Decode php file

article mainly introduces decoding PHP files, which has certain reference value. Now I share it with everyone. Friends in need can refer to it.

Yesterday, I discovered a long-hidden backdoor written in PHP language. Out of curiosity, I opened the file and found that the code had been encrypted.

When I saw the framed code, I knew that it was decrypted using gzuncompress and base64_decode, so I changed eval to echo and output it, and found that the output result was not what I wanted. The result is php mixed with html.
The first thing I thought of was to copy the code in the console, but after running it I found errors everywhere. Obviously this method is not very feasible.
As a programmer, I am committed to making tedious events simple with a few lines of code, so I wrote a few lines of code:
decode.php

$fp1 = fopen ("encoded.txt", "r");  
$contents = fread ($fp1, filesize ("encoded.txt"));  
fclose($fp1);  
$contents=gzuncompress(base64_decode($contents)); 
$fp2 = fopen("decoded.txt","w"); 
fwrite($fp2,trim($contents)); 
fclose($fp2);

Create encoded.txt and decoded. txt, copy the ciphertext to the encode.txt file, access decode.php, put the decrypted file in decoded.txt, replace the ciphertext of the backdoor file, access it, and it runs normally.

The above is the detailed content of Decode php file. For more information, please follow other related articles on the PHP Chinese website!