An encrypted PHP file is encountered and the decode process is written down

A friend in the morning let me help to see a PHP file, inside is garbled, change any one character will abort the run.

The file has only one row, and the following is part of the content:

The middle omits a bunch of character encodings, and the final content is

2kx9yhsqyo/d+5+fnpf+v/bsrlfeg= ')); return;? >5e813 ... 32-bit MD5 .... 3f6

Started using Zendstudio+xdebug tracking again, found that for this kind of compression in one line of code, debugging is simply powerless Ah! Breakpoints are not up.

Have a half-day or no effect, simply solve it by hand.

A simple look, just the variable name with some of the more special characters to replace, open with the editor, a few duplicate occurrences of the keyword replaced, you can see the approximate.

It also uses a custom function, which has been provided at the beginning of the file, that is, "蜖 棁 ㄔ┄ Opposita".

function 蜖 棁 ㄔ┄ opposita ($A, $B = "") {$A =base64_decode ($A), if (Empty ($A)) return "", if ($B = = "") {return ~ $A;} else{$D =strlen ($A), $B =str_pad ($B, $D, $B); $str = $A ^ $B; return $str;}}

After a few simple substitutions, you know what's in each field.

First, start with the Eval function, followed by 2 decryption functions, the function name is stored in the array. Similar

 
You can see the key code that cannot be run after the modification:
$A =file_get_contents (' origin.php '); @substr ($A, -32) ==md5 (substr (substr ($A, 0,-32). ' Another 32-bit MD5', 6) | | Die ();
After commenting out, proceed to the following code:

Again an eval, in decryption ...
Because the decrypted file is garbled, can not be directly used copy&paste, must be binary to write a file, and then after some substitution, decryption, and then write a file ... After a total of 5 rounds of decryption, finally get the source file.
Finally tidied up and wrote a regular to fix this file, directly remove the file.
  
Related code: http://download.csdn.net/detail/sbdx/8616319
                                                
The above describes the encounter an encrypted PHP file, the decode process written down, including aspects of the content, I hope the PHP tutorial interested in a friend helpful.
