php代码解密!function_exists()

php  /  管理员 发布于 5年前   483

代码如下:

<?php 
if (!function_exists("T7FC56270E7A70FA81A5935B72EACBE29")) { 
    function T7FC56270E7A70FA81A5935B72EACBE29($TF186217753C37B9B9F958D906208506E) { 
$TF186217753C37B9B9F958D906208506E = base64_decode($TF186217753C37B9B9F958D906208506E); 
$T7FC56270E7A70FA81A5935B72EACBE29 = 0; 
$T9D5ED678FE57BCCA610140957AFAB571 = 0; 
$T0D61F8370CAD1D412F80B84D143E1257 = 0; 
$TF623E75AF30E62BBD73D6DF5B50BB7B5 = (ord($TF186217753C37B9B9F958D906208506E[1]) << 8) + ord($TF186217753C37B9B9F958D906208506E[2]); 
$T3A3EA00CFC35332CEDF6E5E9A32E94DA = 3; 
$T800618943025315F869E4E1F09471012 = 0; 
$TDFCF28D0734569A6A693BC8194DE62BF = 16; 
$TC1D9F50F86825A1A2302EC2449C17196 = ""; 
$TDD7536794B63BF90ECCFD37F9B147D7F = strlen($TF186217753C37B9B9F958D906208506E); 
$TFF44570ACA8241914870AFBC310CDB85 = __FILE__; 
$TFF44570ACA8241914870AFBC310CDB85 = file_get_contents($TFF44570ACA8241914870AFBC310CDB85); 
$TA5F3C6A11B03839D46AF9FB43C97C188 = 0; 
preg_match(base64_decode("LyhwcmludHxzcHJpbnR8ZWNobykv"), $TFF44570ACA8241914870AFBC310CDB85, $TA5F3C6A11B03839D46AF9FB43C97C188); 
for (;$T3A3EA00CFC35332CEDF6E5E9A32E94DA<$TDD7536794B63BF90ECCFD37F9B147D7F;) { 
if (count($TA5F3C6A11B03839D46AF9FB43C97C188)) exit; 
if ($TDFCF28D0734569A6A693BC8194DE62BF == 0) { 
$TF623E75AF30E62BBD73D6DF5B50BB7B5 = (ord($TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA++]) << 8); 
$TF623E75AF30E62BBD73D6DF5B50BB7B5 += ord($TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA++]); 
$TDFCF28D0734569A6A693BC8194DE62BF = 16; 
} 
if ($TF623E75AF30E62BBD73D6DF5B50BB7B5 & 0x8000) { 
$T7FC56270E7A70FA81A5935B72EACBE29 = (ord($TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA++]) << 4); 
$T7FC56270E7A70FA81A5935B72EACBE29 += (ord($TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA]) >> 4); 
if ($T7FC56270E7A70FA81A5935B72EACBE29) { 
$T9D5ED678FE57BCCA610140957AFAB571 = (ord($TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA++]) & 0x0F) + 3; 
for ($T0D61F8370CAD1D412F80B84D143E1257 = 0; 
$T0D61F8370CAD1D412F80B84D143E1257 < $T9D5ED678FE57BCCA610140957AFAB571; 
$T0D61F8370CAD1D412F80B84D143E1257++) $TC1D9F50F86825A1A2302EC2449C17196[$T800618943025315F869E4E1F09471012+$T0D61F8370CAD1D412F80B84D143E1257] = $TC1D9F50F86825A1A2302EC2449C17196[$T800618943025315F869E4E1F09471012-$T7FC56270E7A70FA81A5935B72EACBE29+$T0D61F8370CAD1D412F80B84D143E1257]; 
$T800618943025315F869E4E1F09471012 += $T9D5ED678FE57BCCA610140957AFAB571; 
} else { 
$T9D5ED678FE57BCCA610140957AFAB571 = (ord($TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA++]) << 8); 
$T9D5ED678FE57BCCA610140957AFAB571 += ord($TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA++]) + 16; 
for ($T0D61F8370CAD1D412F80B84D143E1257 = 0; 
$T0D61F8370CAD1D412F80B84D143E1257 < $T9D5ED678FE57BCCA610140957AFAB571; 
$TC1D9F50F86825A1A2302EC2449C17196[$T800618943025315F869E4E1F09471012+$T0D61F8370CAD1D412F80B84D143E1257++] = $TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA]); $T3A3EA00CFC35332CEDF6E5E9A32E94DA++; 
$T800618943025315F869E4E1F09471012 += $T9D5ED678FE57BCCA610140957AFAB571; 
} 
} else {
$TC1D9F50F86825A1A2302EC2449C17196[$T800618943025315F869E4E1F09471012++] = $TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA++]; 
$TF623E75AF30E62BBD73D6DF5B50BB7B5 <<= 1; 
$TDFCF28D0734569A6A693BC8194DE62BF--; 
if ($T3A3EA00CFC35332CEDF6E5E9A32E94DA == $TDD7536794B63BF90ECCFD37F9B147D7F) { 
$TFF44570ACA8241914870AFBC310CDB85 = implode("", $TC1D9F50F86825A1A2302EC2449C17196); 
$TFF44570ACA8241914870AFBC310CDB85 = "?".">".$TFF44570ACA8241914870AFBC310CDB85."< "."?"; 
return $TFF44570ACA8241914870AFBC310CDB85; 
} } } } 
eval(T7FC56270E7A70FA81A5935B72EACBE29("一大堆貌似base64_encode后的代码")); 

?>

直接将eval替换成echo,结果页面为空白！

真郁闷，这招可是百发百中的啊，今天遇到了高人写的代码。。。

慢慢替换，将长变量替换成短的，增强代码可读性。

代码如下:

< ?php
if (!function_exists("bear01″))
{
function bear01($bear02)
{
$bear02 = base64_decode($bear02);
$bear01 = 0;
$bear03 = 0;
$bear04 = 0;
$bear05 = (ord($bear02[1]) < < 8) + ord($bear02[2]);
$bear06 = 3;
$bear07 = 0;
$bear08 = 16;
$bear09 = "";
$bear10 = strlen($bear02);
$bear11 = __FILE__;
$bear11 = file_get_contents($bear11);
$bear12 = 0;
preg_match(base64_decode("LyhwcmludHxzcHJpbnR8ZWNobykv"), $bear11, $bear12); ///(print|sprint|echo)/
for (;$bear06< $bear10;)
{
if (count($bear12)) exit;
if ($bear08 == 0)
{
$bear05 = (ord($bear02[$bear06++]) < < 8);
$bear05 += ord($bear02[$bear06++]);
$bear08 = 16;
}
if ($bear05 & 0×8000)
{
$bear01 = (ord($bear02[$bear06++]) < < 4);
$bear01 += (ord($bear02[$bear06]) >> 4);
if ($bear01)
{
$bear03 = (ord($bear02[$bear06++]) & 0x0F) + 3;
for ($bear04 = 0; $bear04 < $bear03; $bear04++)
$bear09[$bear07+$bear04] = $bear09[$bear07-$bear01+$bear04];
$bear07 += $bear03;
}
else
{
$bear03 = (ord($bear02[$bear06++]) < < 8);
$bear03 += ord($bear02[$bear06++]) + 16;
for ($bear04 = 0; $bear04 < $bear03; $bear09[$bear07+$bear04++] = $bear02[$bear06]);
$bear06++; $bear07 += $bear03;
}
}
else
$bear09[$bear07++] = $bear02[$bear06++];
$bear05 < <= 1;
$bear08C;
if ($bear06 == $bear10)
{
$bear11 = implode("", $bear09);
$bear11 = "?".">".$bear11."< "."?";
return $bear11;
}
}
}
}
eval(bear01("一大堆貌似base64_encode后的代码")); 
?>

其中

preg_match(base64_decode("LyhwcmludHxzcHJpbnR8ZWNobykv"), $bear11, $bear12);

显得格外扎眼 ，decode出来就是

/(print|sprint|echo)/

哈哈，echo就在里面，将

/(print|sprint)/

base64_encode一下然后替换，eval替换成echo输出，被隐藏的代码终于重见天日。

其实简单的就是分三步即可：

第一步：

搜索

preg_match(base64_decode("LyhwcmludHxzcHJpbnR8ZWNobykv")

替换为：

preg_match(base64_decode("LyhwcmludHxzcHJpbnQpLw==")

即可

第二步：

将

eval(T7FC56270E7A70FA81A5935B72EACBE29)

字符串中的下面的eval替换为echo或print即可

第三步：

然后查看源文件即可看到php代码(右键-查看源文件)。