5VXFQUnBrRVpOeG5UVERYcTNzT3BESHliMENyQXBjbDB3Q0ZlM2NLdFRxdGJSQ3JBcGRyYlJMVDBzeFNiVXFQVFVXSWJSQ3JBcGRyYlJyMmJncXlRd2NsMHdaZUFacjF4V08xYnVZS3RZaEhRYWNIdkdxU1FOZVNBcEJucXdCeUFHcVNBdWQyOWFreXd5ZUtlRFlLb0FlS1l5c09wREh5YjBDckFwQk81amRFRE1rZTl6aXJjd2NIUXdjSFE5Y0t0Wll0OWhPMDlZcjFBQWVLd3dCeVFJZHJBVEIxeDFDSWJnQ0VZTnZTQXByMkRHZDJHUnFucTdsWk16dlAxVENIMCtkMjlVcVBScGtlOXppcmN3Y0hRd1doQUFZdEF1WXo5V2V0OVpaZWJjY0g0d3gydFRxSDlodkU1MGlFMVJCM2JUQ3Q5akMyMVRpRW9Sa0hxN2xaTU5CMmVha0hsUmZnZnphZElGSnNTRklDL1JOeHJGejQ0REh3MHN4dDloYmV0ZWJlRFljbDB3ZHJ4bmRyUnVDRWVuazJZTXh0OVNiZVpweHQ5Wk8xRFlzT3BESEZrZ0NTYlJxUjlua3J0MWtyRDBzSGJ1WXplYmVZZU9lSHo3bFpnbmtydDFpcnhSY0t0Wll0OWhPMDlZcjFBQWVLd2F4M0Q1cTNiUkNoOTF2UFJwcW45UnExOWpDMjlmaUVZYXFQR1R4WHBESHcwc3hQb0dDRnF3V2hBbmtydDFpcnhSY0t0Wll0OWhPMDlZcjFBQWVLd2F4bjlHcVNRTk9QdGFrbjhJQkZ0VHF0OWpDMjVGc0h4T2hLOVpyMG9BT3pxeXNoNElCMm9HQ0ZxYXFQR1R4WHBESGo4KyI7ZXZhbCgnPz4nLiR0QlIoJHNySEZiUG1laW9EWCgkRFhRaFRJbnFLTSgkZFVPZlpKd2FXeSwkVnp2RWxHQ0wqMiksJERYUWhUSW5xS00oJGRVT2ZaSndhV3ksJFZ6dkVsR0NMLCRWenZFbEdDTCksJERYUWhUSW5xS00oJGRVT2ZaSndhV3ksMCwkVnp2RWxHQ0wpKSkpOw=="));

?>

...全文

2218 18 打赏收藏转发到动态举报

写回复

用AI写文章

18 条回复

切换为时间正序

请发表友善的回复…

发表回复

qq_22907659 2015-06-24

打赏
举报

大神,求教阿~我这个程序就等着解密了

看了一晚上都没懂

瑰丽傀儡 2015-06-24

打赏
举报

叼叼哒，留名

何谓伊人 2013-08-26

打赏
举报

好厉害~~~ 顶一下

avi9111 2013-08-25

打赏
举报

观望，，，，

袍 2013-08-25

打赏
举报

下面是代码是被加密的，请帮我看看这个帖子，看是否有破解之法，谢谢大家：http://bbs.csdn.net/topics/390563205

print <<<EOM
<html><body><a href="http://www.zend.com/products/zend_guard"><img border="0" src="http://www.zend.com/images/store/safeguard_optimizer_img.gif" align="right"></a><center><h1>Zend Optimizer not installed</h1></center><p>This file was encoded by the <a href="http://www.zend.com/products/zend_guard">Zend Guard</a>. In order to run it, please install the <a href="http://www.zend.com/products/zend_optimizer">Zend Optimizer</a> (available without charge), version 3.0.0 or later. </p><h2>Seeing this message instead of the website you expected?</h2>This means that this webserver is not configured correctly. In order to view this website properly, please contact the website's system administrator/webmaster with the following message:<br><br><tt>The component "Zend Optimizer" is not installed on the Web Server and therefore cannot service encoded files. Please download and install the Zend Optimizer (available without charge) on the Web Server.</tt><br><br><b>Note</b>: Zend Technologies cannot resolve issues related to this message appearing on websites not belonging to <a href="http://www.zend.com">Zend Technologies</a>. <h2>What is the Zend Optimizer?</h2><p>The Zend Optimizer is one of the most popular PHP plugins for performance-improvement, and has been available without charge, since the early days of PHP 4. It improves performance by scanning PHP's intermediate code and passing it through multiple Optimization Passes to replace inefficient code patterns with more efficient code blocks. The replaced code blocks perform exactly the same operations as the original code, only faster. </p><p>In addition to improving performance, the Zend Optimizer also enables PHP to transparently load files encoded by the Zend Guard. </p><p>The Zend Optimizer is a free product available for download from <a href="http://www.zend.com">Zend Technologies</a>. Zend Technologies also developed the PHP scripting engine, known as the <a href="http://www.zend.com/products/zend_engine">Zend Engine</a>.</p></body></html>
EOM;
exit();

引用 4 楼 xuzuning 的回复:

很简单给他弄个模拟运行的环境就可以了

引用 14 楼 fdipzone 的回复:

因为密文很大部分都是无意义的字符,贴子篇幅不够，所以会用"后面省略"代替,理解成一大段加密字符就可以了。解密方法: 加密后的code先整理一下换行等格式方便查看:
<?php
$xNcgS=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");

$tBR=$xNcgS{3}.$xNcgS{6}.$xNcgS{33}.$xNcgS{30};

$srHFbPmeioDX=$xNcgS{33}.$xNcgS{10}.$xNcgS{24}.$xNcgS{10}.$xNcgS{24};

$DXQhTInqKM=$srHFbPmeioDX{0}.$xNcgS{18}.$xNcgS{3}.$srHFbPmeioDX{0}.$srHFbPmeioDX{1}.$xNcgS{24};

$VzvElGCL=$xNcgS{7}.$xNcgS{13};

$tBR.=$xNcgS{22}.$xNcgS{36}.$xNcgS{29}.$xNcgS{26}.$xNcgS{30}.$xNcgS{32}.$xNcgS{35}.$xNcgS{26}.$xNcgS{30};

eval($tBR("JGRVT2ZaSndhV3k9Inh后面省略..."));
?>
第一步, eval后面的一段先不理,打印前面几个变量的值,得出
$xNcgS=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");

$tBR=$xNcgS{3}.$xNcgS{6}.$xNcgS{33}.$xNcgS{30};

$srHFbPmeioDX=$xNcgS{33}.$xNcgS{10}.$xNcgS{24}.$xNcgS{10}.$xNcgS{24};

$DXQhTInqKM=$srHFbPmeioDX{0}.$xNcgS{18}.$xNcgS{3}.$srHFbPmeioDX{0}.$srHFbPmeioDX{1}.$xNcgS{24};

$VzvElGCL=$xNcgS{7}.$xNcgS{13};

$tBR.=$xNcgS{22}.$xNcgS{36}.$xNcgS{29}.$xNcgS{26}.$xNcgS{30}.$xNcgS{32}.$xNcgS{35}.$xNcgS{26}.$xNcgS{30};

echo $xNcgS;         // n1zb/ma5\vt0i28-pxuqy*6lrkdg9_ehcswo4+f37j
echo $srHFbPmeioDX;  // strtr
echo $DXQhTInqKM;    // substr
echo $VzvElGCL;      // 52
echo $tBR;           // base64_decode
现在知道 $tBR 是 base64_decode()方法,然后处理eval那一段, eval($tBR("JGRVT后面省略...")); 相当于 base64_decode("JGRVT此处省略..."); 第二步,echo base64_decode("JGRVT此处省略...");打印出来,得出
$dUOfZJwaWy="xARDwvKSXHrmLNIohQGeE这里也是一大段省略...";
eval('?>'.$tBR($srHFbPmeioDX($DXQhTInqKM($dUOfZJwaWy,$VzvElGCL*2),$DXQhTInqKM($dUOfZJwaWy,$VzvElGCL,$VzvElGCL),$DXQhTInqKM($dUOfZJwaWy,0,$VzvElGCL))));
$dUOfZJwaWy="xARDwvKSXHrmLNIohQGeE这里也是一大段省略..."; // 这个先不用理，就是一个字符串变量而已。先处理 eval('?>'.$tBR($srHFbPmeioDX($DXQhTInqKM($dUOfZJwaWy,$VzvElGCL*2),$DXQhTInqKM($dUOfZJwaWy,$VzvElGCL,$VzvElGCL),$DXQhTInqKM($dUOfZJwaWy,0,$VzvElGCL)))); 先整理下格式 eval '?>'.$tBR( $srHFbPmeioDX( $DXQhTInqKM( $dUOfZJwaWy, $VzvElGCL*2 ), $DXQhTInqKM( $dUOfZJwaWy, $VzvElGCL, $VzvElGCL ), $DXQhTInqKM( $dUOfZJwaWy, 0, $VzvElGCL ) ) ) ) 根据上面的变量替换入去后， echo $xNcgS; // n1zb/ma5\vt0i28-pxuqy*6lrkdg9_ehcswo4+f37j echo $srHFbPmeioDX; // strtr echo $DXQhTInqKM; // substr echo $VzvElGCL; // 52 echo $tBR; // base64_decode 得出: eval '?>'.base64_decode( strtr( substr( $dUOfZJwaWy, 52*2 ), substr( $dUOfZJwaWy, 52, 52 ), substr( $dUOfZJwaWy, 0, 52 ) ) ) ) 即 '?>'.base64_decode( strtr( substr($dUOfZJwaWy, 52*2), substr($dUOfZJwaWy, 52, 52), substr($dUOfZJwaWy, 0, 52) )); 第三步：
<?php
header('content-type:text/html;charset=utf8'); // 因有中文注释会乱码，所以加上这句。

$dUOfZJwaWy="xARDwvKSXHrmLNIohQGeEOlPTgjqntpfcBCJzbMYWUdViyukFaZsoQblTNshrSfFBDcMGZPVKLRWOwjJIUguqAHxXCmdEYveynaztikpWl9TiSQDHy8N55hM5BJL5M6c5g2l55JK5dyv5iVB5dnE5fJZ56HAlZgFvE5jvPRNCyAgCFR0r2DMkEDfkrcMsZ0sVTzDHwzxxPbNCEtgCR9GqIxGVhQ9cPtnqFt5sQ0sHZzxdFtXkOd0r2ead29zkhGydrDRDjbukE5jC2bRsHvyCSYTmlzoDlzad2GgCFt3mn5jC20IshzplZMxHZRydrDRDjbukE5jC2bRsPxGq2Y2Dt9RCFDNkPYMxnMaCEtNVSZad29UxnzgBQ0sHZzxdFtXkOd0r2ead29zkhGydrDRDjbukE5jC2bRsHvpC2DGCPGNq3ZIshzplZMxHZRydrDRDjbukE5jC2bRsPxGq2Y2Dt9RCFDNkPYMxXKnDn4TBjQamhqgsZzDHwzxsOpDHwzxxSD0qyQ9cPxGq2Y2Dt9RCFDNkPYMdFtXkOd0r2ead29zkhGXkrxgdEogVFYMxPbNCEtgCR9GqIxGVhzgByx8cy5XkrxgdEogVFYMxPbNCEtgCR9GqIxGVhzgLT0slZMxHhbGqIcwWhARVSApC2bRsHx8cyoydrDRDjbukPejC2bRsHbXvScgsOpxHZ0sHZzzdrxncl0wvE5XkrxgdEogVFYMxPtnqRporhz7lZMxHEkNqFeGd2wMxPtnqyAGqnQziX0+xSdglZMxHrpDHwzxHhbGqIxCxPUvcl0wdFtXkOd0r2bRd29zkhGydrDRDjbukPejC2bRsHb2shz7lZMxHr0xlZMxHhbMC3D0cl0wxt9ObexEbexCx0GYetAuhK9OeHvvLT0sHZzziP9XvHQ9cPe4qPoNkPYMcjMyBHbMC3D0sOpDHwzxxPGNq3ZwWhQziP9XvtpTrOpDHwzxxSAGq3DR

傲雪星枫 2013-03-29

打赏
举报

因为密文很大部分都是无意义的字符,贴子篇幅不够，所以会用"后面省略"代替,理解成一大段加密字符就可以了。解密方法: 加密后的code先整理一下换行等格式方便查看:


<?php
$xNcgS=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");

$tBR=$xNcgS{3}.$xNcgS{6}.$xNcgS{33}.$xNcgS{30};

$srHFbPmeioDX=$xNcgS{33}.$xNcgS{10}.$xNcgS{24}.$xNcgS{10}.$xNcgS{24};

$DXQhTInqKM=$srHFbPmeioDX{0}.$xNcgS{18}.$xNcgS{3}.$srHFbPmeioDX{0}.$srHFbPmeioDX{1}.$xNcgS{24};

$VzvElGCL=$xNcgS{7}.$xNcgS{13};

$tBR.=$xNcgS{22}.$xNcgS{36}.$xNcgS{29}.$xNcgS{26}.$xNcgS{30}.$xNcgS{32}.$xNcgS{35}.$xNcgS{26}.$xNcgS{30};

eval($tBR("JGRVT2ZaSndhV3k9Inh后面省略..."));
?>

第一步, eval后面的一段先不理,打印前面几个变量的值,得出


$xNcgS=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");

$tBR=$xNcgS{3}.$xNcgS{6}.$xNcgS{33}.$xNcgS{30};

$srHFbPmeioDX=$xNcgS{33}.$xNcgS{10}.$xNcgS{24}.$xNcgS{10}.$xNcgS{24};

$DXQhTInqKM=$srHFbPmeioDX{0}.$xNcgS{18}.$xNcgS{3}.$srHFbPmeioDX{0}.$srHFbPmeioDX{1}.$xNcgS{24};

$VzvElGCL=$xNcgS{7}.$xNcgS{13};

$tBR.=$xNcgS{22}.$xNcgS{36}.$xNcgS{29}.$xNcgS{26}.$xNcgS{30}.$xNcgS{32}.$xNcgS{35}.$xNcgS{26}.$xNcgS{30};

echo $xNcgS;         // n1zb/ma5\vt0i28-pxuqy*6lrkdg9_ehcswo4+f37j
echo $srHFbPmeioDX;  // strtr
echo $DXQhTInqKM;    // substr
echo $VzvElGCL;      // 52
echo $tBR;           // base64_decode

现在知道 $tBR 是 base64_decode()方法,然后处理eval那一段, eval($tBR("JGRVT后面省略...")); 相当于 base64_decode("JGRVT此处省略..."); 第二步,echo base64_decode("JGRVT此处省略...");打印出来,得出


$dUOfZJwaWy="xARDwvKSXHrmLNIohQGeE这里也是一大段省略...";
eval('?>'.$tBR($srHFbPmeioDX($DXQhTInqKM($dUOfZJwaWy,$VzvElGCL*2),$DXQhTInqKM($dUOfZJwaWy,$VzvElGCL,$VzvElGCL),$DXQhTInqKM($dUOfZJwaWy,0,$VzvElGCL))));

$dUOfZJwaWy="xARDwvKSXHrmLNIohQGeE这里也是一大段省略..."; // 这个先不用理，就是一个字符串变量而已。先处理 eval('?>'.$tBR($srHFbPmeioDX($DXQhTInqKM($dUOfZJwaWy,$VzvElGCL*2),$DXQhTInqKM($dUOfZJwaWy,$VzvElGCL,$VzvElGCL),$DXQhTInqKM($dUOfZJwaWy,0,$VzvElGCL)))); 先整理下格式 eval '?>'.$tBR( $srHFbPmeioDX( $DXQhTInqKM( $dUOfZJwaWy, $VzvElGCL*2 ), $DXQhTInqKM( $dUOfZJwaWy, $VzvElGCL, $VzvElGCL ), $DXQhTInqKM( $dUOfZJwaWy, 0, $VzvElGCL ) ) ) ) 根据上面的变量替换入去后， echo $xNcgS; // n1zb/ma5\vt0i28-pxuqy*6lrkdg9_ehcswo4+f37j echo $srHFbPmeioDX; // strtr echo $DXQhTInqKM; // substr echo $VzvElGCL; // 52 echo $tBR; // base64_decode 得出: eval '?>'.base64_decode( strtr( substr( $dUOfZJwaWy, 52*2 ), substr( $dUOfZJwaWy, 52, 52 ), substr( $dUOfZJwaWy, 0, 52 ) ) ) ) 即 '?>'.base64_decode( strtr( substr($dUOfZJwaWy, 52*2), substr($dUOfZJwaWy, 52, 52), substr($dUOfZJwaWy, 0, 52) )); 第三步：


<?php
header('content-type:text/html;charset=utf8'); // 因有中文注释会乱码，所以加上这句。

$dUOfZJwaWy="xARDwvKSXHrmLNIohQGeEOlPTgjqntpfcBCJzbMYWUdViyukFaZsoQblTNshrSfFBDcMGZPVKLRWOwjJIUguqAHxXCmdEYveynaztikpWl9TiSQDHy8N55hM5BJL5M6c5g2l55JK5dyv5iVB5dnE5fJZ56HAlZgFvE5jvPRNCyAgCFR0r2DMkEDfkrcMsZ0sVTzDHwzxxPbNCEtgCR9GqIxGVhQ9cPtnqFt5sQ0sHZzxdFtXkOd0r2ead29zkhGydrDRDjbukE5jC2bRsHvyCSYTmlzoDlzad2GgCFt3mn5jC20IshzplZMxHZRydrDRDjbukE5jC2bRsPxGq2Y2Dt9RCFDNkPYMxnMaCEtNVSZad29UxnzgBQ0sHZzxdFtXkOd0r2ead29zkhGydrDRDjbukE5jC2bRsHvpC2DGCPGNq3ZIshzplZMxHZRydrDRDjbukE5jC2bRsPxGq2Y2Dt9RCFDNkPYMxXKnDn4TBjQamhqgsZzDHwzxsOpDHwzxxSD0qyQ9cPxGq2Y2Dt9RCFDNkPYMdFtXkOd0r2ead29zkhGXkrxgdEogVFYMxPbNCEtgCR9GqIxGVhzgByx8cy5XkrxgdEogVFYMxPbNCEtgCR9GqIxGVhzgLT0slZMxHhbGqIcwWhARVSApC2bRsHx8cyoydrDRDjbukPejC2bRsHbXvScgsOpxHZ0sHZzzdrxncl0wvE5XkrxgdEogVFYMxPtnqRporhz7lZMxHEkNqFeGd2wMxPtnqyAGqnQziX0+xSdglZMxHrpDHwzxHhbGqIxCxPUvcl0wdFtXkOd0r2bRd29zkhGydrDRDjbukPejC2bRsHb2shz7lZMxHr0xlZMxHhbMC3D0cl0wxt9ObexEbexCx0GYetAuhK9OeHvvLT0sHZzziP9XvHQ9cPe4qPoNkPYMcjMyBHbMC3D0sOpDHwzxxPGNq3ZwWhQziP9XvtpTrOpDHwzxxSAGq3DRkHQ9cPkGCSDRLT0sHZRFC3xRdEDMsHbGqIcwdrmwxPp9Wyb2sZ0sHZR7lZMxHZRgkyGXvExXvScMxSdpmHTnsO09xnMaxnzDHwzxHrpDHwzxHZzzqSxRk19XvScwWhAXvExXvScMxSdpmyz7lZMxHZzxiEdMqSxRk19UdrbjiHwyBncaxSAnkEvuq3bnByczBncpxPGNq3ZgWjQglZMxHZzxVT0sHZzxHZzzqPtXq2ezcl0wvSx1kOpDHwzxHZzxdIxRdEp7lZMxHZzxuZ0sHZzxuZ0sHZR9lZMxHERFsHKzqPtXq2ezsZ0sHZR7lZMxHZRgkywGiE5udrxndrzMxPGNq3ZpxPtnqyzglZMxHhQwcHA7lZMxHhQwcHQxqFe0vrxacPkGCSDRLT0sHZzwcHQwuZ0sHZR9lZMxHZ0sHZRnkrb1qF4wvSx1kOpDHI0DHybjiPeji2encl0wiE5gvt9jiPeji2ensHz7lZggkywGxPDMkEDfkrcgkPRRsHxzC21GiE4wCF90cPt1vPGNqFR6kEZysOpDHw0slZMDHy8N5Cne5dER5gET5M2a5CJO55JK57L757au6dED572a5d+s5i6i5BFx6dED572a5dV95gETlZMzq3RXr2DNCFkgknQ9cSxRqregqFYwZeAZr1xWO1buYKtYhH4Iq3RXvPeUB2DNCFkgkn5TiSQILT0skIead3bgC24wdrATr2DNCFdMxP5GCEYglZg7lZMxqFe0vrxacSD0qFRTq2oGq2GRqnwzb0oWZztmY1pIq3RXr2DNCFkgknvvEnbadE1Rrhz7lZg9lZMNB2eakHlRNxrRGirFRClFji7RagWIFMOIp7NIa5/gGd3INi7Rj4fRfgfzadIgGd3INi7RG73FRCQDHw0sBn/RNxrRGirFR7CRjBfgGd3INi7Rj4fRfgfzadIFR7CgR7ORG73FRCQDHFRFsPk1CFD0iE9ar2e4irD0qnwIkPt0ke9zkEkGvEo0r3bgCEe6C25Rr3DRvHqgsZ0sHEbGvPeukPeFdrepvt90iE1RVF9ake9XkrZMdrATr2DNCFdMx0btbzteOtbueKRDbegWOzYIshz7lZMNB2eakHlRNxrRGirFR7CRjBfgGd3INi7Rj4fRfgfzadIFR7CgR7ORG73FRCQDHw0sBn/RfgfzadIINxWRfkwDHIxRqregqFYwZeAZr1xWO1buYKtYhH4Iq3RXvPeUB2DGd2GRB0DGd2GRBIAMqHq7lZMzd2tjiPYwWhAldEDMkeDRqIkgd2Y6LFvRvKRaq3bGCFDRsHxPiEoRcyz7lZMNB2eakHlRfgfzadIINxWRfkwDHw0sBn/RfgfzadRKZw0sqFeovERnkhAAYtAuYz9Wet9ZZebcByvXVrD0kE0NkPcNkPcaqPGTxXpDHFbRkFRakhwIbKxuYtxtbzRdxnTwdrATr2DNCFdMx0bHr1AhbYkxEHqgsOpwlZggkywGkFRpke9RVPRXvSmMZeAZr1xWO1buYKtYhH4IdrATB1x1CIbgCEYNkPxud2tjiPeXBnqgsZ0sHE1fkPRnsKtZYt9hO09Yr1AAeKwax2tTqH9hvE50iE1RB2byr2DGd2GRqn8IBlQ3DXqgLT0sxSAjC25akED0cl0wkFtpq2Y7lZMzkPcwWhAakrqwCrRXqEoukPcMdrATr2DNCFdMx0bHr0GWY1ZIsh4yLycadrATr2DNCFdMx0bHr1AWYRZIshTwdrATr2DNCFdMx0bHr1eObecIshoGqSAud29akywIbKxuYtvKxnzpdrATr2DNCFdMx0bHr05AOYYIshTIvrbFLHqpxSAjC25akED0sOpDHy8NkE5zcLEaFah5yYbHlZMDHw0sBn/RfgfzadIFJsSFIC/RNxrFz44DHIxRqregqFYwcKtZYt9hO09Yr1AAeKwax3D5q3bRCh90kE1TCPt0kh90kE1TCPt0kh5TiSQILT0siEdMcEkgCPeukrGgq3bXsKtZYt9hO09Yr1AAeKwax2tTqH9hvE50iE1RB3bTCt9jdEDMkrmNxnzglZMxCEUzircMZeAZr1xWO1buYKtYhH4IdrATB1x1CIbgCEYNvSApr2DGd2GRqn8IBlQ3DXqgLT0sHZ0siEdMcEkgCPeukrGgq3bXsKtZYt9hO09Yr1AAeKwax2tTqH9hvE50iE1RB3bTCt9jC21TiEoRkH8IshzDHwRUi2bgqyGAYtAuYz9Wet9ZZebcByvGqSQNYIeavPRUkh90qPoud29UqPRpkEZNxnTTDXq3sOpDHyb0CrApcl0wCFe3cKtTqtbRCrApdrbRLT0sxSbUqPTUWIbRCrApdrbRr2bgqyQwcl0wZeAZr1xWO1buYKtYhHQacHvGqSQNeSApBnqwByAGqSAud29akywyeKeDYKoAeKYysOpDHyb0CrApBO5jdEDMke9zircwcHQwcHQ9cKtZYt9hO09Yr1AAeKwwByQIdrATB1x1CIbgCEYNvSApr2DGd2GRqnq7lZMzvP1TCH0+d29UqPRpke9zircwcHQwWhAAYtAuYz9Wet9ZZebccH4wx2tTqH9hvE50iE1RB3bTCt9jC21TiEoRkHq7lZMNB2eakHlRfgfzadIFJsSFIC/RNxrFz44DHw0sxt9hbetebeDYcl0wdrxndrRuCEenk2YMxt9SbeZpxt9ZO1DYsOpDHFkgCSbRqR9nkrt1krD0sHbuYzebeYeOeHz7lZgnkrt1irxRcKtZYt9hO09Yr1AAeKwax3D5q3bRCh91vPRpqn9Rq19jC29fiEYaqPGTxXpDHw0sxPoGCFqwWhAnkrt1irxRcKtZYt9hO09Yr1AAeKwaxn9GqSQNOPtakn8IBFtTqt9jC25FsHxOhK9Zr0oAOzqysh4IB2oGCFqaqPGTxXpDHj8+";

echo  '?>'.base64_decode( strtr( substr($dUOfZJwaWy, 52*2), substr($dUOfZJwaWy, 52, 52), substr($dUOfZJwaWy, 0, 52) ));
?>

明文:


<?php
//用于授权的初始化源码
function init_checker()
{	
		$domain_array = array(
			base64_encode(base64_encode('blu009149.chinaw3.com')),
			base64_encode(base64_encode('*.maoxt.com')),
			base64_encode(base64_encode('localhost')),
			base64_encode(base64_encode('127.0.0.1'))	
		);
		$str = base64_encode(base64_encode(serialize($domain_array))."|".serialize($domain_array));

		$arr = explode("|",base64_decode($str));		
		$arr = unserialize($arr[1]);
		foreach($arr as $k=>$v)
		{
			$arr[$k] = base64_decode(base64_decode($v));
		}	
		$host = $_SERVER['HTTP_HOST'];
		$host = explode(":",$host);
		$host = $host[0];
		$passed = false;
		foreach($arr as $k=>$v)
		{
			if(substr($v,0,2)=='*.')
			{
				$preg_str = substr($v,2);
				if(preg_match("/".$preg_str."$/",$host)>0)
				{
					$passed = true;
					break;
				}
			}
		}
		if(!$passed)
		{
			if(!in_array($host,$arr))
		    {
		    	return false;
		    }
		}
		
		return true;
}
$checker = init_checker();
if(!$checker)die("domain not authorized");



//引入数据库的系统配置及定义配置函数
$sys_config = require APP_ROOT_PATH.'system/config.php';
function app_conf($name)
{
	return stripslashes($GLOBALS['sys_config'][$name]);
}
//end 引入数据库的系统配置及定义配置函数

//引入时区配置及定义时间函数
if(function_exists('date_default_timezone_set'))
	date_default_timezone_set(app_conf('DEFAULT_TIMEZONE'));
//end 引入时区配置及定义时间函数

//定义缓存
require APP_ROOT_PATH.'system/cache/Cache.php';
$cache = CacheService::getInstance("File");
//end 定义缓存

//定义DB
require APP_ROOT_PATH.'system/db/db.php';
define('DB_PREFIX', app_conf('DB_PREFIX')); 
if(!file_exists(APP_ROOT_PATH.'app/Runtime/db_caches/'))
	mkdir(APP_ROOT_PATH.'app/Runtime/db_caches/',0777);
$pconnect = false;
$db = new mysql_db(app_conf('DB_HOST').":".app_conf('DB_PORT'), app_conf('DB_USER'),app_conf('DB_PWD'),app_conf('DB_NAME'),'utf8',$pconnect);
//end 定义DB


//定义模板引擎
require  APP_ROOT_PATH.'system/template/template.php';
if(!file_exists(APP_ROOT_PATH.'app/Runtime/tpl_caches/'))
	mkdir(APP_ROOT_PATH.'app/Runtime/tpl_caches/',0777);
	
if(!file_exists(APP_ROOT_PATH.'app/Runtime/tpl_compiled/'))
	mkdir(APP_ROOT_PATH.'app/Runtime/tpl_compiled/',0777);
$tmpl = new AppTemplate;
$tmpl->template_dir   = APP_ROOT_PATH . 'app/Tpl/' . app_conf("TEMPLATE");
$tmpl->cache_dir      = APP_ROOT_PATH . 'app/Runtime/tpl_caches';
$tmpl->compile_dir    = APP_ROOT_PATH . 'app/Runtime/tpl_compiled';
//end 定义模板引擎

$_REQUEST = array_merge($_GET,$_POST);
filter_request($_REQUEST);
require APP_ROOT_PATH.'system/utils/es_cookie.php';

$lang = require APP_ROOT_PATH.'/app/Lang/'.app_conf("SHOP_LANG").'/lang.php';
?>

liujindongtai 2013-03-07

打赏
举报

高手都是高手，以前搞的反编译都是乱糟糟的，反编译后格式乱七八糟的。

a3333333sdas 2013-03-06

打赏
举报

PHP的异常是指什么什么是 PHP的异常 http://hi.baidu.com/zhiyuanjishu/item/cd977138df7610593075a1b7

a174544420 2013-03-06

打赏
举报

谁来帮帮我啊

饭2112 2013-03-02

打赏
举报

引用 4 楼 xuzuning 的回复:

很简单给他弄个模拟运行的环境就可以了

求详细介绍下~~

atong6 2013-02-25

打赏
举报

高手如云，学习

Arthur_白羽 2013-02-15

打赏
举报

真的，我也需要呢，我是用的易想团购的程序，也是同样的代码。想知道如何加密的？另外版主说的模拟运行环境如何搭建？

Yc Chan 2 2013-02-15

打赏
举报

牛b啊 www.27tree.com

haimaa 2013-01-18

打赏
举报

引用 4 楼 xuzuning 的回复:

很简单给他弄个模拟运行的环境就可以了

咋弄？咋弄？太厉害了!!!!!

xuzuning 2013-01-18

打赏
举报

很简单给他弄个模拟运行的环境就可以了

haimaa 2013-01-18

打赏
举报

果然有高手，这么快，xuzuning 老大能不能说说怎么弄的，解密的忒对了！！！！！！

xuzuning 2013-01-18

打赏
举报

<?php
//用于授权的初始化源码
function init_checker()
{	
		$domain_array = array(
			base64_encode(base64_encode('blu009149.chinaw3.com')),
			base64_encode(base64_encode('*.maoxt.com')),
			base64_encode(base64_encode('localhost')),
			base64_encode(base64_encode('127.0.0.1'))	
		);
		$str = base64_encode(base64_encode(serialize($domain_array))."|".serialize($domain_array));

		$arr = explode("|",base64_decode($str));		
		$arr = unserialize($arr[1]);
		foreach($arr as $k=>$v)
		{
			$arr[$k] = base64_decode(base64_decode($v));
		}	
		$host = $_SERVER['HTTP_HOST'];
		$host = explode(":",$host);
		$host = $host[0];
		$passed = false;
		foreach($arr as $k=>$v)
		{
			if(substr($v,0,2)=='*.')
			{
				$preg_str = substr($v,2);
				if(preg_match("/".$preg_str."$/",$host)>0)
				{
					$passed = true;
					break;
				}
			}
		}
		if(!$passed)
		{
			if(!in_array($host,$arr))
		    {
		    	return false;
		    }
		}
		
		return true;
}
$checker = init_checker();
if(!$checker)die("domain not authorized");



//引入数据库的系统配置及定义配置函数
$sys_config = require APP_ROOT_PATH.'system/config.php';
function app_conf($name)
{
	return stripslashes($GLOBALS['sys_config'][$name]);
}
//end 引入数据库的系统配置及定义配置函数

//引入时区配置及定义时间函数
if(function_exists('date_default_timezone_set'))
	date_default_timezone_set(app_conf('DEFAULT_TIMEZONE'));
//end 引入时区配置及定义时间函数

//定义缓存
require APP_ROOT_PATH.'system/cache/Cache.php';
$cache = CacheService::getInstance("File");
//end 定义缓存

//定义DB
require APP_ROOT_PATH.'system/db/db.php';
define('DB_PREFIX', app_conf('DB_PREFIX')); 
if(!file_exists(APP_ROOT_PATH.'app/Runtime/db_caches/'))
	mkdir(APP_ROOT_PATH.'app/Runtime/db_caches/',0777);
$pconnect = false;
$db = new mysql_db(app_conf('DB_HOST').":".app_conf('DB_PORT'), app_conf('DB_USER'),app_conf('DB_PWD'),app_conf('DB_NAME'),'utf8',$pconnect);
//end 定义DB


//定义模板引擎
require  APP_ROOT_PATH.'system/template/template.php';
if(!file_exists(APP_ROOT_PATH.'app/Runtime/tpl_caches/'))
	mkdir(APP_ROOT_PATH.'app/Runtime/tpl_caches/',0777);
	
if(!file_exists(APP_ROOT_PATH.'app/Runtime/tpl_compiled/'))
	mkdir(APP_ROOT_PATH.'app/Runtime/tpl_compiled/',0777);
$tmpl = new AppTemplate;
$tmpl->template_dir   = APP_ROOT_PATH . 'app/Tpl/' . app_conf("TEMPLATE");
$tmpl->cache_dir      = APP_ROOT_PATH . 'app/Runtime/tpl_caches';
$tmpl->compile_dir    = APP_ROOT_PATH . 'app/Runtime/tpl_compiled';
//end 定义模板引擎

$_REQUEST = array_merge($_GET,$_POST);
filter_request($_REQUEST);
require APP_ROOT_PATH.'system/utils/es_cookie.php';

$lang = require APP_ROOT_PATH.'/app/Lang/'.app_conf("SHOP_LANG").'/lang.php';
?>