Micro-shield PHP script encryption expert decryption algorithm

Neeaosblog
A partner at work today took the code to check security. The code was encrypted and sweaty, similar to the following code:

<? Php // This file is protected by copyright law & provided under license. copyright (C) 2005-2009 www.vidun.com, All rights reserved. $ OOO0O0O00 =__ FILE __; $ OOO000000 = urldecode (% 74% 68% 36% 73% 62% 65% 68% 71% 6c % 61% 34% 6f % 5f % 63% 73% 61% 64% 6e % 72 ); $ OO00O0000 = 28; $ ooo=o0 = $ ooo=00 {4 }. $ OOO000000 {9 }. $ OOO000000 {3 }. $ ooo=00 {5}; $ ooo=o0. = $ OOO000000 {2 }. $ OOO000000 {10 }. $ OOO000000 {13 }. $ OOO000000 {16}; $ ooo=o0. = $ ooo=o0 {3 }. $ OOO000000 {11 }. $ OOO000000 {12 }. $ ooo=o0 {7 }. $ ooo1_00 {5}; $ o0o1_o0 = ooo1_o0; eval ($ o0o1_o0 (bytes
Bytes
Bytes
Bytes
Bytes
Bytes
Rows =); return;?> Bytes
Bytes
Bytes
HenNHenNHtL7eWplC2ivwunPFolVcM8PhTSYtI = It is obvious that some PHP code obfuscation tool is used to confuse Google. It was originally encrypted by the micro-shield PHP script and searched online, I didn't find a free decryption tool, so I studied it myself, wrote a decryption algorithm, and shared it to my friends who encountered the same problem.

In addition, I tested that the locally decrypted code can be read. Due to obfuscation of the Code, some of the restored code may be different from the original code and can be modified as needed.

<? Php

/***********************************
* Wei shield PHP encryption expert decryption algorithm By: Neeao
* Http://Neeao.com
* 2009-09-10
***********************************/

$ Filename = "install. php"; // file to be decrypted
$ Lines = file ($ filename); // 0, 1, 2 rows

// The first base64 decryption
$ Content = "";
If (preg_match ("/o0o1_o0 (. *)/", $ lines [1], $ y ))
{
$ Content = str_replace ("o0o1_o0 (", "", $ y [0]);
$ Content = str_replace (")", "", $ content );
$ Content = base64_decode ($ content );
}
// Search for the key in the content after the first base64 decryption
$ Decode_key = "";
If (preg_match ("/),. *,/", $ content, $ k ))
{
$ Decode_key = str_replace ("),", "", $ k [0]);
$ Decode_key = str_replace (",", "", $ decode_key );
}
// Intercept the encrypted ciphertext of the file
$ Secret = substr ($ lines [2], 380 );
// Echo $ Secret;

// Directly restores the ciphertext output
Echo "<? Php ". base64_decode (strtr ($ Secret, $ decode_key, ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 +/)."?> ";

?>