An encrypted PHP file is encountered and the decode process is written down

Source: Internet
Author: User
A friend in the morning let me help to see a PHP file, inside is garbled, change any one character will abort the run.

The file has only one row, and the following is part of the content:

The middle omits a bunch of character encodings, and the final content is

2kx9yhsqyo/d+5+fnpf+v/bsrlfeg= ')); return;? >5e813 ... 32-bit MD5 .... 3f6

Started using Zendstudio+xdebug tracking again, found that for this kind of compression in one line of code, debugging is simply powerless Ah! Breakpoints are not up.

Have a half-day or no effect, simply solve it by hand.

A simple look, just the variable name with some of the more special characters to replace, open with the editor, a few duplicate occurrences of the keyword replaced, you can see the approximate.

It also uses a custom function, which has been provided at the beginning of the file, that is, "蜖 棁 ㄔ┄ Opposita".

function 蜖 棁 ㄔ┄ opposita ($A, $B = "") {$A =base64_decode ($A), if (Empty ($A)) return "", if ($B = = "") {return ~ $A;} else{$D =strlen ($A), $B =str_pad ($B, $D, $B); $str = $A ^ $B; return $str;}}

After a few simple substitutions, you know what's in each field.


First, start with the Eval function, followed by 2 decryption functions, the function name is stored in the array. Similar

 

You can see the key code that cannot be run after the modification:

$A =file_get_contents (' origin.php '); @substr ($A, -32) ==md5 (substr (substr ($A, 0,-32). ' Another 32-bit MD5', 6) | | Die ();

After commenting out, proceed to the following code:


Again an eval, in decryption ...

Because the decrypted file is garbled, can not be directly used copy&paste, must be binary to write a file, and then after some substitution, decryption, and then write a file ... After a total of 5 rounds of decryption, finally get the source file.

Finally tidied up and wrote a regular to fix this file, directly remove the file.

  

Related code: http://download.csdn.net/detail/sbdx/8616319

The above describes the encounter an encrypted PHP file, the decode process written down, including aspects of the content, I hope the PHP tutorial interested in a friend helpful.

  • Related Article

    Contact Us

    The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

    If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

    A Free Trial That Lets You Build Big!

    Start building with 50+ products and up to 12 months usage for Elastic Compute Service

    • Sales Support

      1 on 1 presale consultation

    • After-Sales Support

      24/7 Technical Support 6 Free Tickets per Quarter Faster Response

    • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.