Home >Backend Development >PHP Tutorial >php混淆解密 谁能帮我下?顺便教我方法

php混淆解密 谁能帮我下?顺便教我方法

WBOY
WBOYOriginal
2016-06-23 14:20:161311browse

两个文件   
第一个文件:

 <?$O00OO0=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");$O00O0O=$O00OO0{3}.$O00OO0{6}.$O00OO0{33}.$O00OO0{30};$O0OO00=$O00OO0{33}.$O00OO0{10}.$O00OO0{24}.$O00OO0{10}.$O00OO0{24};$OO0O00=$O0OO00{0}.$O00OO0{18}.$O00OO0{3}.$O0OO00{0}.$O0OO00{1}.$O00OO0{24};$OO0000=$O00OO0{7}.$O00OO0{13};$O00O0O.=$O00OO0{22}.$O00OO0{36}.$O00OO0{29}.$O00OO0{26}.$O00OO0{30}.$O00OO0{32}.$O00OO0{35}.$O00OO0{26}.$O00OO0{30};eval($O00O0O("JE8wTzAwMD0idHZyZGxnT3BHVnVoZk1KaVJuRXNtVVBRYWtlWENISXFLU0JXY3hqRkxib1pOekFEeVRZd0pjcERhT1luemd5QU52WGJVS01WamZ0aGR1VEhtSUJyUnhXa3N3TGlRcVBGQ0Vsb1plR1N0bzlTZElsQ21qVWFGamF5RmtoUFgwYVlIMFVpZjFVdGUwNEtSeFdjc2JXYVR6YTBSbURXRzJDYXMzdk9Vemd5ZGtndVhadTdvaFBjUmJQQ21iUE81UXlhNVFiUTVHZGk1ZDY1NlIrMzVHeS81USt5NW54NW9oUHJRUzBSWHppMUR6QWNzamE2R0hVbnEyNXVxMjFBZGs0OUdIWFpHSHVQQmpBQUdrRFpkeDVMcTIwYlFtWDNEM3N5ZHppQUYzWG5RakNjcXhCVkJMTVpDWjRTUUxseXZ4Qm5ZUzBSZGtHUEJrYXlIMmlac2ppNVJtVU5mMGd4Z3VneGtaREJnaVVoSDBBdGYxaEtIeFN1R0hnMGR6OVpkSG5BRHphY3FqVWNxa2lucWJ1bkZIQW5EbU9LNUYrTjVGbUM1cFJBNW5aWDZHbWQ2UStJNVA2QjVuMm9ReWJjSitiV2FZVEV5MWlVQ29Nd3Zvc3dDRXV3WFp1N29obm5GYk91VWlVTmh1OWZSeFd1ZElVMHNtTzB2b3ZuWVMwUlhpOUFzamdBZGtVRUJvME9YWnM3b2hQdUgyaVpGa2luRm1sOUJ6aVpzamk1Um11N29obm5GYk91VWlVcVgyQ25ESXVLSHh1T1RTMFJteFVXZnVnV0J6OVpCbVVXZnVnV0JvME9HMmlMZHpnTnNqZ0FGbU9LR0hYYUd4NVNkSWxLUmVWQ21PYW5GYk91SDJpbkZtdU9UUzBSbWh1dUgyaVpGa2luRkl2T3R4bHVoZ1hpaGdWdUgyaW5GaTFxWDJDUGRrd3VYMTBPdFpsdWhnWGloZ1Z1SDJpbkZpMXFYMmlac2pDUGRrd3Vka2hLSHhsNkJtVU5Ha2F1WVMwUm1odXVIMmlaRmtpbkZtbDlCemc0c3p3Y0Z6ZlBYWlNLUW1sdUgyaVpGa2luRkl2bllTMFJtSDBDbUswT0Zrd0VGeFc3b2hQWFhpOUFka2hPdG1sd0J6OVpCelVBcXpnWkRtT0s1N1k3NTd5TjVuWnI1cVpsNUZtYzVHYno1NnlGNUdyTjZCWTk3N1p2NVBSUDU1ck01R2J6NTZ5RjU2NkE1NW16NXFiaDVHKzM1bnJtNVFiQzVHK2M1NXhQWFpTT1hNMXRVaWd2VWdWWkhnVktxemF5ZDNnWnFtRERRYkRWcTJEY0RIaHlzekFTWFp1N29objlvaG5aRkhpMWRIWGFCTVVmSDFYdGUxaHlYWjlBRnoxbnFiOUtxejliR2tTeUZLZ3lHWjVTZElsS1lTMFJzamd3RGthWkZ4V01naTl4ZTA5ZlFic2NkazVMcUlndUZ4OVNxM0MwUWpGMXFqdnlzekFTWEVWQ21LWGFzSGduc2pnTnEyNUxGeFdNZ2k5eGUwOWZRYnNjZGs1THFJZ3VGeDlMR2tDUEZ4NWpEazVMUUtXUHNtczdvaG5uczNDYURtT3VGamFWRnh1T3EzQk9YekZucXpmT3R4bEtkazV1RkhPS1lTMFJYSUNhRzNYYUR6SmFUeGw5Qm1EQUZ6MW5xYThLUUtDMHNLVWNxejkzRkhCUHMzZ2JzM1VaUk1VZkgwSmlreFNPUWVHblJlVkNtamFqUm1Vb1V1RHFYMmkxRHpBQUZ6MW5xYkREQm8wOUJtRExxMjlwZGtmS1J4VzdvaFBYWGk5dUZIQzBxMjl5SDJpdXFrYXlCbzBPRjJnMEgyQ2NxMkpuRnhPdXMyZ0xzamcwZDJnNVJlVkNtT3V1SDJVYXMzVWNxMjVOR2tVSmRrNE90eGx1SDJVYXMzVWNxMjVOR2tVSmRrNE90WlducUtVMkdrU1BYaTl1RkhDMHEyOXlIMml1cWtheVJ4bDZCb2w3b2huOUJ6Z1ZzMmZPVFMwUm14VUVGSENFZGs5eUJvME9xamczQnpVRUZIQ0Vkazl5Um11N29oUFhYaTl1RkhDMHEyOXlIMml1cWtheUJvME9kSENFRkhoUFhpOWVVZ0NleGY5WWtaVUVGa0NaRkhVcEZIYURSeGwvQnpheURJRkFxbU91SDFDaWYxQ1hlMDVxWElDYUczWGFEekphVGcwbkJvUE92b1ZDbUswQ21iVU5GajkxcWpVYXNibDlCbVVvVXVEcVgyRmNEazV1RkhYbkZtRERCbzA5Qm1VTkRIQ2FzamF1Qm84T1hpOTFzMmdaZGtoT1libFNZUzBSWGk5TEdIVW5GSXZPdHhsdUgyQ1Bka3d1c1psOUJtc0tZUzBSWGk5TEdIVW5GbWw5Qm1VTkcyQW5xemhPdHhXQXNLWEFUeE9uWVMwUmRrR1BYTVVma1pEQUZ6MW5xYTlWcTJzS0h4bGpYYmx1R2tDMGRrOXlCbU05Qm1EbnFIV2NzS2hLUnhXQUZ6MW5xYTlWcTJzUFJlVkNtamFqUm1VTWdpVktHa1VKZGs1TnEyNVZkazVhWDEwbkJ6aXVxa2F5SDI5eXF6YXlGeE9uWVMwUlhJRG5GekRhRG1sOUJ6YUVzMmcwUm1VM2RrVUtGSGhuQm84T2RrNTBEamlWUm1VM2RrVUtGSGhuQm9QT3ZvVkNtYlVTczJhNkZ4bDlCemFFczJnMFJtVVNzMmE2Rnh1T3RaV25xS1UyR2tTUFhJV0VkSG5hUnhsNkJvbDdvaG5uRmJPdXNJQ25UamZPdGJsU0JtR2pCbVVTczJhNkZ4bEF0eGx1c3ppS0ZIQ25UamZuQklWQ21PdXVzemlLRkhDblRqZk90eGx1c0lDblRqZjdvaFBYWHo5akZLQ2FEbWw5Qm1PdXN6aUtGeDB3UnhQdXN6aUtGSENuVGpmN29objlvaG5uRmJPdXFrOXVEa3dhQm8wOUJtRHVGSEMwcTI5eVhadU9UUzBSbXhBbnFqQ1ZEa1VhQk1VZkgxWHRlMWh5WFo5QUZ6MW5xYjhLUWJVamRrd2FRYnN5ZGs1TFFLV1BzbXNuQno5WkJ6MUVGWk9uWVMwUk54V2FxSUNhQklWQ21PYW5xakNWRGtVYUJNVWZIMVh0ZTFoeVhaOUpxMlUxcXpmY1haNHVxazl1RGt3YVFic2NHMjlKcWs5eVFqYXlHWjVTZElsS1lTMFJteEFucWpDVkRrVWFCTTFNSDFYdGUxaHlYWjlBRnoxbnFiOEtRYlVqZGt3YVFic3lkazVMUUtXUHNtc25CejlaQnoxRUZaT25ZUzBSTmgwUnRFND0iO2V2YWwoJz8+Jy4kTzAwTzBPKCRPME9PMDAoJE9PME8wMCgkTzBPMDAwLCRPTzAwMDAqMiksJE9PME8wMCgkTzBPMDAwLCRPTzAwMDAsJE9PMDAwMCksJE9PME8wMCgkTzBPMDAwLDAsJE9PMDAwMCkpKSk7"));  ?>

第二个文件


回复讨论(解决方案)

第二个文件  
太大了,代码传布上来   教我方法吧!万分感谢

这个没有加密。
$O00OO0 这个用urlde解出来就是一个字符串。。

逐次把 eval 替换成 echo 后运行

defined('IN_DESTOON') or exit('Access Denied');/*** 以下内容请勿修改*/$authorizationdomain=array("haagri.com","www.haagri.com","127.0.0.1");if(!in_array($_SERVER['HTTP_HOST'],$authorizationdomain))exit('域名没有通过授权.请联系QQxxxxxx');if($DT_BOT) dhttp(403);$_areaids = '';$_areaid = array();if($DT['city']) {	$AREA or $AREA = cache_read('area.php');	if($_aid) {		$_areaids = $AREA[$_aid]['child'] ? $AREA[$_aid]['arrchildid'] : $_aid;		$_areaid = explode(',', $_areaids);	}} else {	$_aid < 1 or dalert('系统未开启分站功能,您的分站管理帐号暂不可用', $MODULE[2]['linkurl'].'logout.php');}require DT_ROOT.'/admin/global.func.php';require DT_ROOT.'/include/post.func.php';require_once DT_ROOT.'/include/cache.func.php';isset($file) or $file = 'index';$secretkey = 'admin_'.strtolower(substr(DT_KEY, -6));if($CFG['authadmin'] == 'cookie') {	$_destoon_admin = get_cookie($secretkey);	$_destoon_admin = $_destoon_admin ? intval($_destoon_admin) : 0;} else {	$session = new dsession();	$_destoon_admin = isset($_SESSION[$secretkey]) ? intval($_SESSION[$secretkey]) : 0;}$_founder = $CFG['founderid'] == $_userid ? $_userid : 0;$_catids = $_childs = '';$_catid = $_child = array();if($DT['admin_log'] && $action != 'import') admin_log();if($DT['admin_online']) admin_online();$widget = isset($widget) ? intval($widget) : 0;$psize = isset($psize) ? intval($psize) : 0;if($psize > 0 && $psize != $pagesize) {	$pagesize = $psize;	$offset = ($page-1)*$pagesize;}if($module == 'destoon') {	(include DT_ROOT.'/admin/'.$file.'.inc.php') or msg();} else {	include DT_ROOT.'/module/'.$module.'/common.inc.php';	(include MD_ROOT.'/admin/'.$file.'.inc.php') or msg();}

这也是比较简单的加密,方法和楼上说的一样 就是echo

Statement:
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn