Php! Function_exists (T7FC56270E7A70FA81A5935B72EACBE29) code decryption

Today, I learned from Baidu that a friend asked me about php code decryption. I was interested in the code. I searched for it and found the following solution, for details, refer to the final description.

Today, I learned from Baidu that a friend asked me about php code decryption. I was interested in the code. I searched for it and found the following solution, for details, refer to the final description.

The Code is as follows:

<? Php if (! Function_exists ("member") {function compute ($ member) {$ member = base64_decode ($ member); $ member = 0; $ T9D5ED678FE57BCCA610140957AFAB571 = 0; $ member = 0; $ TF623E75AF30E62BBD73D6DF5B50BB7B5 = (ord ($ TF186217753C3 7B9B9F958D906208506E [1]) <8) + ord ($ pipeline [2]); $ pipeline = 3; $ pipeline = 0; $ pipeline = 16; $ pipeline = ""; $ response = strlen ($ response); $ tff44570aca%1914870afbc310cdb85 =_ _ FILE __; $ tff44570aca%1914870afbc310cdb8 5 = file_get_contents ($ response); $ response = 0; preg_match (base64_decode ("LyhwcmludHxzcHJpbnR8ZWNobykv"), $ response, $ response); for (; $ response <$ response ;) {if (count ($ TA5F3C6A11B03839D46AF9FB43C97C188) exit; if ($ TDFCF28D0734569A6A693BC8194DE62B F = 0) {$ TF623E75AF30E62BBD73D6DF5B50BB7B5 = (ord ($ token [$ t3a3ea00cfc%32cedf6e5e9a32e94da ++]) <8 ); $ token + = ord ($ token [$ t3a3ea00cfc000032cedf6e5e9a32e94da ++]); $ token = 16;} if ($ token & 0x8000) {$ token = (ord ($ TF186217753C3 7B9B9F958D906208506E [$ pipeline ++]) <4); $ pipeline ++ = (ord ($ pipeline [$ pipeline])> 4); if ($ pipeline) {$ T9D5ED678FE57BCCA610140957AFAB571 = (ord ($ token [$ t3a3ea00cfc000032cedf6e5e9a32e94da ++]) & 0x0F) + 3; for ($ token = 0; $ response <$ response; $ response ++) $ response [$ response + $ Response] = $ TC1D9F50F86825A1A2302EC2449C17196 [$ response-$ response + $ Response]; $ response + = $ Signature;} else {$ T9D5ED678FE57BCCA610140957AFAB571 = (ord ($ token [$ t3a3ea00cfc%32cedf6e5e9a32e94da ++]) <8 ); $ token + = ord ($ token [$ t3a3ea00cfc000032cedf6e5e9a32e94da ++]) + 16; for ($ token = 0; $ token <$ T9D5ED678FE57BCCA610140 957AFAB571; $ TC1D9F50F86825A1A2302EC2449C17196 [$ scheme + $ scheme ++] = $ Scheme [$ Scheme]); $ scheme ++ = $ scheme ;}} else $ TC1D9F50F86825A1A2302EC2449C17196 [$ T800618943025315F869E4E1F09471012 +] = $ TF186217 Pipeline [$ pipeline ++]; $ pipeline <= 1; $ pipeline --; if ($ pipeline ==$ pipeline) {$ tff44570acapipeline 1914870afbc310cdb85 = implode ("", $ TC1D9F50F86825A1A2302EC2449C17196); $ tff44570aca4241914870afbc310cdb85 = "? "."> ". $ Tff44570aca4241914870afbc310cdb85." <"."? "; Return $ tff44570aca4241914870afbc310cdb85; }}} eval (T7FC56270E7A70FA81A5935B72EACBE29 (" a lot of base64_encode-based code ");?>

Directly replace eval with echo, and the result page is blank! It's really depressing. It's just a hundred million people. Today I met the code written by someone else...

Replace long variables with short ones to improve code readability.

The Code is as follows:

<? Php
If (! Function_exists ("bear01 ″))
{
Function bear01 ($ bear02)
{
$ Bear02 = base64_decode ($ bear02 );
$ Bear01 = 0;
$ Bear03 = 0;
$ Bear04 = 0;
$ Bear05 = (ord ($ bear02 [1]) <8) + ord ($ bear02 [2]);
$ Bear06 = 3;
$ Bear07 = 0;
$ Bear08 = 16;
$ Bear09 = "";
$ Bear10 = strlen ($ bear02 );
$ Bear11 = _ FILE __;
$ Bear11 = file_get_contents ($ bear11 );
$ Bear12 = 0;
Preg_match (base64_decode ("LyhwcmludHxzcHJpbnR8ZWNobykv"), $ bear11, $ bear12); // (print | sprint | echo )/
For (; $ bear06 <$ bear10 ;)
{
If (count ($ bear12) exit;
If ($ bear08 = 0)
{
$ Bear05 = (ord ($ bear02 [$ bear06 ++]) <8 );
$ Bear05 + = ord ($ bear02 [$ bear06 ++]);
$ Bear08 = 16;
}
If ($ bear05 & 0 ×8000)
{
$ Bear01 = (ord ($ bear02 [$ bear06 ++]) <4 );
$ Bear01 + = (ord ($ bear02 [$ bear06])> 4 );
If ($ bear01)
{
$ Bear03 = (ord ($ bear02 [$ bear06 ++]) & 0x0F) + 3;
For ($ bear04 = 0; $ bear04 <$ bear03; $ bear04 ++)
$ Bear09 [$ bear07 + $ bear04] = $ bear09 [$ bear07-$ bear01 + $ bear04];
$ Bear07 + = $ bear03;
}
Else
{
$ Bear03 = (ord ($ bear02 [$ bear06 ++]) <8 );
$ Bear03 + = ord ($ bear02 [$ bear06 ++]) + 16;
For ($ bear04 = 0; $ bear04 <$ bear03; $ bear09 [$ bear07 + $ bear04 +] = $ bear02 [$ bear06]);
$ Bear06 ++; $ bear07 + = $ bear03;
}
}
Else
$ Bear09 [$ bear07 ++] = $ bear02 [$ bear06 ++];
$ Bear05 <= 1;
$ Bear08 -;
If ($ bear06 ==$ bear10)
{
$ Bear11 = implode ("", $ bear09 );
$ Bear11 = "? "."> ". $ Bear11." <"."? ";
Return $ bear11;
}
}
}
}
Eval (bear01 ("a lot of code that looks like base64_encode");?>

Where
Preg_match (base64_decode ("LyhwcmludHxzcHJpbnR8ZWNobykv"), $ bear11, $ bear12 );

This is especially eye-catching, and decode is
/(Print | sprint | echo )/
Haha, echo is in it.
/(Print | sprint )/
Base64_encode and then replace it with the eval with the echo output. The hidden code can be seen again in the sky.
In fact, it is easy to do so in three steps:
Step 1: Search for preg_match (base64_decode ("LyhwcmludHxzcHJpbnR8ZWNobykv") with preg_match (base64_decode ("LyhwcmludHxzcHJpbnQpLw = ").
Step 2: replace the following eval In the eval (T7FC56270E7A70FA81A5935B72EACBE29 string with echo or print.
Step 3: view the source file to see the php code (right-click to view the source file ).