php !function_exists(T7FC56270E7A70FA81A5935B72EACBE29))代码解密

今天在百度知道上面有个朋友问php代码解密的问题，看了代码不是常见几种比较感兴趣，特意搜索了下，发现下面的方法，解决了，具体的看最后的说明。

复制代码 代码如下:

< ?php if (!function_exists("T7FC56270E7A70FA81A5935B72EACBE29")) { function T7FC56270E7A70FA81A5935B72EACBE29($TF186217753C37B9B9F958D906208506E) { $TF186217753C37B9B9F958D906208506E = base64_decode($TF186217753C37B9B9F958D906208506E); $T7FC56270E7A70FA81A5935B72EACBE29 = 0; $T9D5ED678FE57BCCA610140957AFAB571 = 0; $T0D61F8370CAD1D412F80B84D143E1257 = 0; $TF623E75AF30E62BBD73D6DF5B50BB7B5 = (ord($TF186217753C37B9B9F958D906208506E[1]) << 8) ord($TF186217753C37B9B9F958D906208506E[2]); $T3A3EA00CFC35332CEDF6E5E9A32E94DA = 3; $T800618943025315F869E4E1F09471012 = 0; $TDFCF28D0734569A6A693BC8194DE62BF = 16; $TC1D9F50F86825A1A2302EC2449C17196 = ""; $TDD7536794B63BF90ECCFD37F9B147D7F = strlen($TF186217753C37B9B9F958D906208506E); $TFF44570ACA8241914870AFBC310CDB85 = __FILE__; $TFF44570ACA8241914870AFBC310CDB85 = file_get_contents($TFF44570ACA8241914870AFBC310CDB85); $TA5F3C6A11B03839D46AF9FB43C97C188 = 0; preg_match(base64_decode("LyhwcmludHxzcHJpbnR8ZWNobykv"), $TFF44570ACA8241914870AFBC310CDB85, $TA5F3C6A11B03839D46AF9FB43C97C188); for (;$T3A3EA00CFC35332CEDF6E5E9A32E94DA<$TDD7536794B63BF90ECCFD37F9B147D7F;) { if (count($TA5F3C6A11B03839D46AF9FB43C97C188)) exit; if ($TDFCF28D0734569A6A693BC8194DE62BF == 0) { $TF623E75AF30E62BBD73D6DF5B50BB7B5 = (ord($TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA ]) << 8); $TF623E75AF30E62BBD73D6DF5B50BB7B5 = ord($TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA ]); $TDFCF28D0734569A6A693BC8194DE62BF = 16; } if ($TF623E75AF30E62BBD73D6DF5B50BB7B5 & 0x8000) { $T7FC56270E7A70FA81A5935B72EACBE29 = (ord($TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA ]) << 4); $T7FC56270E7A70FA81A5935B72EACBE29 = (ord($TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA]) >> 4); if ($T7FC56270E7A70FA81A5935B72EACBE29) { $T9D5ED678FE57BCCA610140957AFAB571 = (ord($TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA ]) & 0x0F) 3; for ($T0D61F8370CAD1D412F80B84D143E1257 = 0; $T0D61F8370CAD1D412F80B84D143E1257 < $T9D5ED678FE57BCCA610140957AFAB571; $T0D61F8370CAD1D412F80B84D143E1257 ) $TC1D9F50F86825A1A2302EC2449C17196[$T800618943025315F869E4E1F09471012 $T0D61F8370CAD1D412F80B84D143E1257] = $TC1D9F50F86825A1A2302EC2449C17196[$T800618943025315F869E4E1F09471012-$T7FC56270E7A70FA81A5935B72EACBE29 $T0D61F8370CAD1D412F80B84D143E1257]; $T800618943025315F869E4E1F09471012 = $T9D5ED678FE57BCCA610140957AFAB571; } else { $T9D5ED678FE57BCCA610140957AFAB571 = (ord($TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA ]) << 8); $T9D5ED678FE57BCCA610140957AFAB571 = ord($TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA ]) 16; for ($T0D61F8370CAD1D412F80B84D143E1257 = 0; $T0D61F8370CAD1D412F80B84D143E1257 < $T9D5ED678FE57BCCA610140957AFAB571; $TC1D9F50F86825A1A2302EC2449C17196[$T800618943025315F869E4E1F09471012 $T0D61F8370CAD1D412F80B84D143E1257 ] = $TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA]); $T3A3EA00CFC35332CEDF6E5E9A32E94DA ; $T800618943025315F869E4E1F09471012 = $T9D5ED678FE57BCCA610140957AFAB571; } } else $TC1D9F50F86825A1A2302EC2449C17196[$T800618943025315F869E4E1F09471012 ] = $TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA ]; $TF623E75AF30E62BBD73D6DF5B50BB7B5 <<= 1; $TDFCF28D0734569A6A693BC8194DE62BF--; if ($T3A3EA00CFC35332CEDF6E5E9A32E94DA == $TDD7536794B63BF90ECCFD37F9B147D7F) { $TFF44570ACA8241914870AFBC310CDB85 = implode("", $TC1D9F50F86825A1A2302EC2449C17196); $TFF44570ACA8241914870AFBC310CDB85 = "?".">".$TFF44570ACA8241914870AFBC310CDB85."< "."?"; return $TFF44570ACA8241914870AFBC310CDB85; } } } } eval(T7FC56270E7A70FA81A5935B72EACBE29("一大堆貌似base64_encode后的代码")); ?>

直接将eval替换成echo,结果页面为空白！真郁闷，这招可是百发百中的啊，今天遇到了高人写的代码。。。

慢慢替换，将长变量替换成短的，增强代码可读性。

复制代码 代码如下:

if (!function_exists("bear01″))
{
函数 bear01($bear02)
{
$bear02 = base64_decode($bear02);
$bear01 = 0;
$bear03 = 0;
$bear04 =
$bear05 = (ord($bear02[1]) $bear06 = 3;
$bear07 = 0;
$bear09 = "";
$bear10 = strlen($bear02); ;
$bear11 = file_get_contents($bear11);
$bear12 = 0;
preg_match("LyhwcmludHxzcHJpbnR8ZWNobykv"), $bear11, $bear12); /
for (;$bear06{
if (count($bear12)) 退出
if ($bear08 == 0)
{
$ bear05 = (ord($bear02[$bear06 ]) $bear05 = ord($bear02[$bear06 ]);
$bear08 = 16; if ($bear05 & 0×8000)
{
$bear01 = (ord($bear02[$bear06 ]) $bear01 = (ord($bear02[$bear06]); ]) >> 4);
if ($bear01)
{
$bear03 = (ord($bear02[$bear06 ]) & 0x0F)
for ($bear04 = 0; $bear04 $bear09[$bear07 $bear04] = $bear09[$bear07-$bear01 $bear04];
$bear07 = $bear03;
}
其他
{
$bear03 = (ord($bear02[$bear06 ]) $bear03 = ord($bear02[$bear06 ]) 16;
for ($bear04 = 0; $bear04 $bear06 ; $bear07 = $bear03;
}
}
其他
$bear09[$bear07] = $bear02[$bear06];
$bear05 $bear08–;
if ($bear06 == $bear10)
{
$bear11 = 内爆("", $bear09);
$bear11 = "?".">".$bear11."返回$bear11;
}
}
}
}
eval(bear01("一大堆像素base64_encode后的代码")); ？>


其中
preg_match(base64_decode("LyhwcmludHxzcHJpbnR8ZWNobykv"), $bear11, $bear12);

缩放扎眼，解码出来就是

/(print|sprint|echo)/
哈哈，echo就在里面，将
/(print|sprint)/
base64_encode一下然后替换，eval替换隐藏成echo输出，被的代码终于重见天日。
其实简单的就是分三步即可：
第一步：搜索preg_match(base64_decode("LyhwcmludHxzcHJpbnR8ZWNobykv")替换为：preg_match (base64_decode("LyhwcmludHxzcHJpbnQpLw==")即可
第二步：将eval(T7FC56270E7A70FA81A5935B72EACBE29字符串中的下面的eval替换为echo或print即可
第三步：然后查看源文件即可看到php代码(右键-查看源文件)。