Cracking php code obfuscation encryption programs

Code obfuscation encryption-although it is an encryption method of the artifact, it is quite time-consuming to solve it manually, especially when there are a lot of encryption programs.
I am very happy today. I wrote a php decryption program. The decryption effect is perfect. Batch decryption is also a pleasure!

Note: The program will generate and delete tmp. php in the same directory.

<? Php

/*
* By 267014855
* 2011-7-18
*/

// $ File = 'Global. func. php ';
$ Hd = opendir ('./');
While ($ f = readdir ($ hd )){
If ($ f = '.' | $ f = '..') continue;

$ File = $ f;
$ Strs = file ($ file );
$ Code = $ strs [1];

If (strpos ($ code, '$ OOO0O0O00') = 0 ){
$ Arr = decode ($ code );
$ Arr = checkagain ($ arr );
// If the encryption is deep, multiple checkagain times
/*
// Output all the code of the file
$ Arr = checkagain ($ arr );
Echo '<pre> ';
Print_r ($ arr );
Echo '</pre> ';
*/

// Output useful code of the file
$ Arr = checkagain ($ arr, 1 );

File_put_contents ('jm _ '. $ file, "<? Php \ r \ n ". $ arr." \ r \ n?> ");
// Echo $ arr;
} Else
Echo 'decryption not required ';

}
//////////////////////////////////////// //////////////////
Function checkagain ($ arr, $ out = 0 ){
// It's almost the same without this function. Keep it a little and leave a bowl of rice for developers!
}

Function getrlcode ($ arr, $ key ){
$ Str = '<? Php '. "\ r \ n ";
Foreach ($ arr as $ v ){
$ Str. = $ v;
}
$ Str. = "?> ";
File_put_contents ('tmp. php', $ str );
Include 'tmp. php ';
Unlink ('tmp. php ');
Return $ key;
}

Function decode ($ str ){
Global $ file;
$ Codearr = $ tmpcodearr = array ();
$ Arr = explode (';', trim ($ str ));
$ I = 1;
Foreach ($ arr as $ v ){
$ V = trim ($ v );
$ V = str_replace ('_ FILE _', '\'. $ file. '\ '', $ v );
If ($ v = '?> ')
Break;
If ($ v = 'Return ')
Continue;
If (strpos ($ v, 'eval') = 0 ){
Unset ($ tmpcodearr );
$ Tmpcodearr = $ codearr;
$ Key = 'str'. $ I;
$ Tmpcodearr [] = '$'. $ key. '='. findstr ($ v). "; \ r \ n ";
$ Newstr = getrlcode ($ tmpcodearr, $ key );
Unset ($ tmpcodearr );
$ Tmpcodearr = explode (';', trim ($ newstr ));
Foreach ($ tmpcodearr as $ v ){
Trim ($ v) & $ codearr [] = trim ($ v). "; \ r \ n ";
}
$ I ++;
} Else {
$ Codearr [] = $ v. "; \ r \ n ";
}
}
Return $ codearr;
}

// Gbk File Format
Function findstr ($ str ){
$ I = 4;
While ($ str [$ I] = '('){
$ I ++;
}
Return substr ($ str, $ I, strlen ($ str)-$ I-($ I-4 ));
}
?>

From: WebShell's Blog