Php encryption and decryption, encryption and decryption

Php encryption and decryption, encryption and decryption

Test File

Test. php

<?php    echo "hello world.";?>

1. encryption method:

<? The php/* eval () function calculates the string according to the PHP code. The string must be a valid PHP code and must end with a semicolon. Replace strtr () with the character "ia" in the string to "eo": strtr ("Hilla Warld", "ia", "eo "); */function T_rndstr ($ length = "") {// returns a random string $ str = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"; if ($ length = "") {return str_shuffle ($ str);} else {return substr (str_shuffle ($ str),-$ length) ;}$ T_k1 = T_rndstr (); // random key 1 $ T_k2 = T_rndstr (); // random key 2 $ vstr = file_get_contents (". /test. php "); // the file to be encrypted $ v1 = base64_encode ($ Vstr); $ c = strtr ($ v1, $ T_k1, $ T_k2); // replace the corresponding character with the key $ c = $ T_k1. $ T_k2. $ c; // $ qn Variable Function $ isqs = 3; if ($ isqs = "1 ") {// 1 take the random string as the variable name $ q = T_rndstr (); // random string $ q1 = substr ($ q, 2, 3 ); $ q2 = substr ($ q, 10, 10); $ q3 = substr ($ q, 20, 12); $ q4 = substr ($ q, 30, 10 ); $ q5 = substr ($ q, 40, 8); $ q6 = substr ($ q, 5, 5);} else if ($ isqs = "2 ") {// 2 is composed of lowercase l and 1. It must start with $ q1 = "ll11l1l1"; $ q2 = "l1lll11l"; $ q3 = "Ll1l1lll"; $ q4 = "l1lll1l1"; $ q5 = "l1l1ll11"; $ q6 = "ll111l1l ";} else {// The basic variable $ q1 = "O00O0O"; $ q2 = "O0O000"; $ q3 = "O0OO00"; $ q4 = "OO0O00 "; $ q5 = "OO0000"; $ q6 = "O00OO0 ";} $ keystr = urldecode ("% 6E1% 7A % 62% 2F % 6D % 615% 5C % 76% 740% 2D % 6928% 70% 78% 75% 2A6% 6C % 71% 6B % 79% 72% 5F % 65% 68% 63% 73% 77% 6F4% 2B % 6637% 6A "); /* string, which must contain the characters required for the variable, such as base64_decoden1zb/ma5 \ vt0i28-pxuqy * 6lrkdg9_ehcswo4 + f37j $ q1 = Base $ q3 = strtr $ q4 = substr $ q5 = 52-> ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz length $ q1. = 64_decode-> base64_decode */$ s = '$ '. $ q6. '= urldecode ("% 6E1% 7A % 62% 2F % 6D % 615% 5C % 76% 740% 2D % 6928% 70% 78% 75% 71% 2A6% 6C % 79% 6B % 72% 64% 5F % 679% 68% 63% 73% 77% 6F4% 2B % 6637% 6A "); $ '. $ q1. '= $ '. $ q6. '{3 }. $ '. $ q6. '{6 }. $ '. $ q6. '{33 }. $ '. $ q6. '{30}; $ '. $ q3. '= $ '. $ q6. '{33 }. $ '. $ q6. '{10 }. $'. $ Q6. '{24 }. $ '. $ q6. '{10 }. $ '. $ q6. '{24}; $ '. $ q4. '= $ '. $ q3. '{0 }. $ '. $ q6. '{18 }. $ '. $ q6. '{3 }. $ '. $ q3. '{0 }. $ '. $ q3. '{1 }. $ '. $ q6. '{24}; $ '. $ q5. '= $ '. $ q6. '{7 }. $ '. $ q6. '{13}; $ '. $ q1. '. = $ '. $ q6. '{22 }. $ '. $ q6. '{36 }. $ '. $ q6. '{29 }. $ '. $ q6. '{26 }. $ '. $ q6. '{30 }. $ '. $ q6. '{32 }. $ '. $ q6. '{35 }. $ '. $ q6. '{26 }. $ '. $ q6. '{30}; eval ($ '. $ q1. '("'. base6 4_encode ('$'. $ q2. '= "'. $ c. '"; eval (\'?> \'. $ '. $ Q1. '($ '. $ q3. '($ '. $ q4. '($ '. $ q2. ', $ '. $ q5. '* 2), $ '. $ q4. '($ '. $ q2. ', $ '. $ q5. ', $ '. $ q5. '), $ '. $ q4. '($ '. $ q2. ', 0, $ '. $ q5. '))));'). '");'; echo $ s; file_put_contents ('. /test_encode.php ',' <? Php '. $ s.'?> ');?>

Run the encrypted command to generate the TEST_ENCODE.PHP file.

<?php $O00OO0=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");$O00O0O=$O00OO0{3}.$O00OO0{6}.$O00OO0{33}.$O00OO0{30};$O0OO00=$O00OO0{33}.$O00OO0{10}.$O00OO0{24}.$O00OO0{10}.$O00OO0{24};$OO0O00=$O0OO00{0}.$O00OO0{18}.$O00OO0{3}.$O0OO00{0}.$O0OO00{1}.$O00OO0{24};$OO0000=$O00OO0{7}.$O00OO0{13};$O00O0O.=$O00OO0{22}.$O00OO0{36}.$O00OO0{29}.$O00OO0{26}.$O00OO0{30}.$O00OO0{32}.$O00OO0{35}.$O00OO0{26}.$O00OO0{30};eval($O00O0O("JE8wTzAwMD0iTGhxQk16QW5Zc29qUlVmSVhKZVBGSFF2Q2FwRWtOVFpHY2lXdWxtYmdkclZ5S3R3RFNPeER2Z2pick1mT1hreXVHaFlTVW5FcFF3b1B0Y2lLQ2VSTkhkWlZhVElGc0FMeGxxV3ptSkJFejlXdFFNQ1BkTUZZUGphTzJ2b1lQVWtSWkJYSXhqM0kzVVhSUDRkSlcwbFl6OCt6d2s9IjtldmFsKCc/PicuJE8wME8wTygkTzBPTzAwKCRPTzBPMDAoJE8wTzAwMCwkT08wMDAwKjIpLCRPTzBPMDAoJE8wTzAwMCwkT08wMDAwLCRPTzAwMDApLCRPTzBPMDAoJE8wTzAwMCwwLCRPTzAwMDApKSkpOw=="));?>

　　

Analysis

<? Php // All $ O00OO and so on are variables !!! /* % 6E1% 7A % 62% 2F % 6D % 615% 5C % 76% 740% 6928% 2D % 70% 78% 75% 71% 2A6% 6C % 79% 6B % 72% 5F % 64% 679% 65% 73% 77% 6F4% 2B % 6637% 6 decoded into n1zb/ma5 \ vt0i28-pxuqy * 6lrkdg9_ehcswo4 + f37j and assigned to $ O00OO0 */$ O00OO0 = urldecode ("% 6E1% 7A % 62% 2F % 6D % 615% 5C % 76% 740% 2D % 6928% 70% 78% 75% 71% 2A6% 6C % 79% 6B % 72% 64% 5F % 679% 65% 68% 63% 6F4% 2B % 73% 6A "); // get the corresponding character from $ O00OO0 and other variable strings to form a new string, and assigned to the corresponding variable // for example $ O00OO0 {3} represents n1zb/ma5 \ vt0i28-pxuqy * 6lrkdg9_ehcswo4 + f37j The third character in the string, B // $ O00O0O = "base" $ O00O0O = $ O00OO0 {3 }. $ O00OO0 {6 }. $ O00OO0 {33 }. $ O00OO0 {30}; // $ O0OO00 = "strtr" $ O0OO00 = $ O00OO0 {33 }. $ O00OO0 {10 }. $ O00OO0 {24 }. $ O00OO0 {10 }. $ O00OO0 {24}; // $ OO0O00 = "substr" $ OO0O00 = $ O0OO00 {0 }. $ O00OO0 {18 }. $ O00OO0 {3 }. $ O0OO00 {0 }. $ O0OO00 {1 }. $ O00OO0 {24}; // $ OO0000 = "52" $ OO0000 = $ O00OO0 {7 }. $ O00OO0 {13}; // $ O00O0O = "base64_decode" $ O00O0O. = $ O00OO0 {22 }. $ O00OO0 {36 }. $ O00OO0 {29 }. $ O00OO0 {2 6 }. $ O00OO0 {30 }. $ O00OO0 {32 }. $ O00OO0 {35 }. $ O00OO0 {26 }. $ O00OO0 {30}; // then run the php code eval ($ O00O0O ("example/Example Encoding = ");/* eval executes the following PHP code. The first step is to decode $ O00O0O to" base64_decode ". That is, after base64 decoding of the subsequent strings $ O0O000 = "bytes + zwk ="; eval ('?> '. $ O00O0O ($ O0OO00 ($ OO0O00 ($ O0O000, $ OO0000 * 2), $ OO0O00 ($ O0O000, $ OO0000, $ OO0000), $ OO0O00 ($ O0O000, 0, $ OO0000); the second step is to execute the decoded code and then return it as another code, according to the encryption algorithm, the value of the variable $ O0O000 is the key 1 + key 2 + Source Code encoded and replaced string. Here, the replaced string is restored first, then perform base64_decode decoding to obtain the original code !!! Note: The Source Code already contains <? Php?>, So you must add '?> '*/?>

　　

2. Decryption Method

<? Php // The encrypted file format must be fixed !! /* $ O00OO0 = urldecode ("% 6E1% 7A % 62% 2F % 6D % 615% 5C % 76% 740% 2D % 6928% 70% 78% 75% 2A6% 6C % 71% 6B % 79% 72% 5F % 65% 68% 63% 73% 6F4% 2B % 77% 6A "); $ O00O0O = $ O00OO0 {3 }. $ O00OO0 {6 }. $ O00OO0 {33 }. $ O00OO0 {30}; $ O0OO00 = $ O00OO0 {33 }. $ O00OO0 {10 }. $ O00OO0 {24 }. $ O00OO0 {10 }. $ O00OO0 {24}; $ OO0O00 = $ O0OO00 {0 }. $ O00OO0 {18 }. $ O00OO0 {3 }. $ O0OO00 {0 }. $ O0OO00 {1 }. $ O00OO0 {24}; $ OO0000 = $ O00OO0 {7 }. $ O00OO0 {13}; $ O00O0O. = $ O00OO0 {22 }. $ O00OO0 {36 }. $ O00OO0 {29 }. $ O00OO0 {26 }. $ O00OO0 {30 }. $ O00OO0 {32 }. $ O00OO0 {35 }. $ O00OO0 {26 }. $ O00OO0 {30}; eval ($ O00O0O ("JE8wTzAwMD0iTmV5SElCamZRdk ...... 1UYVNuUUpnY21UYVVoOCtoTm89IjtldmFsKCc/= ");?> * // The file to be decrypted. Remove the php identifier $ encode_sourcecode = file_get_contents ("./test_e.php"); $ encode_sourcecode = str_replace ('<? Php ', '', $ encode_sourcecode); $ encode_sourcecode = str_replace ('?> ', '', $ Encode_sourcecode); // extract the content to be decrypted for the first time. // JE8wTzAwMD0iTmV5SElCamZRdk ...... response/= echo '</br> ---------------------------- $ encode_sourcecode_content </br>'; $ start = strripos ($ encode_sourcecode, '("') + 2; $ end = strripos ($ encode_sourcecode, '")'); $ encode_sourcecode_content = substr ($ encode_sourcecode, $ start, $ end-$ start); echo $ encode_sourcecode_conte Nt; // decrypt the encrypted part of the code. // $ O0O000 = "NeyHIBjfQvDMwo ...... joSptgMdl3M3JgSKQTiB0nuh8 + hNo = "; eval ('...... OO0000); echo '</br> response $ decode_sourcecode_content </br>'; $ decode_sourcecode_content = base64_decode ($ encode_sourcecode_content); echo $ response; // After decryption, it is still an encrypted code that needs to be decoded again. Therefore, you need to extract the content to be decrypted again. // that is, NeyHIBjfQvDMwo ...... joSptgMdl3M3JgSKQTiB0nuh8 + hNo = echo '</B R> </br> ---------------------------- $ scheme </br> '; $ start = stripos ($ decode_sourcecode_content,' "') + 1; $ end = strripos ($ decode_sourcecode_content, '"'); $ response = substr ($ decode_sourcecode_content, $ start, $ end-$ start); echo $ decode_sourcecode_content_encode_content; // replace and decode the characters according to the encryption rules, you can get the source file echo '</br> --------------- --------------- $ Response </br> '; $ origin_content = base64_decode (strtr (substr ($ response, 104), substr ($ decode_sourcecode_content_encode_content, 52, 52), substr ($ response, 0, 52); var_dump ($ origin_content); file_put_contents ('. /test_origin.php ', $ origin_content);?>